Mexico's Anti-Money Laundering Law: Vulnerable Activities and Notices to the UIF

A foreign company with a Mexican subsidiary, or one that sells to Mexican buyers, often cannot tell whether Mexico's anti-money laundering law reaches it. The answer does not depend on size. It depends on whether the business carries out one of the vulnerable activities the law lists.

At Soulbit Academy we go deep on Mexico here, as of October 2026. The three-country comparison is in our guide to anti-money laundering rules in Colombia, Mexico and Brazil, and we do not repeat it.

Mexico's Anti-Money Laundering Law: What the LFPIORPI Covers and Who Supervises It

Mexico's anti-money laundering law is the Federal Law for the Prevention and Identification of Operations with Resources of Illicit Origin (LFPIORPI), published in the Official Gazette on October 17, 2012. Its current text was last amended on July 16, 2025.

The law does not ask what kind of company you are, but what you do. Article 17 lists the vulnerable activities, Article 18 sets the duties of whoever performs them, and Articles 52 to 54 and 62 cover penalties.

Supervision belongs to the Ministry of Finance and Public Credit, known as Hacienda (Article 22 Bis), which receives notices electronically. Its Financial Intelligence Unit (UIF) is the country's financial intelligence authority. The law makes notices and the identity of the filer confidential (Article 38).

Who falls outside the law?

Anyone who does not carry out an Article 17 activity. Acts below the notice amount do not trigger a notice, although they may still require identification, and every commercial company keeps its beneficial-owner duties under Articles 33 Bis and 33 Ter. There is one caveat: if a person accumulates operations over six months that exceed the notice amount, the sum can be treated as an operation subject to notice.

Vulnerable Activities in Article 17: The Catalog and Paragraph XVI on Virtual Assets

Article 17 lists vulnerable activities in sixteen paragraphs, plus paragraph V Bis added in 2025. Each paragraph carries its own amounts.

For a company outside finance, the notable ones are real estate development and brokerage (V and V Bis), precious metals, jewelry and watches (VI), artworks (VII), vehicles (VIII), loans by parties that are not financial entities (IV), independent professional services handling client funds (XI), customs agents (XIV), real estate leasing (XV) and virtual assets (XVI).

Paragraph XVI matters most to crypto-active companies; the framework for financial technology institutions is covered in our guide to the Fintech Law and crypto assets for Mexican companies. The activity is the habitual and professional exchange of virtual assets by parties other than financial entities, through electronic platforms. It reaches whoever facilitates purchases and sales of clients' assets, or provides the means to custody, store or transfer virtual assets.

The 2025 reform made explicit that operations with Mexican citizens from another jurisdiction are included. It also requires obtaining and keeping information on the originator, the recipient and, where relevant, the controlling beneficial owner.

The law defines a virtual asset as any representation of value recorded electronically and used among the public as a means of payment. It excludes legal tender, foreign currencies and any other asset denominated in legal tender or foreign currency. Whether a currency-referenced stablecoin falls inside or outside that definition is a matter of interpretation this article does not settle: take it to specialized counsel and to the general rules.

UMA Thresholds: When a Notice Is Due and What It Means in Pesos in 2026

The thresholds are expressed as multiples of the daily Measurement and Update Unit (UMA), not in pesos. INEGI announced in the Official Gazette of January 9, 2026 that the daily UMA is 117.31 pesos from February 1, 2026, per the official INEGI document. It is updated every year.

With that value we convert the notice amounts of some paragraphs. The peso figures are our own calculation, rounded to the cent, and change with each update.

Article 17 paragraph	Activity	Notice from (times the UMA)	In pesos (UMA of 117.31)
XVI, item a	Virtual assets: each client's operation	210	24,635.10
XVI, item b	Virtual assets: fee charged for the service	4	469.24
II	Prepaid cards or stored-value instruments, per operation	645	75,664.95
IV	Loans by parties that are not financial entities	1,605	188,282.55
XV	Real estate leasing, monthly amount	3,210	376,565.10
VIII	New or used vehicles	6,420	753,130.20
V and V Bis	Construction, development and brokerage of real estate	8,025	941,412.75

For virtual assets the notice threshold is low compared with other paragraphs, and there are two alternatives: one on the client's operation amount and one on the fee charged. Check the current text and Hacienda's general rules for the amount from which a paragraph XVI client must be identified, because the identification threshold may differ from the notice threshold.

Article 18 Duties, SAT Portal Registration and Notices

Whoever carries out a vulnerable activity has twelve duties in Article 18 after the 2025 reform. Five matter most to a finance team.

The first is identifying the client and verifying identity with official documents, keeping a copy, and asking about their activity or occupation when a business relationship exists (paragraphs I and II).

The second is identifying the controlling beneficial owner. For a legal entity, trust or other structure, the documents that identify it are collected; for an individual, a statement on whether one exists (paragraph III).

The third is keeping the supporting records that allow operations to be reconstructed, for at least ten years from the activity, except for paragraph XIV (paragraph IV).

The fourth is registering. The reform added registration, modification or deregistration in the Registry of persons carrying out vulnerable activities (paragraph IV Bis), done on the tax authority's anti-money laundering portal (SPPLD) with an electronic signature (e.firma). Article 20 also requires legal entities to appoint a compliance representative before Hacienda, with annual training.

The fifth is filing notices (paragraph VI). Ordinary notices are due by the 17th of the month after the operation (Article 23): a March operation is reported by April 17. The notice includes the filer's data, the client and its controlling beneficial owner, and a description of the activity (Article 24).

The suspicion notice is more urgent. Article 18, paragraph VI, requires filing within 24 hours of learning of facts or indications that funds could come from, or be destined for, money laundering offenses. It applies even if the operation was not completed.

Must anything be filed if there were no operations in the month?

The law does not expressly regulate a nil report; the general rules and the portal do. Before you stop filing, confirm in the current rule and in the SPPLD when a zero report applies.

If the client refuses to provide the information, Article 21 lets the obligated party decline the operation without liability. Paragraphs VII to XI are new since 2025: risk assessment, internal policy manual, annual training, automated monitoring and an annual review by internal or external audit.

Penalties Under the Anti-Money Laundering Law: Fines in UMA and Prison for False Information

The law imposes administrative fines set by Hacienda (Article 52, treated as tax credits) and prison for false information. At the UMA of 117.31 pesos, the fines in Articles 53 and 54 read as follows (our conversion):

• Failing to answer Hacienda's requests, breaching Article 18 duties, late notices (up to 30 days) or notices lacking requirements: 200 to 2,000 times the UMA, that is, 23,462 to 234,620 pesos.
• Breaching the beneficial ownership duties of commercial companies (Articles 33, 33 Bis and 33 Ter): 2,000 to 10,000 times the UMA, 234,620 to 1,173,100 pesos.
• Omitting notices or taking part in operations prohibited by Article 32: 10,000 to 65,000 times the UMA, 1,173,100 to 7,625,150 pesos, or 10% to 100% of the operation's value if quantifiable, whichever is greater.

A notice filed more than 30 days late is treated as an omission (Article 53, paragraph III). In criminal law, Article 62 punishes with two to eight years in prison, and five hundred to two thousand days of fine, anyone who provides false information for a notice, alters it or submits it illegible. Since 2025 it admits negligent commission, and a vincible mistake corrected spontaneously before the authority learns of it is not punished.

Article 54 Bis also lets Hacienda order the temporary suspension of operations with certain persons.

What the 2025 Reform Changed and What Counterparties Will Ask You For

The reform published in the Official Gazette on July 16, 2025 took effect the next day. It made five main changes: new Article 18 paragraphs (registry, risk, manual, training, monitoring, audit), paragraph V Bis of Article 17, a reworded paragraph XVI, Articles 33 Bis and 33 Ter on the beneficial owner of commercial companies, and Article 54 Bis.

The second transitory article gave Hacienda twelve months to amend the general rules, a term that ended in July 2026. Check the Official Gazette for which rules were issued and when the new duties take effect.

If you are a foreign company, even one that carries out no vulnerable activity, these duties reach you as the client or counterparty of someone who does.

Obligated party's duty	Article	What it may ask of your company
Identify and verify the client	18, paragraph I	Official ID of the person or representative, and a copy
Know the client's activity or occupation	18, paragraph II	Economic activity, supported by its tax registration
Identify the controlling beneficial owner	18, paragraph III	Ownership structure up to the person who controls the company
Keep records for ten years	18, paragraph IV	Up-to-date documents that can be archived
Detect out-of-profile operations	18, paragraph X	Source of funds and transactional profile
Decline if information is missing	21	Timely answers; if you refuse, the operation may not proceed

A hypothetical example: a US company with a Mexican subsidiary sells equipment to a Mexican real estate developer. That buyer, bound by paragraph V, will ask for corporate documents, the controlling beneficial owner of the group and an explanation of the payments. It is an illustrative assumption.

To organize that file, our guide to what KYB is describes what gets verified. For international payments, see sanctions list screening.

What Soulbit V1 Delivers Against Mexico's Anti-Money Laundering Law, and What It Does Not

Soulbit V1 does not comply with the LFPIORPI on behalf of any company: each vulnerable activity is an obligation of the party carrying it out, with its own registration, compliance representative and notices.

Today Soulbit V1 verifies business clients through KYB, applies transaction monitoring (KYT) and AML controls to the payments it processes, operates with institutional custody and offers human support. The detail is in our guide to KYT and AML in payments. Each payment leaves a trail your team can use as support for its own due diligence.

What Soulbit V1 does not deliver matters just as much. It does not register you in the Mexican registry, file notices with Hacienda, write your manual or risk assessment, determine whether your company carries out a vulnerable activity, or replace your compliance representative. Its local bank rail exists only in Colombia, not in Mexico. This article also does not state which Mexican regime applies to Soulbit as an operator.