The reform expands identification, monitoring, recordkeeping, risk assessment and audit obligations for persons carrying out Vulnerable Activities and lowers the threshold for identifying Ultimate Beneficial Owners to 25%.
The reform of the Federal Law for the Prevention and Identification of Transactions with Illicit Proceeds (“LFPIORPI”) introduces significant changes to Mexico’s anti-money laundering framework applicable to persons carrying out Vulnerable Activities.
The new framework expands compliance obligations and brings several requirements applicable to non-financial entities closer to standards traditionally used in the financial sector, particularly regarding customer and Ultimate Beneficial Owner identification, risk-based assessments, transaction monitoring, training and audits.
The Decree enters into force on the day following its publication in the Federal Official Gazette. However, certain obligations —including training, audits, risk-based assessments, internal policies manuals, personnel recruitment processes and automated transaction-monitoring mechanisms— will depend on General Rules to be issued by the Ministry of Finance and Public Credit (“SHCP”) within 12 months following publication.
Key changes include:
• Ultimate Beneficial Owners. The ownership threshold for identifying an individual as an Ultimate Beneficial Owner through voting control is reduced from 50% to 25%.
Commercial companies must identify and register their Ultimate Beneficial Owners and report transfers of ownership and the creation of rights over equity interests or shares through the electronic system administered by the Ministry of Economy.
Failure to comply with these requirements may result in fines ranging from 2,000 to 10,000 times the value of the Unit of Measurement and Update (“UMA”).
• Politically Exposed Persons. The LFPIORPI incorporates the concept of Politically Exposed Persons (“PEPs”) and related persons, whose scope will be further defined through General Rules. The SHCP must maintain and update a public PEP list that reporting entities may use in their customer identification processes.
• New Vulnerable Activities and revised thresholds. The reform expands and modifies several activities covered by Article 17 of the LFPIORPI. Among other changes, it classifies the receipt of funds for real estate developments intended for sale or lease as a Vulnerable Activity and modifies reporting thresholds or conditions applicable to certain transactions involving real estate, trusts, jewelry, precious metals and stones, securities and virtual assets.
For real estate transactions, the reporting threshold for transfers or the creation of real rights formalized before a notary public is reduced to 8,000 UMA. Certain corporate transactions before a notary —including the incorporation of legal entities, capital increases or reductions, mergers, spin-offs and transfers of shares or equity interests— are also subject to mandatory reporting regardless of amount.
For trusts, the threshold is reduced to 4,000 UMA and the scope is expanded to structures involving transfers of title or guarantee arrangements.
• Virtual assets. The framework is expanded to include certain cross-border transactions involving Mexican nationals. It also introduces requirements to collect and transmit information regarding the originator, beneficiary and, where applicable, the Ultimate Beneficial Owner of virtual asset transactions under a framework equivalent to the “Travel Rule.”
• Customer identification and knowledge. The reform expands the obligation to identify Clients or Users and expressly introduces a requirement to know them. Supporting documentation must also be obtained to identify the Ultimate Beneficial Owners of legal entities, trusts and other legal arrangements.
• Recordkeeping. Reporting entities must retain information for ten years, including records sufficient to reconstruct individual transactions, commercial correspondence and the results of compliance analyses.
• Risk-based approach. Persons carrying out Vulnerable Activities must implement assessments designed to identify, analyze, understand and mitigate money laundering risks associated both with their own activities and with their Clients or Users.
• Internal policies and automated monitoring. Reporting entities must maintain an internal policies manual documenting the criteria, measures and procedures required for compliance and implement automated mechanisms to continuously monitor customer transactions and identify activity that falls outside established transactional profiles.
• Personnel selection and training. Obligated parties must establish personnel selection procedures and annual training programs for members of management bodies, directors, compliance personnel and employees who interact directly with Clients or Users.
• Audits. Where the obligated entity presents a high level of risk, its internal audit function or an external auditor must assess and issue an opinion on the effectiveness of compliance with the LFPIORPI and its secondary regulations.
• 24-hour Notices. The reform expressly provides for certain Notices to be filed within 24 hours, in accordance with the formats and General Rules issued by the authorities.
The reform also modifies the enforcement framework. From an administrative perspective, it adjusts the voluntary compliance regime and allows for reductions of up to 50% in certain fines for subsequent violations where the reporting entity voluntarily remedies the breach before a verification procedure begins and the applicable requirements are met.
From a criminal perspective, Article 62 is amended to sanction the intentional or negligent inclusion of illegible information, documents, data or images in Notices or responses to information requests when such illegibility prevents effective understanding of their content. The penalties provided include imprisonment from two to eight years and fines ranging from 500 to 2,000 UMA, subject to the statutory requirements and exceptions.
The new framework represents a significant transformation for companies subject to the LFPIORPI. Implementation will require reviewing not only identification and reporting processes, but the broader compliance structure, including governance, risk assessments, technological systems, recordkeeping, training and audits.
Companies carrying out, or potentially exposed to, Vulnerable Activities should therefore assess the impact of the new obligations at an early stage and closely monitor the General Rules that will develop several of the reform’s operational requirements.
Von Wobeser y Sierra is available to assist with the analysis and implementation of the new regulatory framework, including risk assessments, review of internal policies and the design or enhancement of anti-money laundering compliance programs.
