Flash News: Amendment to the Anti-Money Laundering Law (LFPIORPI) and the Federal Criminal Code

This approval occurs in a particularly sensitive context for the financial sector, following: (i) the recent measures adopted by the Financial Crimes Enforcement Network (FinCEN) of the United States Department of the Treasury, which identified three Mexican institutions as of primary money laundering concern, in connection with schemes financing the trafficking of fentanyl and chemical precursors, and (ii) Mexico's assessment by the Financial Action Task Force (FATF) in 2025. Although the amendment seeks to strengthen the regulatory framework, the sector's principal concern is that this text equates, in regulatory and administrative burden, the Vulnerable Activities carried out by non-financial entities with financial institutions. The associated compliance costs and the severity of the sanctions raise the question of whether the regulatory burden will generate information that is useful and proportionate to the effort demanded by the new obligations. What was approved and what changed? The published text preserves several of the pillars originally set out in the reform initiative, which are detailed below. However, the latest version discussed no longer incorporated the matter relating to the inclusion of terrorism financing within the scope of the LFPIORPI, one of the initial pillars of the proposal. For this version discussed by the Chamber of Deputies, the Senate removed all reference to that component, leaving it out of the amended provisions in both the LFPIORPI and the CPF. This amendment incorporates highly relevant technical clarifications and adjustments to the AML legislation, which we analyze below: Key Points on Implementation: A. Immediate entry into force with staggered deadlines: The decree enters into force the day following its publication in the DOF. Nevertheless, certain specific provisions, such as the obligations regarding training, auditing, assessment under a Risk-Based Approach, Internal Policies Manual, personnel selection processes, and automated mechanisms for transaction monitoring, will be subject to general rules that the Ministry of Finance and Public Credit (SHCP) must issue within the 12 months following publication in the DOF. B. Supplementary Laws: The General Law of Negotiable Instruments and Credit Operations is recognized and added as a supplementary law to the LFPIORPI. C. Controlling Beneficiary. The amendment modifies the definition of “Controlling Beneficiary” in the LFPIORPI, reducing the threshold for its identification with respect to control of voting rights in a company from 50% to 25%. This modification means that more persons must be identified and registered as controlling beneficiaries by the entities subject to the LFPIORPI. Commercial companies must also: (i) identify and register their Controlling Beneficiaries, and (ii) register any transfer of ownership or creation of rights of any nature (e.g., pledge) over equity interests or shares, through the electronic system managed by the Mexican Ministry of Economy. This registration adds to, on the one hand, and complements, on the other, both the update notice of partners and shareholders currently managed by the Tax Administration Service (SAT) and the notices contemplated in the General Law of Commercial Companies (LGSM) (arts. 73 and 129). However, unlike the LGSM, the LFPIORPI establishes sanctions for non-compliance with this registration by obligated parties, with fines ranging between 2,000 and 10,000 times the UMA1 (Unit of Measurement and Update). D. Politically Exposed Persons (PEPs) and comparable persons. As in the prudential regulation for financial institutions, the concept of PEPs is included in the LFPIORPI, as well as a generic concept for comparable persons (“…as well as persons related to them”), which the SHCP will define through general rules. E. Amendments to Article 17 – Modification of thresholds and new vulnerable activities: i. Art. 17, sec. II. – Service, credit, and prepaid cards and monetary value storage instruments: The section removes the conditions relating to the issuer or merchant maintaining a business relationship with the acquirer, to the instruments allowing the transfer of funds, or to their marketing being carried out occasionally. ii. Introduction of New Vulnerable Activities in the Real Estate Sector: Section V Bis is added to Article 17, classifying as a vulnerable activity the receipt of resources intended for real estate developments for sale or lease purposes. This measure broadens the scope of the law to encompass both final transactions and the financing stage in real estate developments. iii. Art. 17, sec. VI – Jewelry, precious metals and precious stones: The reporting threshold in the habitual trade of jewelry, precious metals and precious stones is modified. Previously, the obligation to file a notice applied only to cash transactions exceeding a certain amount. With the amendment, the threshold is broadened to any act or transaction exceeding said amount, regardless of the means of payment used. iv. Art. 17, sec. X – Transfer or Custody of Valuables: The obligation to file a notice is established in those cases where it is not possible to determine the value of the goods transferred or held in custody. v. Art. 17, sec. XII: a. Subsection A, paragraph a): The reporting threshold is reduced to 8,000 UMAs (previously 16,000) for acts transferring or creating rights in rem over real property before a notary public. b. Subsection A, paragraph c): The reporting threshold for the incorporation of legal entities, capital increases or decreases, mergers, spin-offs, and the purchase and sale of shares or equity interests before a public attestor was modified. As a result of this modification, all of these transactions will be subject to mandatory notice before the authority, regardless of the amount. c. Subsection A, paragraph d): The reporting threshold is reduced to 4,000 UMAs (previously 8,0254) for the creation or modification of trusts, and the scenario is broadened to include all types of ownership-transferring or guarantee trusts, not only those relating to real property. d. Subsection D. Public and private facilitators are incorporated as new obligated parties, in accordance with the provisions of the General Law on Alternative Dispute Resolution Mechanisms, with respect to attestation services related to the activities of section A (notaries public). vi. Art. 17, sec. XVI – Virtual assets: Includes exchanges of virtual assets carried out with Mexican nationals from another jurisdiction, with new reporting thresholds. In addition, the obligation to comply with the “travel rule” is included; that is, to collect and provide information about the virtual asset transactions of the originator, the recipient, and, where applicable, the Controlling Beneficiary. F. New obligations under Article 18. The amendment introduces a comprehensive transformation of Article 18 of the LFPIORPI, establishing a series of reinforced obligations, in many cases aligning the standards applicable to financial institutions. Among the principal changes are: i. Identification and Knowledge (section I). Its scope is broadened to include not only the identification of clients or users, but the obligation to know them directly. ii. Documentation (section III). Requires obtaining the documentation that allows the identification of the Controlling Beneficiary of clients or users that are legal entities, trusts, or another legal figure, regardless of whether such documentation is in their possession or not. In the event that the client or user is an individual, a statement would be collected as to whether they are aware of the existence of a Controlling Beneficiary and, if applicable, the documentation to identify them. iii. Record Retention (section IV). Specifies what supporting information must be retained by those who carry out vulnerable activities (records of transactions that allow the reconstruction of individual transactions, commercial correspondence, and the results of prior analyses performed), for a period of 10 years and at the domicile registered with the SHCP. iv. 24-Hour Notices (section VI). Includes the filing of 24-hour notices based on the guidelines issued by the authority and the general rules. v. RBA (section VII). Added to provide for the obligation to carry out a risk-based assessment, allowing the identification, analysis, understanding, and mitigation of risks of both the obligated parties and the clients or users. vi. Internal Policies Manual and Automated Mechanisms (sections VIII and X). Added to establish that those who carry out vulnerable activities must prepare an internal policies manual containing the criteria, measures, and procedures necessary to comply with the obligations set out in the law. Likewise, they must establish automated mechanisms to conduct ongoing monitoring of their clients' or users' transactions in order to identify those that fall outside their transactional profile. Additionally, in the event that the obligated parties form part of a business group, policies applicable to all majority-owned branches and subsidiaries, including foreign ones, must be implemented for the prevention of offenses involving resources of illicit origin and terrorism financing. vii. Personnel Selection and Training (section IX). Added to include the obligation to develop personnel selection processes, as well as to adopt annual training programs, aimed at the members of the governing body, executives, compliance officers, and employees who have a direct relationship with clients or users. viii. Auditing (section XI). Added to indicate the obligation to have a review by the internal audit area or an external auditor, when the risk of the party carrying out the vulnerable activity is high, in order to assess and issue an opinion within a calendar year on the effectiveness of compliance with the obligations set out in the law and its secondary regulations. G. Adjustments to the Sanctioning Regime: i. Administrative (Art. 55): The benefit for spontaneous compliance that exempts from sanction in the case of a first infraction is modified in two respects: a. An additional benefit is incorporated for subsequent infractions, allowing the SHCP to reduce the fine by up to 50% if the obligated party spontaneously regularizes its situation before the commencement of verification powers, and b. It is clarified that, for both first and subsequent infractions, the express acknowledgment of the fault(s) must be made within the initial period of the sanctioning proceeding. ii. Special Criminal (Arts. 62): Article 62 is amended to criminalize the incorporation of illegible information, documentation, data, or images in notices or in responses to information requests, whether intentionally or negligently, that prevent effective knowledge of their content. Art. 62 establishes a prison sentence of 2 to 8 years and a fine of 500 to 2000 UMAs and adds an exclusion from the offense if it concerns a remediable error corrected spontaneously before the authority becomes aware of the offense. H. Additional key modifications: i. Art. 32: A section is added to specify that the restrictions on currencies and cash for the settlement of obligations also apply to cases of judicial deposit of payment. ii. Art. 51 Bis: Added and empowers the SHCP to request information from any public entity in the country, using specific channels for political or union data. Additionally, it requires State-owned enterprises and their subsidiaries to implement internal measures to mitigate the risk of being used in illicit operations. iii. Art. 51 Ter: Establishes the obligation of the SHCP to prepare and maintain an up-to-date list of Politically Exposed Persons available to obligated parties, for the identification of clients and users. iv. The proposal to recognize the Financial Intelligence Unit (UIF) as a victim or aggrieved party is removed from the CPF reform project, reaffirming that: (i) it is the Public Prosecutor's Office that holds the power to investigate conduct involving the use of services of financial system institutions, and (ii) a formal complaint filed by the SHCP will be required for criminal action to be exercised. v. Other Legislative Drafting Considerations. The LFPIORPI amendment presents legislative drafting deficiencies by referring to “Specialized Units” of the Office of the Attorney General of the Republic (FGR) that do not correspond to the name or structure provided for in its current Organic Statute (last amendment published on April 8, 2025). For example, Article 3, section XIV, mentions the Specialized Unit for the Investigation of Tax and Financial Offenses, whereas the Statute recognizes only the Special Prosecutor's Office for the Investigation of Tax and Financial System Offenses. Likewise, Article 8, section IX, refers to a Specialized Unit on Organized Crime, whereas the Statute refers to a Specialized Prosecutor's Office on Organized Crime or to its Special Prosecutor's Office for the Investigation of Operations with Resources of Illicit Origin, Counterfeiting and Alteration of Currency, and Tax Offenses. Similarly, Article 7 refers to a Specialized Unit for Financial Analysis, when the Statute contemplates only a Financial Analysis Subunit. These divergences, although nominal, may generate legal uncertainty as to the effective jurisdiction of the authorities indicated. To download the reform published in the DOF, click [Here]. Our team remains at your disposal to help you interpret, implement, and comply with this new regulatory framework. If your company carries out vulnerable activities or may be impacted by these reforms, we invite you to contact our experts to coordinate a diagnostic session, review your policies and procedures, and design appropriate compliance strategies. Luis Burgueño, Partner: +52 (55) 5258 1003 | lburgueno@vwys.com.mx Alberto Córdoba, Partner: +52 (55) 5258 1016 | acordoba@vwys.com.mx Diego Sierra, Partner: +52 (55) 5258 1039 | dsierra@vwys.com.mx Raymundo Soberanis, Partner: +52 (55) 5258 1059 | rsoberanis@vwys.com.mx Ricardo Cacho, Counsel: +52 (55) 5258 1000 | rcacho@vwys.com.mx Max Morales, Associate: +52 (55) 5258 1014 | mmorales@vwys.com.mx