Amendment to the General Rules of the Anti-Money Laundering Law (LFPIORPI)

The New Rules further develop several of the obligations incorporated into the LFPIORPI and its Regulations through the amendments published on July 16, 2025 and March 27, 2026, respectively, and will enter into force on a staggered basis, in accordance with the timetable set forth below.

In this context, we outline below the main changes introduced by the New Rules so that our clients may timely identify any necessary compliance measures.

Executive Summary

The New Rules substantially modify the manner in which compliance with anti-money laundering and counter-terrorist financing (“AML/CFT”) requirements must be demonstrated to the authorities. Compliance will no longer rest merely on the formal existence of files, acknowledgments of Notices and manuals, but will require traceable evidence of the design, effective implementation, monitoring and audit of the prevention program. The most relevant details and changes include:

Risk-based approach as the guiding principle of prevention obligations, replacing the previous formalistic model.

11 new chapters, 4 chapters renamed and 5 provisions repealed.

Regulation of trusts and other legal arrangements as new obligated subjects for enrollment and registration with the Mexican Tax Administration Service (“SAT”).

Internal Policies Manual with specific minimum content requirements, automated monitoring mechanisms and periodic audits.

Adjustments to the 24-hour notice regime for suspicious activity and for facts or indications of operations with resources of illicit origin.

Specific provisions on virtual assets, including traceability, custody and intermediation rules, as well as supplementary thresholds.

The New Rules will enter into force on a staggered basis, giving obligated subjects a transition period depending on the nature of each obligation and the complexity of the required adjustments. The following table summarizes the most relevant deadlines:

The principal changes and additions introduced by the New Rules are summarized below by topic.

A. Risk-Based Approach (new Chapter II Quáter) [Effective as of March 1, 2027]

Without a doubt, the most significant change introduced by the New Rules is the incorporation of a risk-based approach as the guiding principle of AML/CFT obligations.

Articles 10 Septies through 10 Septies 6 establish the obligation to:

Design and implement a risk assessment methodology, which must be documented in the Internal Policies Manual (the “Manual”), consistently assigning values to risk indicators and factors.

Consider at least four factors: (i) acts or transactions carried out; (ii) type of clients; (iii) countries or geographic areas involved; and (iv) distribution channels used.

Take into account the National Risk Assessment (the “NRA”) issued by the Financial Intelligence Unit (“FIU”).

Conduct a prior assessment before launching new products, services or distribution channels.

Review the methodology at least every 12 months or whenever new risks are identified or the NRA is updated.

B. Risk Level Classification (new Chapter III Bis) [Effective as of March 1, 2027]

Articles 23 Bis through 23 Bis 4 establish a mandatory model for classifying the Risk Level of Clients or Users, which must include at least three levels: low, medium and high. The classification must be reassessed at least every 6 months.

Obligated subjects must have a system that automatically classifies their clients by Risk Level and updates such classification semiannually.

C. Know Your Customer and Due Diligence (new Chapter III Ter) [Effective as of March 1, 2027]

Articles 23 Ter through 23 Ter 5 establish a mandatory Know Your Customer policy based on the transactional profile, which must be incorporated into the Manual.

D. Politically Exposed Persons (PEPs) (new Chapter III Quáter)

Articles 23 Quáter through 23 Quáter 2 introduce a specific chapter on PEPs, including domestic and foreign PEPs, under a broad definition encompassing head of state, political leaders, senior government, judicial and military officials, senior executives of state-owned enterprises, and senior officials of political parties.

The following are treated as PEPs: a PEP’s spouse, common-law or cohabiting partner, relatives up to the second degree, and partners with financial ties. For domestic PEPs, PEP status continues for one year after leaving office; foreign PEPs are, in all cases, deemed high risk.

The Consulta PEP 2.0 system is established, accessible through an Advanced Electronic Signature, and is expected to become available approximately in August 2027 (9 months after the general effective date).

E. Beneficial Owner of Clients or Users (new Chapter III Quinquies) [Effective as of March 1, 2027]

Articles 23 Quinquies through 23 Quinquies 3 establish a new obligation for persons carrying out Vulnerable Activities to identify the Beneficial Owner of their Clients or Users. Such identification must be completed before the relevant act or transaction is carried out or, as applicable, when the business relationship is established. They must also document the procedure followed, retain the supporting information and keep it updated throughout such relationship.

For Clients or Users that are legal entities, the following order of priority must be followed: (i) the individual or group of individuals who, directly or indirectly, owns 25% or more of the capital stock; (ii) the individual who exercises control through other means; and (iii) the individual holding the highest-ranking administrative position or forming part of senior management.

Where the Client or User is a trust, the Beneficial Owner will be the individual who exercises effective control over the trust, such as where that individual has authority to dispose of, administer or direct the use or destination of the assets or rights held in trust.

Exceptions are also established to the obligation to collect Beneficial Owner identification information where the Client or User is: (i) a trust or legal entity listed on a recognized securities market that provides its ticker symbol or corresponding identifier; or (ii) one of the legal entities contemplated in Annexes 4 Bis, 6 Bis, 7-A and 7 Bis A of the Rules, including certain public entities, diplomatic missions, international organizations and entities of the Mexican financial system.

F. Suspicion Notices and Notices Based on Facts or Indications (Articles 26 Bis, 26 Bis 1 and 26 Bis 2)

The New Rules establish the Notices that must be filed within 24 hours after an obligated subject detects certain red flags. These Notices are triggered by the existence of elements that may indicate a possible link to operations with resources of illicit origin, related offenses or the financial structures of criminal organizations.

The New Rules distinguish two scenarios, primarily based on the source of the information giving rise to the red flag: (i) Suspicion Notices (Article 26 Bis), and (ii) Notices Based on Facts or Indications (Article 26 Bis 1).

These Notices may be filed even where the relevant act or transaction does not reach the applicable amount or otherwise satisfy the condition required for it to be subject to a Notice. They also apply where the transaction was merely attempted and was not ultimately carried out, provided that the obligated subject has information that allows it to identify the Client or the person who attempted to carry it out.

Pursuant to the Fifth Transitory Provision, these Notices may be filed six months after the resolution amending the official Notice and Report forms to expressly incorporate these new categories enters into force.

G. Internal Policies Manual (new Chapter X) [Effective as of March 1, 2027]

The 14 minimum items that the Manual must contain pursuant to Article 37 Bis include: (i) identification and verification of Clients or Users; (ii) risk level classification; (iii) due diligence and enhanced measures; (iv) identification of PEPs; (v) transactional profile and alert system; (vi) filing of Notices; (vii) retention of information (10 years); (viii) aggregation of transactions; (ix) screening against international lists; (x) duties of the Compliance Representative; (xi) training program; (xii) internal control mechanisms; (xiii) confidentiality policies; and (xiv) procedures for updating the Manual itself.

H. Trusts and Legal Arrangements (new Chapter II Ter)

Articles 10 Sexies and 10 Sexies 1 introduce an entirely new chapter governing the enrollment, registration and obligations of persons carrying out Vulnerable Activities through trusts (Annex 2 Bis) and other legal arrangements (Annex 2 Ter), such as Asociaciones en Participación (contractual joint venture arrangements), in which case the asociante (managing party) will be responsible for compliance.

I. Automated Mechanisms (new Chapter XIII) [No later than June 1, 2027, with information on transactions carried out as of that date]

Article 41 (Chapter XIII) establishes the obligation to maintain automated mechanisms (e.g., ranging from software systems to verifiable databases or spreadsheets) that perform at least 6 functions: (i) retention and updating of files; (ii) aggregation in a consolidated database and monitoring; (iii) provision of information for the risk methodology; (iv) execution of the classification model; (v) alert system; and (vi) monitoring of cash and precious metals transactions.

J. Annual Audit (new Chapter XIV) [First audit period: January 1 through December 31, 2028]

Articles 42 through 51 (Chapter XIV) establish a mandatory annual audit regime to assess the effectiveness of compliance:

Low or medium risk: internal audit (by personnel independent from the Compliance Representative).

High risk: external audit conducted by an independent auditor holding a university degree and professional license, with at least 3 years of experience and FIU certification.

The audit report must be issued during the first 3 months of the year following the audited period.

K. Training and Personnel Selection (new Chapter XII) [Training: January 1 through December 31, 2027 / Personnel selection: new hires as of March 1, 2027]

Articles 39 Bis through 39 Bis 2 establish:

Mandatory training at least once a year for governing bodies, the sole administrator, directors, officers, the Compliance Representative and personnel involved in customer-facing activities, KYC, Notices or audit activities, delivered by trainers with at least 5 years of experience.

Minimum content: the Law, Regulations, Rules, Manual, suspicious transactions and risks.

Retention of training evidence for 10 years.

Personnel selection: signed background declaration; persons convicted of property crimes may not be hired.

L. Virtual Assets (Articles 24 Bis 2 through 24 Bis 5)

The New Rules incorporate specific provisions to clarify the scope of virtual asset transactions, including traceability requirements, identification of the originator and recipient, custody and intermediation. They also include clarifying thresholds to avoid duplicate Notices.

M. Electronic Notifications (Articles 5 Bis and 6)

Notifications will be deemed sent and received when the corresponding electronic acknowledgment is generated through the Online Portal. Obligated subjects will have 3 business days to open pending digital documents; after that period, the notification will be deemed completed on the fourth business day. Accordingly, the Portal must be checked at least once each business day.

Finally, Article 24 Bis specifies, for each Vulnerable Activity, the “date of the act or transaction” that must be taken into account for purposes of filing the corresponding Notice.

To consult the amendment published in the DOF, click here.

Von Wobeser y Sierra remains available to advise you on the analysis and implementation of the changes arising from the New Rules. If your company carries out Vulnerable Activities or may otherwise be affected by these amendments, we invite you to contact our experts to coordinate a diagnostic session, review your policies and procedures, and design appropriate compliance strategies.

Download the source note in PDF