On August 7, 2026, the Ministry of Finance and Public Credit (SHCP) published in the Official Gazette of the Federation Resolution 115\/2026 amending the General Rules (GR) referred to in the Federal Law for the Prevention and Identification of Transactions with Proceeds of Illicit Origin (LFPIORPI or Anti-Money Laundering Law) (the \"Resolution\").<\/p>\n\n\n\n
These amendments derive from the reform to the LFPIORPI published on July 16, 2025, which expanded the catalog of Vulnerable Activities, modified the definition of Ultimate Beneficial Owner, incorporated the annual audit and mandatory training, among other aspects, as well as from the reform to the Regulations of the LFPIORPI published in March 2026, which specified the powers of the Tax Administration Service (SAT), the logic of transaction accumulation and the regime applicable to Politically Exposed Persons (PEPs). The Resolution constitutes the final piece of that regulatory update and seeks to strengthen the Risk-Based Approach, the identification of the Ultimate Beneficial Owner, the use of technological tools and the professionalization of obligated subjects.<\/p>\n\n\n\n
In summary, the most relevant amendments consist of: (i) the migration to a Risk-Based Approach (\"RBA\") with a documented risk assessment methodology; (ii) the classification of the Risk Level of Clients or Users, with at least semi-annual review, and the creation of the Transactional Profile; (iii) the enhanced obligation to identify the Ultimate Beneficial Owner; (iv) the incorporation of a specific regime for Politically Exposed Persons; (v) the comprehensive update of the Internal Policies Manual; (vi) the implementation of automated mechanisms for permanent transaction monitoring; (vii) the performance of annual compliance audits; and (viii) the establishment of mandatory training programs and personnel selection criteria. The new GR will enter into force on November 30, 2026, with obligations enforceable on a staggered basis in accordance with the calendar detailed below.<\/p>\n\n\n\n
<\/p>\n\n\n\n
I. Analysis<\/strong><\/p>\n\n\n\n I.1 Purpose of the Reform and New Obligations<\/strong><\/p>\n\n\n\n The reform aims to establish the minimum measures and procedures that must be observed by those who carry out Vulnerable Activities referred to in Article 17 of the LFPIORPI. It requires obligated subjects to implement compliance programs based on a Risk-Based Approach together with automated monitoring mechanisms.<\/p>\n\n\n\n <\/p>\n\n\n\n I.2 Risk-Based Approach (RBA) and Risk Level Classification<\/strong><\/p>\n\n\n\n Those who carry out Vulnerable Activities must design and implement a documented Risk assessment methodology that considers: (a) acts or transactions, types of clients, countries and geographic areas, and distribution channels; (b) the National Risk Assessment of the Financial Intelligence Unit (\"FIU\"); and (c) existing Mitigating Controls. It must be applied prior to new products or services, updated at least every 12 months, and available for review by the SAT from March 1, 2027. The classification must be divided into at least three Risk Levels: low, medium, and high, with reassessment at least every six months. A Transactional Profile is introduced to detect deviations in the Client's or User's behavior.<\/p>\n\n\n\n <\/p>\n\n\n\n I.3 Client or User Identification<\/strong><\/p>\n\n\n\n Those who carry out Vulnerable Activities must directly identify and know their Client or User, for which purpose they shall prepare and analyze the internal criteria, measures and procedures required. The obligation to \"identify and know\" unfolds into two complementary duties: identification (compiling the file with the Client's or User's data and documents at the beginning of the relationship) and customer knowledge (understanding their activity, the origin of their resources and their expected behavior during the Business Relationship). They must compile and maintain a single identification file for each of their Clients or Users, available to the FIU or the SAT.<\/p>\n\n\n\n <\/p>\n\n\n\n I.4 Ultimate Beneficial Owner<\/strong><\/p>\n\n\n\n The new GR create Chapter III Quinquies \"On the Ultimate Beneficial Owner\" (Articles 23 Quinquies to 23 Quinquies 3), which constitutes one of the most relevant innovations. The definition of Ultimate Beneficial Owner is specified and expanded, reducing the control threshold from 50% to 25% of the capital stock, and a sequential hierarchical methodology for its identification is established: (a) first, whoever directly or indirectly holds 25% or more of the capital stock; (b) if this does not allow identification, whoever has control through other means related to strategy, direction or decision-making; and (c) failing that, the highest-ranking officer.<\/p>\n\n\n\n The obligation to collect information on shareholders, partners, settlors, trust beneficiaries, management bodies and economic dependents is established. For trusts and other legal arrangements, the GR require ascending the chain of ownership to the natural person who exercises ultimate control. The procedure followed\u2014not only the result\u2014must be documented, records must be maintained and kept updated throughout the duration of the business relationship.<\/p>\n\n\n\n <\/p>\n\n\n\n I.5 Ter Politically Exposed Persons (PEPs)<\/strong><\/p>\n\n\n\n The new GR incorporate a specific chapter on Politically Exposed Persons. A PEPs is considered to be a natural person who performs or has performed relevant public functions, in Mexico or abroad. The following are assimilated to this category: spouse, common-law partner, blood or affinity relatives up to the second degree, and partners with patrimonial ties. A domestic PEP retains that character during the year following separation from office. To verify this status, the possibility of consulting the FIU's Consulta PEP 2.0 application is introduced, available from August 30, 2027. When a Client or User is a PEP and has a high Risk Level, enhanced due diligence measures must be applied, including approval by a senior officer before entering into the act or transaction.<\/p>\n\n\n\n <\/p>\n\n\n\n I.6 Internal Policies Manual<\/strong><\/p>\n\n\n\n Those who carry out Vulnerable Activities must have an Internal Policies Manual that integrates the risk methodology and contains, at a minimum: Client identification and knowledge criteria; Risk classification and proportional due diligence mechanisms; procedures for PEPs and Ultimate Beneficial Owner; detection of deviations from the Transactional Profile; procedures for Notices and Reports; functions of the Compliance Officer; training programs; internal control, supervision, audit and confidentiality mechanisms; and procedures for updating the Manual itself. The updated Manual must be available from March 1, 2027.<\/p>\n\n\n\n <\/p>\n\n\n\n I.7 Automated Mechanisms<\/strong><\/p>\n\n\n\n Those who carry out Vulnerable Activities must have automated mechanisms\u2014which may be implemented through spreadsheets, databases or other equivalent means, not necessarily specialized software\u2014that allow them to: maintain files, group transactions by client, detect deviations from the Transactional Profile, execute the risk classification model, generate alerts for high-risk clients and monitor the use of cash and precious metals. The historical record of the Risk Level must be maintained for no less than ten years. Implementation deadline: June 1, 2027.<\/p>\n\n\n\n <\/p>\n\n\n\n I.8 Audits<\/strong><\/p>\n\n\n\n Those who carry out Vulnerable Activities must undergo an annual audit covering from January 1 to December 31 of each year, with the audit report deliverable no later than the last business day of March following the audited year. If the risk is low or medium, an internal audit is sufficient; if high, it must be performed by an external independent auditor with a professional degree in related fields, at least three years of experience in anti-money laundering matters and a current certification from the FIU. The evaluation is classified into five levels (Compliant, Mostly Compliant, Partially Compliant, Non-Compliant and Not Applicable). The first period subject to audit will be fiscal year 2028, with the audit report due no later than March 2029.<\/p>\n\n\n\n <\/p>\n\n\n\n I.9 Training and Personnel Selection<\/strong><\/p>\n\n\n\n The new GR establish the mandatory requirement of having an annual training program directed at members of the board of directors, the sole administrator, officers, executives, the Compliance Officer and employees who serve the public, identify clients, submit Notices or perform audits. Courses must be provided at least once a year, be consistent with the risk methodology, and be taught by persons with at least five years of experience in the field. Documentary evidence must be maintained for a minimum period of ten years. Likewise, guidelines for personnel selection are established: a signed declaration must be obtained regarding prior experience in obligated sectors and regarding the absence of convictions for property crimes or disqualifications. These procedures shall be applicable to new hires from March 1, 2027.<\/p>\n\n\n\n <\/p>\n\n\n\n I.10 Electronic Notifications<\/strong><\/p>\n\n\n\n Consultation of the SAT Portal, previously biweekly, becomes mandatory at least once every business day. Electronic notification is deemed served on the fourth business day following its delivery, even if the obligated subject has not opened it. In practice, it is advisable to designate a responsible person and an alternate for the daily consultation and maintain an access log, as deadlines will run regardless of whether the Portal is reviewed.<\/p>\n\n\n\n <\/p>\n\n\n\n II. Compliance Calendar<\/strong><\/p>\n\n\n\n A staggered compliance scheme is established according to the following dates:<\/p>\n\n\n\n <\/p>\n\n\n\n III.\u00a0<\/strong> III. Implications for Companies<\/strong><\/p>\n\n\n\n The provisions of the Resolution are mandatory for all natural or legal persons who carry out Vulnerable Activities. The obligated subject that today complies only with the documentary standard will face, in 2027 and 2028, traceability, technology and evidentiary requirements that cannot be improvised. The March and June 2027 deadlines leave less than one year to: (i) redesign the RBA methodology and the Manual; (ii) implement the automated mechanisms; and (iii) determine whether the 2028 audit will be covered with internal personnel or a FIU-certified external auditor.<\/p>\n\n\n\n <\/p>\n\n\n\n IV.<\/strong> Next Steps and Recommendations<\/strong><\/p>\n\n\n\n In light of the staggered entry into force of these obligations, we recommend adopting the following actions:<\/p>\n\n\n\n If you have any questions about the scope or implementation of this note, please do not hesitate to contact us.<\/p>\n\n\n\n Bernardo Mendoza: bmendoza@k-g.com.mx<\/a><\/p>\n\n\n\n\n
\n
\n
\n
\n
\n
\n
\n