Mexico’s anti-money laundering law (also known as PLD or LFPIORPI) was designed for businesses that carry out at least one of the 17 activities vulnerable to money laundering. Failing to comply can result in fines of up to 65,000 UMAs (over $7.6 million pesos), temporary or permanent closure of your business, and in the most serious cases, criminal liability.
The reforms of July 2025 significantly raised the bar on Mexico’s KYC requirements. New obligations include having automated monitoring mechanisms in place, conducting annual audits, and formally registering beneficial owners.
This article covers what PLD is, who is subject to Mexico’s anti-money laundering regulations, how to comply with them, the consequences of non-compliance, and how Mindsec can help you expedite the entire process through automation.
What Is PLD?
Mexico’s anti-money laundering initiatives started with the LFPIORPI (Federal Law for the Prevention and Identification of Transactions with Funds of Illicit Origin), which was enacted in 2012 and updated in July 2025.
Its objective is to prevent Mexico’s financial and commercial system from being used to launder assets of criminal origin or finance terrorist activities. To achieve this, it establishes a compliance framework for individuals and legal entities that carry out economic activities considered “susceptible” to money laundering.
Mexico’s anti-money laundering law is overseen by the Ministry of Finance and Public Credit (SHCP), the Financial Intelligence Unit (UIF), and the SAT (the federal revenue service, which receives reports of vulnerable activities through the Anti-Money Laundering Portal). For the financial sector, supervision also falls under the CNBV, CNSF, and CONSAR.
In simple terms: if your business handles operations that could be used to move money of illicit origin, Mexico’s anti-money laundering regulations require you to identify your clients, monitor suspicious transactions, file reports with the SAT, and retain documentation for 10 years.
The 2025 reform was a landmark moment for Mexico’s KYC requirements. The most relevant changes to the LFPIORPI include:
- The obligation to have automated monitoring systems in place
- Mandatory identification of beneficial owner(s)
- Annual internal and external audits
- Formal training programs
- The inclusion of new sectors (such as real estate development and virtual assets)
Who Must Comply with Mexico’s Anti-Money Laundering Regulations?
Any individual or legal entity that carries out any of the 17 vulnerable activities established in Article 17 of the LFPIORPI is required to comply with Mexico’s anti-money laundering law. These activities are particularly susceptible to money laundering due to their characteristics.
The main vulnerable activities include:
- Games, gambling, lotteries, and contests
- Issuance and sale of prepaid or service cards
- Loan or credit operations
- Sale and purchase of real estate
- Real estate development (added in the 2025 reform)
- Sale and purchase of vehicles (air, sea, and land)
- Armored vehicle and security services
- Sale and purchase of jewelry, watches, precious metals, and gemstones
- Public notary and broker services
- Foreign trade (imports and exports)
- Sale and purchase of works of art
- Asset management and administration services
- Exchange of virtual assets through electronic platforms
Not all operations within these activities trigger compliance obligations under Mexico’s anti-money laundering regulations. Each activity has specific thresholds expressed in UMAs (the official economic reference to calculate obligations, fines, taxes, and social security caps).
Obligations are only activated when a transaction exceeds the identification threshold or the reporting threshold.
Financial entities (banks, brokerage firms, insurance companies, bonding companies, investment funds) are also subject to Mexico’s KYC requirements, but under a different regime supervised by the CNBV and other financial sector commissions.
How to Start Complying with Mexico’s Anti-Money Laundering Law
Compliance with Mexico’s anti-money laundering law is not a one-time process. It is ongoing and requires documentation, technology, and the following structure to get started:
- Determine whether you carry out vulnerable activities. Identify whether your operations fall under the 17 vulnerable activities in Article 17 of the LFPIORPI to confirm whether you are required to comply with Mexico’s anti-money laundering regulations and other KYC.
- Register with the SAT. Before filing your first report, you must complete registration at the SAT’s Anti-Money Laundering Portal. You will need a valid RFC and e.firma (electronic signature).
- Designate a compliance officer. Any legal entity carrying out vulnerable activities must formally designate a compliance officer before the SHCP. This person must receive arduous annual training on any updates published on Mexico’s KYC requirements.
- Implement customer identification procedures (KYC). You must identify and verify clients using official documentation and collect information about their activity or occupation. The same applies to identifying the beneficial owner when applicable. Mexico’s KYC applies to all clients whose operations exceed the relevant thresholds.
- Develop a risk-based methodology. Mexico’s anti-money laundering law requires a methodology for analyzing and mitigating risks associated with operations and clients.
- File reports with the SAT. Reports are submitted in XML format through the SAT’s Anti-Money Laundering Portal, no later than the 17th of the month following the transaction. There are three types: the standard report (monthly), the zero report (when there were no reportable transactions), and the 24-hour report (when there are indications of illicit funds).
- Implement automated monitoring mechanisms. Since 2025, the LFPIORPI requires automated systems for ongoing monitoring and detection of suspicious transactions. Manual compliance is no longer sufficient.
- Conduct annual audits. Internal or external audits (depending on risk level) must be conducted to evaluate compliance with Mexico’s anti-money laundering regulations.
- Retain documentation for 10 years. All supporting documentation, client files, reports, and analyses must be kept for a minimum of 10 years from the last transaction with the client.
- Train your staff. Annual training programs are required for compliance personnel, the executive committee, and employees involved in vulnerable activities under Mexico’s anti-money laundering law.
Consequences and Penalties for Non-Compliance With Mexico’s Anti-Money Laundering Law
Failing to meet the obligations under Mexico’s KYC requirements carries serious consequences. The LFPIORPI establishes a tiered penalty regime based on the severity of the violation.
Administrative fines. Penalties range from 200 to 65,000 UMAs, depending on the type of violation. With the current UMA value ($117.31 in 2026), this translates to fines ranging from approximately $23,000 to over $7.6 million pesos. For the most serious violations, the fine can be between 10% and 100% of the transaction value.
Business closure. The SHCP can order the temporary or permanent closure of a business in cases of serious and/or repeated non-compliance with the LFPIORPI.
Criminal liability. Money laundering is a criminal offense under Article 400 Bis of the Federal Penal Code, with penalties ranging from 5 to 15 years in prison. The 2025 update strengthened this article to include new scenarios.
Permit revocation. For certain sectors (gaming and lotteries, customs agencies), non-compliance with Mexico’s anti-money laundering regulations can result in the revocation of operating permits.
Joint liability. If a company is part of a corporate group, the obligations under Mexico’s anti-money laundering law extend to all majority-owned subsidiaries and branches, including foreign ones.
One important note: Mexico’s KYC requirements guidelines allow for a one-time exemption from penalties, provided the violator voluntarily remedies the situation before the SHCP initiates its verification process. After using this benefit, fines can still be reduced by up to 50% under the same conditions.
Mindsec Automates Your Compliance with Mexico’s KYC Requirements
Spreadsheets and manual processes fall short under the LFPIORPI, especially after the 2025 reform made automated monitoring mechanisms a legal requirement.
Mindsec was built to help you with exactly that. Our compliance automation platform centralizes and simplifies your organization’s anti-money laundering processes. Instead of managing client identification, transaction monitoring, and report filing separately, you can handle all of this and more from a single place.
For example:
- Detect suspicious patterns with automated monitoring.
- Centralize documentation of yours and your clients’ files.
- Produce compliance policies and evidence directly in the platform and organize them into a file ready for audits or SHCP verification.
- Manage internal, third-party, and vendor risk with a structured internal tool to classify clients by their operations and risk level.
- Automate reminders and workflows so you never miss report deadlines, annual audits, training schedules, or evidence expiration dates.
- Generate audit-ready reports that demonstrate your compliance status with Mexico’s anti-money laundering regulations to the authority and the executive committee.
Mindsec also supports compliance with other regulatory frameworks, including ISO 9001, ISO 27001, PCI DSS, and NIST CSF 2.0, allowing you to manage multiple certifications at once from a single centralized platform.
