Reform to the General Rules of the Anti-Money Laundering Law (LFPIORPI)

On August 7, 2026, the evening edition of the Official Gazette of the Federation (DOF) published Agreement 115/2026, through which the Ministry of Finance and Public Credit (SHCP) amends, adds, and repeals various provisions of the General Rules under the LFPIORPI. This reform modernizes Mexico's Anti-Money Laundering (AML) framework and establishes new preventive compliance standards for entities conducting Designated Non-Financial Businesses and Professions (DNFBPs/Vulnerable Activities).

The core points of this official publication are:

1. Risk-Based Approach (RBA) and Client Classification

The obligation to design and implement a Risk-Based Approach Methodology is formally established:

• Risk Matrix: Entities carrying out vulnerable activities must categorize clients into risk tiers (low, medium, and high), assessing variables such as geographic location, business type, transactional volume, and delivery channels.
• Enhanced Due Diligence (EDD): Intensified identification and monitoring measures regarding the origin and destination of funds are required for high-risk clients and Politically Exposed Persons (PEPs).

2. Ultimate Beneficial Owner (UBO) Identification and Unified Files

Strict rules are imposed regarding corporate transparency and transactional tracking:

• Order of Precedence: Clear criteria are set to identify the ultimate natural person who owns, controls, or benefits from transactions conducted through corporate entities or trusts.
• Single Client File and Transactional Profile: Entities must maintain a single unified file per client and build a consolidated transactional profile to automatically detect unusual variances.
• Record Retention: Identification records and supporting transaction files must be kept for a minimum period of 10 years.

3. Annual Audit, Automated Systems, and Electronic Notifications

The reform details the technical and audit requirements mandated for compliance officers:

• Audits and Reports: Periodic compliance evaluations via independent audits become mandatory (first formal audit cycle applicable in 2028).
• Automated Mechanisms: Specialized IT tools must be implemented for continuous monitoring of alerts, sanctions lists, and PEP screening.
• Electronic Notifications: Administrative notices delivered electronically by authorities allow 3 business days for opening; after this period, notification takes legal effect on the fourth business day.

Operational Impact Summary

Visit the following link to review the official publication and view the complete text:

Agreement Amending the General Rules of LFPIORPI on the Official DOF Gazette