Mexico AML Reform 2026: New LFPIORPI Compliance Obligations for Business Owners

Mexico’s 2026 LFPIORPI reform changes AML compliance for vulnerable activities: risk-based approach, beneficial owner, PEPs, alerts, audits and automated controls.

Mexico AML Reform 2026: New LFPIORPI Compliance Obligations for Business Owners

Mexico’s anti-money laundering compliance framework is changing significantly. Through Agreement 115/2026, published in the Federal Official Gazette, the general rules related to the Federal Law for the Prevention and Identification of Transactions with Resources of Illicit Origin, commonly known as LFPIORPI, were amended.

For business owners, this reform should not be treated as a purely technical update for lawyers or accountants. If your company performs Vulnerable Activities in Mexico, such as real estate transactions, real estate leasing, donations, certain professional services, virtual asset services or other regulated activities, the new rules may directly affect your internal compliance obligations.

The reform introduces a clear shift: compliance is no longer limited to identifying clients and filing notices. Companies must now demonstrate an ongoing AML prevention program based on risk, supported by internal controls, monitoring, documentation, training, automated mechanisms and audit procedures.

What is the most important change?

The core change is the incorporation of a Risk-Based Approach. Each company must identify the money laundering risks it faces based on its activity, type of clients, geographic exposure, transaction amounts, frequency and channels used.

In practice, not all clients and transactions can be treated the same way. A low-value occasional transaction with a clearly identified local client does not represent the same risk as a high-value transaction involving foreign corporate structures, trusts, high-risk jurisdictions or Politically Exposed Persons.

Authorities may review whether the company’s risk methodology is reasonable, documented and consistent with the mitigation measures actually implemented.

New obligations for companies in Mexico

• Classify each client by risk level: low, medium or high.
• Determine each client’s expected transactional profile.
• Identify and document the real Beneficial Owner of legal entities, trusts and legal arrangements.
• Apply enhanced due diligence for high-risk clients and Politically Exposed Persons.
• Maintain an updated Internal Policies Manual aligned with the company’s actual operations.
• Implement automated mechanisms, which may include specialized software or verifiable tools such as databases or robust spreadsheets.
• Provide annual training to personnel involved in compliance, client identification and notice filing.
• Prepare for annual AML compliance audits under the new rules.

Beneficial Owner: a critical issue for business owners

One of the most relevant obligations is the identification of the Beneficial Owner. Companies must identify the individual who directly or indirectly owns or holds at least 25% of the capital, controls the client by other means or, ultimately, holds the highest management position.

This is especially important for corporate groups, trusts, foreign shareholders and structures where ownership is not immediately clear. Requesting an ID is not enough; the company must document the procedure followed to identify the final individual exercising ownership or control.

PEPs, foreign clients and high-risk transactions

Politically Exposed Persons will also require a more formal process. Foreign PEPs must be treated as high-risk clients, while domestic PEPs must be assessed based on whether their transactional behavior is reasonably consistent with their income, duties and responsibilities.

For companies serving foreign clients, international investors or real estate buyers in Mexico, this means stronger files, better documentation on the source and destination of funds and a clear explanation of why the client is conducting transactions in Mexico when the case requires it.

What should companies do now?

• Perform an LFPIORPI compliance diagnostic.
• Update the Internal Policies Manual.
• Design a risk matrix adapted to the business model.
• Review client files and Beneficial Owner documentation.
• Create KYC forms and source/destination of funds questionnaires.
• Implement alerts and automated controls.
• Train the team involved in regulated operations.
• Prepare for annual AML audits.

The 2026 LFPIORPI reform should not be viewed only as an administrative burden. For serious companies, it is an opportunity to strengthen internal controls, improve corporate governance, support banking processes and reduce risks before clients, investors and authorities.

At Tax Art, we help business owners and companies in Mexico implement tax, accounting and anti-money laundering compliance programs in a practical, structured and business-oriented way.

If your company performs Vulnerable Activities in Mexico, or if you are unsure whether your operations fall under LFPIORPI, now is the right time to review your compliance position before the new obligations fully come into effect.

Schedule a preventive compliance review with Tax Art and confirm whether your company is ready for Mexico’s 2026 LFPIORPI reform.