Reform of the Anti-Money Laundering Law 2025: Impact and new obligations for obliged entities

On July 16, 2025, the Decree which reforms and adds various provisions of the Federal Law for the Prevention and Identification of Operations with Resources of Illicit Origin (LFPIORPI or Law) and amends the Article 400 Bis of the Federal Criminal Code (CPF by its acronym in Spanish) was published in the Official Gazette of the Federation (DOF by its acronym in Spanish). This reform represents a significant change in the Mexican regulatory framework for the prevention of money laundering.

The main modifications in the reform are the following:

1. National and international institutional cooperation. The reform establishes collaboration mechanisms between the Tax Ministry (SHCP by its acronym in Spanish), the Attorney General's Office (FGR by its acronym in Spanish), the Secretariat of Security and Citizen Protection (SSPC by its acronym in Spanish), the National Guard (GN by its acronym in Spanish) and international organizations, indicating the obligation to establish training and specialization programs for personnel involved in the prevention and combat of these crimes.

2. Strengthening of Sanctions. Administrative and criminal sanctions are reinforced, including the revocation of permits and the penalization of straw person (“prestanombres” in Spanish), or accomplices in illicit operations. The Financial Intelligence Unit (UIF by its acronym in Spanish) may participate directly in investigations as a victim or offended party.

Likewise, the third paragraph of Article 400 Bis of the CPF is amended, to indicate that in the case of conduct in which the services of institutions that make up the financial system are used, the Public Prosecutor's Office (MP by its acronym in Spanish) will be empowered, at all times, to investigate them. To bring criminal action, a complaint will be required from the SHCP, which will have the character of victim or offended party.

3. Redefinition and expansion of key concepts. Updates are introduced and definitions are introduced to strengthen identification and control:

• "Beneficial/ Controlling Owner". Now it is explicitly equated with "final beneficiary" and "real owner", with the collection of their identification documentation being mandatory.

In addition, Articles 33 Bis, 33 Ter and 33 Quarter are added, establishing new obligations for commercial companies in Mexico, focused on the identification and registration of their beneficial owner. Companies will now be obliged to comply with the requirements of the authorities to determine and retain the information of their beneficial owner. In addition, they must file a notice in the electronic system of the Ministry of Economy when the transfer of ownership or constitution of rights over their shares or social shares is carried out, registering the necessary information to identify the person or group of persons exercising effective control.

The SHCP, through its authorized administrative unit, shall promote among the state authorities that companies and associations identify their beneficial owner, following the guidelines and General Rules issued by the SHCP itself in accordance with this Law.

• "Politically Exposed Persons (PEPs)". Defined for the first time, with an obligation to identify and monitor their operations, requiring the implementation of tailored internal policies and technological tracking tools.
• The definition of "Real Estate Development" is incorporated to include construction projects or subdivision of lots for sale or lease.
• The definition of "Risk" is incorporated and the use of the Unit of Measurement and Update (UMA) as the official monetary reference to determine monetary thresholds within the Law is ratified.

4. Expansion of the catalogue of vulnerable activities and threshold adjustments. New vulnerable activities are incorporated, and monetary thresholds for reporting obligations are updated:

• Real estate development. Defined as "project for the construction of real estate or subdivision of lots, intended for sale or sale". Receipt of funds for such purposes now constitutes a vulnerable activity.
  
• Virtual assets (cryptocurrencies). Now considered vulnerable activities even when carried out with Mexican nationals from foreign jurisdictions.
• The thresholds and assumptions for reporting were updated: (a) Mandatory reporting to the SHCP applies when a transaction per client or user equals or exceeds 210 (two hundred) and ten times the UMA daily value; and (b) If fees are collected for the service, reporting is required when the amount equals or exceeds 4 (four) times the UMA daily value.
• Public Notaries and Public Brokers. Although not newly categorized as vulnerable, the reform establishes a lower threshold for the obligation for reporting obligations regarding the transfer or constitution of real rights over real estate, that is, reduced from 16,000 (sixteen thousand) to 8,000 (eight thousand) UMA.
• Incorporation or modification of trusts. Reporting obligations for Public Notaries for the constitution or modification of transferable ownership or guarantee trusts are modified, except for those that are constituted to guarantee a credit in favor of institutions of the financial system or public housing agencies. Notaries must report these transactions when the amount of operation equals to or exceeds (4,000) four thousand times the UMA daily value.
• Games with bets, contests or raffles. The definition is broadened to include operations authorized under non-permit regimes. Thresholds for identification and reporting remain unchanged.
• Issuance and/or commercialization of prepaid cards and monetary value storage instruments: The conditions requiring user identification have been modified. For prepaid cards, in addition to commercialization, identification is now also mandatory when funds are loaded or paid in an amount equal to or greater than 645 (six hundred and forty-five) times UMA daily value per transaction.

With respect to monetary value storage instruments, their regulation is now included within the Law (previously governed by a secondary regulation). These instruments shall be subject to identification requirements when issued, commercialized, or loaded with funds equal to or exceeding 645 (six hundred and forty-five) times the UMA daily value per operation. Likewise, such transactions must be reported when commercialization or funding involves amounts at or above 645 (six hundred and forty-five) times the UMA daily value.

5. New obligations for obligated entities.

• Customers or users identification. Scope is expanded. Obligated subjects must not only identify but also directly know their clients and users.
• Information and Record Keeping: Obligated subjects must retain the supporting documentation of vulnerable activities for ten years (previously five).

Likewise, supporting information to be retained by the obligated subjects, includes transaction logs enabling reconstruction of operations, business correspondence, and due diligence analysis.

• Staff selection and training programs. Obligated subjects must establish recruitment processes and implement annual AML training board members, management, officers and employees with a direct relationship with customers or users.
• Automated mechanisms: Implementation of automated mechanisms is mandatory for continuous monitoring and risk assessment, as well as for the identification of deviations from a customer’s transactional profile and tracking of high-risk customers or users and PEPs.

Obligated subjects dealing with virtual assets must obtain, retain and make available to the competent authorities, accurate information regarding the originator, recipient, and, where applicable, the beneficial owner of such transactions, as per the provisions of the SHCP's General Rules.

• Compliance representative: The obligation to designate a compliance representative or officer is added for operations carried out through trusts or other legal vehicles. Likewise, the protection of the identity of both, compliance offices of financial institutions as well compliance officers of obligated subjects is added for those events where the judicial or administrative authorities require their appearance during any diligence related to their functions derived from the Law’s enforcement.
• Risk-based approach (EBR): Section VII is added to Article 18 of the LFPIORPI, establishing that the obligated subjects must carry out an assessment with a risk-based approach, in accordance with the General Rules, allowing them to identify, analyze, understand and mitigate the risks of both the obligated subject and of their customers or users.
• Internal Policies Manual. Section VIII is added to Article 18 of the Law, establishing the obligation to develop and implement an Internal Policies Manual containing the criteria, measures and procedures necessary to comply with the obligations set forth in the Law, including those that aimed at identifying and monitoring transactions or activities involving PEPs pursuant the General Rules issued by the SHCP.

In the case of forming part of a corporate group, such policies must be applied across all branches and majority-owned subsidiaries, including those located abroad. These policies must be designed to prevent money laundering, related offenses, and the financial operations of criminal organizations, as well as to prevent the use of resources for their financing, also in accordance with the General Rules issued by the SHCP.

• Internal and external audits. A new obligation to conduct internal or external audits is introduced for entities assessed as low or medium risk. For entities classified as high risk, audits must be performed by an independent external auditor. These audits will be governed by the General Rules issued by the SHCP.
• "Non-operation" notices: Section VI of Article 18 is expanded to clarify that the obligation to file “non-operation” notices will be subject to regulation under the General Rules issued by the SHCP.

It is further established that, in the event of suspicion or when information based on facts or indications is obtained suggesting that resources involved in a transaction or activity may originate from or be destined for the commission of money laundering or related crimes, the obligated subject must file a notice within 24 (twenty-four) hours of becoming aware of such information or generating the suspicion, even if the operation did not ultimately take place. These obligations must be fulfilled in accordance with the corresponding General Rules issued by the SHCP.

• Recognition of Spontaneous Compliance. Article 55 of the Law is amended to provide that the SHCP may, on a one-time basis, refrain from imposing sanctions on an obligated subject, for all infractions committed, provided that the entity comply voluntarily and spontaneous corresponding obligations before any verification procedures are initiated by the SHCP, and expressly acknowledges the breach during the initial stage of the verification process.
• Restriction on the use of cash. The main amendment to article 32 of the LFPIORPI lies in the increased clarity and detail regarding the prohibition on using cash. The reform explicitly establishes that obligations may not be fulfilled or settled using coins, banknotes (in either national or foreign currency), or precious metals, when processed through financial institutions. The UMA is reaffirmed as the reference unit for determining the monetary threshold applicable to all transactions.

Additionally, a new provision is introduced prohibiting the deposit of payments related to such acts or transactions -subject to their respective thresholds-, and granting the SHCP the authority to determine, via General Rules, the specific cases and conditions under which this prohibition will also apply to fungible goods, based on their assessed risk level.

6. Transitional provisions and final considerations. The Decree will enter into force on the day after its publication in the DOF. However, SHCP and SAT will have a period of up to twelve 12 (months) to issue or amend the General Rules necessary for the effective implementation of the reform. 

This means that, while the amended provisions are legally in force, their practical enforcement will depend on the issuance of these administrative rules. A gradual yet expedited transition toward full compliance with the new obligations is therefore anticipated.

In this context, it is essential that both, those engaged in vulnerable activities and taxpayers who may fall within the scope of the amended provisions, understand and analyze the changes in a timely manner, along with the terms and deadlines to be set forth in the forthcoming secondary regulations. Accurate interpretation of the reforms and their early, strategic implementation will help mitigate compliance risks and ease the transition into the new regulatory framework.

If you require additional information regarding the content of this EY Law Flash, please contact our team of professionals: