On March 27, 2026, the “Decree amending, adding, and repealing various provisions of the Regulations of the Federal Law for the Prevention and Identification of Operations with Resources of Illicit Origin” (“Regulations”) was published in the Official Gazette of the Federation (by its Spanish acronym, “DOF”), and became effective on March 30, 2026.
The new provisions of the Regulations complement the amendment to the Federal Law for the Prevention and Identification of Operations with Resources of Illicit Origin (by its Spanish acronym, “LFPIORPI”) published on July 16, 2025. Those changes stem from the recommendations of the Financial Action Task Force (“FATF”) made during its evaluation conducted in Mexico in January 2018 and replaced regulatory provisions that had been in force since 2013.
Below we summarize the most relevant changes to the amended Regulations:
1. New definitions. Within Article 2 of the Regulations, the definition of “Client or User” was eliminated and the definitions of “Reports,” “List of Politically Exposed Persons,” and “Persons Entrusted with Public Faith” were incorporated, the latter category now expressly including facilitators of alternative dispute resolution mechanisms.
2. New powers for the Financial Intelligence Unit (“FIU”). Subsection III Bis is added to Article 3, obligating the FIU to issue the format and determine the means by which the authorities provided for in Article 51 Ter of the Law -including public authorities, autonomous bodies, federal and local agencies and entities, prosecutors’ offices, jurisdictional bodies, state-owned enterprises, and other entities listed in the article- must provide the information necessary to compile the list of public officials considered Politically Exposed Persons (“PEPs”), as well as its updates.
Subsection IV Bis of Article 3 of the Regulations is also added, authorizing the Ministry of Finance and Public Credit (“Ministry”) to establish, through agreements published in the DOF, exceptions to compliance with obligations and deadlines for the filing of Notices, in accordance with Articles 18 (last paragraph) and 23 (second paragraph) of the Law.
Finally, subsections VI and VII have been added to the article. The first establishes the obligation to promote the coordinated implementation of specialized units for the receipt and analysis of asset-related information among the federal entities; while the second assigns to the Ministry the custody of notices and reports submitted by obligated entities through the SAT.
3. Expansion of SAT’s powers. Article 4 was subject to various amendments that clarify and expand the powers of the Tax Administration Service (by its Spanish acronym, “SAT”). Regarding verification visits, it is established that these must be carried out at the address indicated by the subject in its registration as a vulnerable activity and, if not located at such address, they may be conducted at the address registered with the Federal Taxpayer Registry (by its Spanish acronym, “RFC”).
Likewise, the scope of compliance monitoring is expanded, no longer limited to the filing of notices, but now also including reports, audit opinions, and the regularization of observations detected in internal or external audits.
In sanctioning matters, it is specified that the SAT must conduct and resolve the corresponding procedure before imposing sanctions. Finally, new powers are incorporated that allow requesting the assistance of public force, carry out notifications by electronic means, and requiring audit opinions, as well as documentation evidencing the corresponding regularization.
4. Date of the act and filing of notices. Pursuant to a joint interpretation of Articles 5, 6, and 7 of the Regulations, the relevant date for identifying the client or user and filing notices ceases to be, as a general rule, the date of execution of the act, and is instead subject to what is established by the general rules applicable to each vulnerable activity.
Likewise, when filing the notice, the total amounts paid must be reported, including taxes, although without itemizing them. Furthermore, the aggregation of transactions is carried out per client or user over a period of up to six (6) months, giving rise to the obligation to file the corresponding notice once the applicable threshold is reached or exceeded, without the need to wait for the expiration of such period.
5. Twenty-four (24) hour notice. Article 7 Bis is added, regulating the 24-hour notice requirement provided for in the LFPIORPI, establishing that it must be filed even when the act or transaction is not carried out, using the available data of the person who attempted to carry it out, and specifying that its implementation will be subject to the updating of official formats by the FIU.
6. Deadlines for requests and resolutions. Articles 8 and 9 of the Regulations establish that the FIU and the SAT may request at any time information, documentation, data, and images, which must be delivered within a period of ten (10) business days counted from the day following receipt of the request, with the possibility of a five (5) day extension provided that such extension is requested within the original period.
As a result of the review, the SAT will have ten (10) business days to issue the notice of facts or omissions and will grant five (5) business days to challenge them; if not, they will be deemed accepted. Subsequently, the SAT will have twenty (20) business days to issue the corresponding resolution, being able to impose sanctions for non-compliance without the need to process the procedure provided for in the Federal Administrative Procedure Law.
7. Proof value of information held by the SAT. Article 10 Bis is added, establishing that the SAT may support its resolutions with information contained in files, its own databases, or those provided by other authorities, without being required to disclose which databases were consulted when dealing with information generated by the obligated entity itself.
When the information comes from third parties, the SAT will grant the subject a period of ten (10) business days to submit a written statement, which will form part of the administrative file. Likewise, the information contained in CFDIs and in the databases to which the SAT has access is presumed to be true, and certified copies or reproductions of electronic documents will have the same evidentiary value as the originals.
8. Audit obligation. Article 12 Bis is added, regulating the obligation of subjects carrying out vulnerable activities to obtain and retain an audit opinion, whether internal or external, as well as documentation evidencing the regularization of identified observations. This information must be provided to the SAT when required by the authority, following the terms and formats established by general rules.
9. Document retention period. Article 20 establishes that subjects carrying out vulnerable activities must retain, in physical or electronic format, notices, reports, supporting documentation, and corresponding electronic acknowledgments for a minimum period of ten (10) years, counted from the filing of notices and reports and the issuance of acknowledgments. When the information relates to matters subject to appeal or litigation, the period is suspended and will resume once the decision becomes. This period applies to acts or transactions carried out as of July 17, 2025.
10. Specific vulnerable activities. Articles 21 Bis, 24, and 31 Bis specify rules on games, sweepstakes, loans, credits, and virtual assets. In games and sweepstakes, the sum of two (2) or more transactions with the same client within 24 hours is considered a vulnerable activity.
In loans and credits, the act is understood to occur when the resources are made available to the client. In virtual assets, it will only be necessary to file a notice when one of the assumptions set forth in subsections a) or b) of section XVI of Article 17 of the Law is met, related to the amount of the transaction or the consideration for the service provided.
11. List of Politically Exposed Persons. Chapter Six Bis is incorporated, regulating the integration, confidentiality, and consultation of the list of PEPs prepared by the FIU. When an obligated entity cannot determine whether its client is a PEP, it may consult the FIU through the electronic means established by it.
Authorities providing information to the list must update it within five (5) business days following any change, thus ensuring that the data remains complete and up to date for purposes of preventing money laundering and terrorist financing.
12. Express acknowledgment of violations. Article 55 Bis is added, establishing that to access the benefit of reduction of sanctions provided for in the LFPIORPI, the obligated entity must submit a written statement to the SAT, detailing all violations, declaring under oath that they have been corrected, and attaching documentation evidencing compliance. The deadlines considered “initial” for the verification and sanctioning procedures are also specified.
