LFPIORPI, Article 17, section XVI

AML compliance for virtual assets in Mexico

If you regularly and professionally offer virtual-asset exchange through a platform — exchange, trading or custody — without being a financial institution, you must identify the client in every transaction and file a notice with the UIF when their transactions reach 210 UMA, individually or added up over a period of up to six months, or when the fee or other consideration for a transaction reaches 4 UMA. SiennaDocs keeps every user file and the data for every transaction.

Who is covered?

Article 17, section XVI of the LFPIORPI treats as a vulnerable activity the regular and professional offering of virtual-asset exchange by anyone other than financial institutions, through electronic, digital or similar platforms they manage or operate, facilitating or carrying out the purchase or sale of clients' virtual assets, or providing means to safekeep, store or transfer them, including transactions with Mexican citizens from another jurisdiction. Custody, storage or transfer refers to virtual assets other than those recognized by the Bank of Mexico, and the Act does not treat legal tender, foreign currencies or assets denominated in them as virtual assets.

XVI. El ofrecimiento habitual y profesional de intercambio de activos virtuales por parte de sujetos distintos a las Entidades Financieras, que se lleven a cabo a través de plataformas electrónicas, digitales o similares, que administren u operen, facilitando o realizando operaciones de compra o venta de dichos activos propiedad de sus clientes o bien, provean medios para custodiar, almacenar, o transferir activos virtuales distintos a los reconocidos por el Banco de México en términos de la Ley para Regular las Instituciones de Tecnología Financiera, incluidas las operaciones que se realicen con ciudadanos mexicanos desde otra jurisdicción. Se entenderá como activo virtual toda representación de valor registrada electrónicamente y utilizada entre el público como medio de pago para todo tipo de actos jurídicos, cuya transferencia únicamente puede llevarse a cabo a través de medios electrónicos. En ningún caso se entenderá como activo virtual la moneda de curso legal en territorio nacional, las divisas ni cualquier otro activo denominado en moneda de curso legal o divisas.

Serán objeto de Aviso ante la Secretaría:

a) Cuando el monto de la operación que realice cada Cliente o Usuario de quien realice la Actividad Vulnerable a que se refiere esta fracción sea por una cantidad igual o superior al equivalente a doscientas diez veces el valor diario de la UMA.

b) Cuando las operaciones den lugar al cobro de una contraprestación por el servicio brindado, independientemente de su denominación, ésta sea por una cantidad igual o superior al equivalente a cuatro veces el valor diario de la UMA.

Quienes realicen las Actividades Vulnerables establecidas en esta fracción deberán obtener, mantener y poner a disposición de las autoridades competentes, la información precisa sobre las operaciones con activos virtuales del originante, del receptor y, en su caso, del Beneficiario Controlador, de conformidad con lo que dispongan las reglas de carácter general.

En el evento de que el Banco de México reconozca en términos de la Ley para Regular las Instituciones de Tecnología Financiera activos virtuales, las personas que provean los medios a que se refiere esta fracción, deberán obtener las autorizaciones correspondientes en los plazos que señale dicho Banco de México en las disposiciones respectivas.

LFPIORPI, Article 17, section XVI. Official Spanish text in force; latest amendment to the Act: DOF, July 16, 2025.

Key points

There is no minimum amount for identification: every transaction is a vulnerable activity and the client must be identified (Art. 7, third paragraph, of the Regulations).
You must obtain, keep and make available to the competent authorities accurate information on virtual-asset transactions about the originator, the recipient and, where applicable, the beneficial owner, as set out in the general rules (Art. 17, section XVI, paragraph added in the DOF on July 16, 2025). From November 30, 2026, the General Rules set its minimum content, which must be kept for ten years and delivered to the UIF or the SAT upon request (Art. 24 Bis 2, as amended by Agreement 115/2026).
It also applies to transactions with Mexican citizens carried out from another jurisdiction.
Before registering, you must deliver additional documents to the SAT in hard copy: proof of address (including each establishment), trade name and websites; individuals also add official ID, CURP and RFC; legal entities also add a certified copy of the articles of incorporation, a list of those who hold or intend to hold a direct or indirect equity interest, and legal representative details (General Rules, Art. 10 Bis). From November 30, 2026, apps and beneficial owner information are added, and those already registered have six months to update and deliver it (Agreement 115/2026, twelfth transitional article).
If a single transaction reaches both thresholds (210 UMA for the transaction and 4 UMA for the fee), only the item (a) notice is filed (Art. 31 Bis of the Regulations, already in force). From November 30, 2026, the fee is also measured per transaction and is not aggregated (General Rules, Art. 24 Bis 5, as amended by Agreement 115/2026).
A client's transactions of the same type are added up over a period of up to six months: once the total reaches or exceeds 210 UMA a notice is filed, even if no single transaction reaches it; since there is no identification amount, every transaction counts toward the total (Art. 7 of the Regulations). From November 30, 2026, the General Rules expressly include this section in tracking and aggregation (Art. 19, as amended by Agreement 115/2026).

Typical businesses

Crypto exchanges
Crypto trading platforms
Virtual-asset custodians
Crypto OTC desks operating through a platform
Custodial wallet providers

Identification and notice thresholds

In multiples of the daily UMA. Peso amounts use the 2026 UMA of MX$117.31.

Case	Identification	Notice to the UIF
Each client or user transaction	All transactions	≥ 210 UMA (≈ MX$24,635.10)
Fee or other consideration charged for the service	All transactions	≥ 4 UMA (≈ MX$469.24)

Source: LFPIORPI (current text, amended in the DOF on July 16, 2025), its Regulations (amended in the DOF on March 27, 2026) and the General Rules. See the full list of vulnerable activities for 2026

Your obligations as an obligated party

Identify the client: Identify and know the client directly, verify their identity with documents or other officially recognized means of identification, and obtain a copy of them. (Art. 18, sec. I)
Business or occupation: Ask for it whenever there is a business relationship. (Art. 18, sec. II)
Beneficial owner: If the client is a legal entity, trust or other legal arrangement, obtain documents or other officially recognized means of identification that identify its beneficial owner. If the client is an individual, obtain their statement on whether or not they know that a beneficial owner exists and, where applicable, the documentation to identify them. (Art. 18, sec. III)
Keep records 10 years: Keep the information on every transaction and the client's identification for at least ten years from the transaction date. (Art. 18, sec. IV)
Registry enrollment: Register in the Registry of Persons Carrying Out Vulnerable Activities through the online portal, and update or cancel your registration when applicable. (Art. 18, sec. IV Bis)
Notices to the UIF: Filed through the SAT portal by the 17th of the following month. If there is suspicion, within 24 hours of it arising or of learning the information on which it is based, even if the transaction did not take place. (Arts. 18, sec. VI and 23)
Nil report: If there were no reportable transactions in the month, you file a report saying so. (General Rules, Art. 25)
Risk-based approach: Assess your own risks and those of your clients. The assessment must be available from March 1, 2027. (Art. 18, sec. VII)
Internal policy manual: Criteria and procedures, including monitoring of politically exposed persons. Today, the General Rules require a policy document 90 days after registration (Art. 37); the manual with the risk methodology, from March 1, 2027. (Art. 18, sec. VIII)
Annual training: Annual training programs for the board or sole administrator, management, the compliance officer and staff who deal directly with clients, plus staff selection processes. First annual training period: 2027. (Art. 18, sec. IX)
Automated monitoring: Detect out-of-profile transactions, aggregate totals over up to six months where applicable and apply enhanced monitoring to politically exposed or high-risk clients. Today, tracking and aggregation (Regulations, Art. 7; General Rules, Art. 19); automated mechanisms by June 1, 2027. (Art. 18, sec. X)
Annual audit: Internal or independent external review; external if your risk is high. First audited year: 2028. (Art. 18, sec. XI)
Compliance representative: Legal entities and those acting through trusts or any other legal arrangement appoint one before the Ministry of Finance and keep the appointment current. Individuals comply personally and directly, unless they file their notices through a collegiate entity (entidad colegiada). (Art. 20)

How SiennaDocs helps

KYC files: One file per client with documents, expiry dates, approvals and audit log.
Document reading: Extracts data from IDs and documents so you don't type it by hand.
Watchlists: Screening against OFAC, the UN, the SAT 69-B and 69-B Bis lists and countries on the FATF lists.
Beneficial owner: Record of who controls each legal entity or trust.
Client risk: Risk-based assessment with a traffic-light score per client.
Thresholds and aggregation: Flags when a transaction, or a six-month total, reaches the threshold.
XML notices: Generates the notice in the official format, ready to file with the UIF through the SAT portal.
Alerts and audit trail: Alerts on expiries and incidents, and traceability of every action.

Frequently asked questions

From what amount must I file a notice?

When a client's transactions reach 210 UMA (about MX$24,635.10 in 2026), individually or added up over a period of up to six months, or when the fee or other consideration for a transaction is 4 UMA or more (about MX$469.24). The notice is due no later than the 17th of the month after the month in which the transaction took place (Art. 23 of the Act). From November 30, 2026, the transaction date for the notice is the date on which it is deemed completed and the notice threshold has been reached (General Rules, Art. 24 Bis, section IX, as amended by Agreement 115/2026).

What transaction data must I obtain and keep?

Accurate information on virtual-asset transactions about the originator, the recipient and, where applicable, the beneficial owner; you must obtain it, keep it and make it available to the competent authorities, as set out in the general rules (Art. 17, section XVI, paragraph added in 2025).

Does it apply if my platform is outside Mexico?

Yes, when you deal with Mexican citizens: the section expressly covers transactions with them from another jurisdiction.

Other vulnerable activities

Book a private demo