LFPIORPI, Article 17, section IV

AML compliance for loans and credit in Mexico

If you regularly or professionally grant loans or credit, or enter into loan or guarantee transactions, without being a financial institution, every client must be identified and a UIF notice is due from 1,605 UMA. SiennaDocs keeps the file for every loan and generates your notices.

Who is covered?

Article 17, section IV of the LFPIORPI treats as a vulnerable activity the regular or professional offering of loans or guarantees, or granting loans or credit, secured or unsecured, by anyone who is not a financial institution.

IV. El ofrecimiento habitual o profesional de operaciones de mutuo o de garantía o de otorgamiento de préstamos o créditos, con o sin garantía, por parte de sujetos distintos a las Entidades Financieras.

Serán objeto de Aviso ante la Secretaría cuando el acto u operación sea por una cantidad igual o superior al equivalente a mil seiscientas cinco veces el valor diario de la UMA;

LFPIORPI, Article 17, section IV. Official Spanish text in force; latest amendment to the Act: DOF, July 16, 2025.

Key points

There is no minimum amount for identification: every loan, guarantee or credit offered on a regular or professional basis is a vulnerable activity (Art. 7, third paragraph, of the Regulations).
SOFOMs are not covered by this section: they comply as financial institutions (Arts. 3, section VI, and 13 to 15 of the LFPIORPI).
If several loans or credits to the same client reach or exceed 1,605 UMA within a period of up to six months, a notice is filed; since there is no identification amount, all of them count toward the total, and the notice relates to the loan that reaches or exceeds the threshold, even if the six months have not elapsed (Art. 7 of the Regulations).
Certain loans within a business group — to employees of the group's companies or to other group companies, including those funded with contributions from workers — do not require a notice, nor do loans by public trusts in which the Ministry of Finance is settlor and the Bank of Mexico is trustee, or in which credit is granted to financial system institutions, as long as the funds were delivered through financial system institutions (General Rules, Art. 27 Bis, sections I and II). The client is still identified; if you had no other reportable transactions that month, you state so in the monthly report (General Rules, Art. 25).

Typical businesses

Private lenders
Pawnshops
Companies that lend to third parties
Private credit funds

Identification and notice thresholds

In multiples of the daily UMA. Peso amounts use the 2026 UMA of MX$117.31.

Case	Identification	Notice to the UIF
Loan, guarantee or credit	All transactions	≥ 1,605 UMA (≈ MX$188,282.55)

Source: LFPIORPI (current text, amended in the DOF on July 16, 2025), its Regulations (amended in the DOF on March 27, 2026) and the General Rules. See the full list of vulnerable activities for 2026

Your obligations as an obligated party

Identify the client: Identify and know the client directly, verify their identity with documents or other officially recognized means of identification, and obtain a copy of them. (Art. 18, sec. I)
Business or occupation: Ask for it whenever there is a business relationship. (Art. 18, sec. II)
Beneficial owner: If the client is a legal entity, trust or other legal arrangement, obtain documents or other officially recognized means of identification that identify its beneficial owner. If the client is an individual, obtain their statement on whether or not they know that a beneficial owner exists and, where applicable, the documentation to identify them. (Art. 18, sec. III)
Keep records 10 years: Keep the information on every transaction and the client's identification for at least ten years from the transaction date. (Art. 18, sec. IV)
Registry enrollment: Register in the Registry of Persons Carrying Out Vulnerable Activities through the online portal, and update or cancel your registration when applicable. (Art. 18, sec. IV Bis)
Notices to the UIF: Filed through the SAT portal by the 17th of the following month. If there is suspicion, within 24 hours of it arising or of learning the information on which it is based, even if the transaction did not take place. (Arts. 18, sec. VI and 23)
Nil report: If there were no reportable transactions in the month, you file a report saying so. (General Rules, Art. 25)
Risk-based approach: Assess your own risks and those of your clients. The assessment must be available from March 1, 2027. (Art. 18, sec. VII)
Internal policy manual: Criteria and procedures, including monitoring of politically exposed persons. Today, the General Rules require a policy document 90 days after registration (Art. 37); the manual with the risk methodology, from March 1, 2027. (Art. 18, sec. VIII)
Annual training: Annual training programs for the board or sole administrator, management, the compliance officer and staff who deal directly with clients, plus staff selection processes. First annual training period: 2027. (Art. 18, sec. IX)
Automated monitoring: Detect out-of-profile transactions, aggregate totals over up to six months where applicable and apply enhanced monitoring to politically exposed or high-risk clients. Today, tracking and aggregation (Regulations, Art. 7; General Rules, Art. 19); automated mechanisms by June 1, 2027. (Art. 18, sec. X)
Annual audit: Internal or independent external review; external if your risk is high. First audited year: 2028. (Art. 18, sec. XI)
Compliance representative: Legal entities and those acting through trusts or any other legal arrangement appoint one before the Ministry of Finance and keep the appointment current. Individuals comply personally and directly, unless they file their notices through a collegiate entity (entidad colegiada). (Art. 20)

How SiennaDocs helps

KYC files: One file per client with documents, expiry dates, approvals and audit log.
Document reading: Extracts data from IDs and documents so you don't type it by hand.
Watchlists: Screening against OFAC, the UN, the SAT 69-B and 69-B Bis lists and countries on the FATF lists.
Beneficial owner: Record of who controls each legal entity or trust.
Client risk: Risk-based assessment with a traffic-light score per client.
Thresholds and aggregation: Flags when a transaction, or a six-month total, reaches the threshold.
XML notices: Generates the notice in the official format, ready to file with the UIF through the SAT portal.
Alerts and audit trail: Alerts on expiries and incidents, and traceability of every action.

Frequently asked questions

Does a SOFOM fall under this section?

No. SOFOMs meet their AML obligations as financial institutions (Arts. 3, section VI, and 13 to 15 of the LFPIORPI). Section IV is for lenders that are not financial institutions.

From what amount must I file a notice?

When the loan or credit is 1,605 UMA or more (about MX$188,282.55 in 2026), no later than the 17th of the month after the month in which you made the funds available to the client (Art. 23 of the Act and Art. 24 of the Regulations).

Does it apply to secured loans?

Yes. The section expressly covers loans or credit with or without collateral, as well as guarantee transactions.

Other vulnerable activities

Book a private demo