LFPIORPI, Article 17, section XI

AML compliance for professional services in Mexico

Independent lawyers, accountants and advisors who prepare for their clients, or carry out in their name and on their behalf, real estate purchases or sales, the management of their funds or accounts, or the incorporation and management of companies or trusts carry out a vulnerable activity. SiennaDocs keeps every client file and flags which transactions require a notice.

Who is covered?

Article 17, section XI of the LFPIORPI treats as a vulnerable activity providing independent professional services, with no employment relationship with the client, when preparing for the client, or carrying out in the client's name and on their behalf, any of these transactions: buying or selling real estate or assigning rights over it; managing funds, securities or other assets; managing bank, savings or securities accounts; organizing capital or other contributions for the incorporation, operation and management of companies; or incorporating, splitting, merging, operating and managing legal entities or corporate vehicles, including trusts, and buying or selling businesses.

XI. La prestación de servicios profesionales, de manera independiente, sin que medie relación laboral con el cliente respectivo, en aquellos casos en los que se prepare para un cliente o se lleven a cabo en nombre y representación del cliente cualquiera de las siguientes operaciones:

a) La compraventa de bienes inmuebles o la cesión de derechos sobre estos;

b) La administración y manejo de recursos, valores o cualquier otro activo de sus clientes;

c) El manejo de cuentas bancarias, de ahorro o de valores;

d) La organización de aportaciones de capital o cualquier otro tipo de recursos para la constitución, operación y administración de sociedades mercantiles, o

e) La constitución, escisión, fusión, operación y administración de personas morales o vehículos corporativos, incluido el fideicomiso y la compra o venta de entidades mercantiles.

Serán objeto de Aviso ante la Secretaría cuando el prestador de dichos servicios lleve a cabo, en nombre y representación de un cliente, alguna operación financiera que esté relacionada con las operaciones señaladas en los incisos de esta fracción, con respeto al secreto profesional y garantía de defensa en términos de esta Ley;

LFPIORPI, Article 17, section XI. Official Spanish text in force; latest amendment to the Act: DOF, July 16, 2025.

Key points

It only applies if you provide the service independently: if you have an employment relationship with the client, this section does not apply.
Preparing the transaction already makes you an obligated party; the notice is due when you carry out a related financial transaction in the client's name and on their behalf.
A financial transaction is one carried out through a financial institution or using financial instruments, bills and coins (pesos or foreign currency) or precious metals, directly or on the client's instructions (Art. 27 of the Regulations).
Notices are filed with due respect for professional secrecy and the right of defense (Art. 17, section XI).
If you only prepare the transaction, the General Rules allow you to build the client file with just the data required by Annexes 3, 4, 4 Bis, 5, 6, 6 Bis, 7 Bis or 8, depending on the client type, plus the identification data of their representative or attorneys (General Rules, Art. 12 Bis).

Typical businesses

Law firms
Accounting firms
Independent wealth advisors
Corporate structuring consultants

Identification and notice thresholds

In multiples of the daily UMA. Peso amounts use the 2026 UMA of MX$117.31.

Case	Identification	Notice to the UIF
Preparing for a client, or carrying out in the client's name and on their behalf, any of the listed transactions	All transactions	When you carry out a related financial transaction in the client's name and on their behalf

Source: LFPIORPI (current text, amended in the DOF on July 16, 2025), its Regulations (amended in the DOF on March 27, 2026) and the General Rules. See the full list of vulnerable activities for 2026

Your obligations as an obligated party

Identify the client: Identify and know the client directly, verify their identity with documents or other officially recognized means of identification, and obtain a copy of them. (Art. 18, sec. I)
Business or occupation: Ask for it whenever there is a business relationship. (Art. 18, sec. II)
Beneficial owner: If the client is a legal entity, trust or other legal arrangement, obtain documents or other officially recognized means of identification that identify its beneficial owner. If the client is an individual, obtain their statement on whether or not they know that a beneficial owner exists and, where applicable, the documentation to identify them. (Art. 18, sec. III)
Keep records 10 years: Keep the information on every transaction and the client's identification for at least ten years from the transaction date. (Art. 18, sec. IV)
Registry enrollment: Register in the Registry of Persons Carrying Out Vulnerable Activities through the online portal, and update or cancel your registration when applicable. (Art. 18, sec. IV Bis)
Notices to the UIF: Filed through the SAT portal by the 17th of the following month. If there is suspicion, within 24 hours of it arising or of learning the information on which it is based, even if the transaction did not take place. (Arts. 18, sec. VI and 23)
Nil report: If there were no reportable transactions in the month, you file a report saying so. (General Rules, Art. 25)
Risk-based approach: Assess your own risks and those of your clients. The assessment must be available from March 1, 2027. (Art. 18, sec. VII)
Internal policy manual: Criteria and procedures, including monitoring of politically exposed persons. Today, the General Rules require a policy document 90 days after registration (Art. 37); the manual with the risk methodology, from March 1, 2027. (Art. 18, sec. VIII)
Annual training: Annual training programs for the board or sole administrator, management, the compliance officer and staff who deal directly with clients, plus staff selection processes. First annual training period: 2027. (Art. 18, sec. IX)
Automated monitoring: Detect out-of-profile transactions, aggregate totals over up to six months where applicable and apply enhanced monitoring to politically exposed or high-risk clients. Today, tracking and aggregation (Regulations, Art. 7; General Rules, Art. 19); automated mechanisms by June 1, 2027. (Art. 18, sec. X)
Annual audit: Internal or independent external review; external if your risk is high. First audited year: 2028. (Art. 18, sec. XI)
Compliance representative: Legal entities and those acting through trusts or any other legal arrangement appoint one before the Ministry of Finance and keep the appointment current. Individuals comply personally and directly, unless they file their notices through a collegiate entity (entidad colegiada). (Art. 20)

How SiennaDocs helps

KYC files: One file per client with documents, expiry dates, approvals and audit log.
Document reading: Extracts data from IDs and documents so you don't type it by hand.
Watchlists: Screening against OFAC, the UN, the SAT 69-B and 69-B Bis lists and countries on the FATF lists.
Beneficial owner: Record of who controls each legal entity or trust.
Client risk: Risk-based assessment with a traffic-light score per client.
Thresholds and aggregation: Flags when a transaction, or a six-month total, reaches the threshold.
XML notices: Generates the notice in the official format, ready to file with the UIF through the SAT portal.
Alerts and audit trail: Alerts on expiries and incidents, and traceability of every action.

Frequently asked questions

Is a law firm covered?

If it provides independent services and prepares for its clients, or carries out in their name and on their behalf, any of the section XI transactions — for example, property purchases or incorporations — it carries out a vulnerable activity.

When must I file a notice?

When, in the client's name and on their behalf, you carry out a financial transaction related to any of those transactions, whatever its amount. The notice is due no later than the 17th of the month after the month in which you carried out that transaction (Art. 23 of the Act). From November 30, 2026, the relevant date is when you carry out the financial transaction on the client's behalf or instructions (General Rules, Art. 24 Bis, section VII, as amended by Agreement 115/2026).

Does filing a notice breach professional secrecy?

No. The Act provides that filing notices and information does not breach confidentiality or professional secrecy obligations, and that this cannot be restricted by a confidentiality clause (Art. 22). Section XI adds that notices are filed with respect for professional secrecy and the right of defense under the Act itself.

Can I pay in cash for my client?

Not when the transaction reaches the Article 32 limits, which bind both the payer and the payee, including when you pay on your client's behalf. Under this section the most common are creating or transferring property rights over real estate from 8,025 UMA (sec. I) and transferring shares or equity interests from 3,210 UMA (sec. VI); if you manage client funds, vehicles, watches and jewelry, artwork, gaming tickets and prizes and armoring also count from 3,210 UMA (secs. II to V), and the use of real estate or vehicles from 3,210 UMA a month (sec. VII). The prohibition is paying or accepting payment in bills and coins, in pesos or foreign currency, or in precious metals, in one or several installments and even through a financial institution; consigning that payment in cash or precious metals is also prohibited (Art. 32, sec. VIII; Art. 42 of the Regulations). The value includes taxes and other charges (Art. 6 of the Regulations).

Other vulnerable activities

Book a private demo