LFPIORPI, Article 17, section II(c)

AML compliance for rebate and rewards cards in Mexico

If you regularly or professionally issue or sell e-wallets, certificates or coupons that, without a prior deposit by the holder, are loaded with prizes, promotions, rebates or rewards and can be used outside the issuer or to withdraw cash, you must identify and file a notice with the UIF from 645 UMA per transaction. SiennaDocs tracks every issuance and load.

Who is covered?

Article 17, section II of the LFPIORPI covers the regular or professional issuance or sale of stored-value instruments by anyone other than financial institutions. The Regulations specify that these include e-wallets, certificates or coupons that, without a prior deposit by the holder, are loaded with prizes, promotions, rebates or rewards and can be used at businesses other than the issuer or to withdraw cash (Art. 22, section II of the Regulations).

II. La emisión o comercialización, habitual o profesional, distinta a la realizada por las Entidades Financieras de:

(…)

c) Instrumentos de almacenamiento de valor monetario cuando su emisión, comercialización o abono de recursos sea por una cantidad igual o superior al equivalente a seiscientas cuarenta y cinco veces el valor diario de la UMA, por operación.

Serán objeto de Aviso ante la Secretaría, en el caso de tarjetas de servicios o de crédito, cuando el gasto mensual acumulado en la cuenta de la tarjeta sea igual o superior al equivalente a mil doscientas ochenta y cinco veces el valor diario de la UMA. En el caso de tarjetas prepagadas e instrumentos de almacenamiento de valor monetario, cuando se comercialicen o se abonen recursos por una cantidad igual o superior al equivalente a seiscientas cuarenta y cinco veces el valor diario de la UMA;

LFPIORPI, Article 17, section II(c). Official Spanish text in force; latest amendment to the Act: DOF, July 16, 2025.

Key points

Identification and notice share the same threshold: 645 UMA per transaction.
Issuance, sale and loading of funds after issuance all count as transactions (Art. 23 of the Regulations).
Article 22 of the Regulations distinguishes: section I covers vouchers or coupons redeemable for goods or services; section II, rewards e-wallets, certificates or coupons that can be used outside the issuer or to withdraw cash.
When the UIF or the SAT requests it, you must provide, no later than two months after notification, information on the destination or use of the instruments, including the places and dates where they were used, funded or topped up. To that end, you must agree in writing with the third party holding that information that it will provide it to you (General Rules, Art. 20).

Typical businesses

Rewards e-wallet issuers
Loyalty programs whose balance can be used outside the issuer or withdrawn in cash
Corporate rewards platforms
Rebate certificate and coupon issuers

Identification and notice thresholds

In multiples of the daily UMA. Peso amounts use the 2026 UMA of MX$117.31.

Case	Identification	Notice to the UIF
Issuance, sale or loading of funds	≥ 645 UMA (≈ MX$75,664.95)	≥ 645 UMA (≈ MX$75,664.95)

Source: LFPIORPI (current text, amended in the DOF on July 16, 2025), its Regulations (amended in the DOF on March 27, 2026) and the General Rules. See the full list of vulnerable activities for 2026

Your obligations as an obligated party

Identify the client: Identify and know the client directly, verify their identity with documents or other officially recognized means of identification, and obtain a copy of them. (Art. 18, sec. I)
Business or occupation: Ask for it whenever there is a business relationship. (Art. 18, sec. II)
Beneficial owner: If the client is a legal entity, trust or other legal arrangement, obtain documents or other officially recognized means of identification that identify its beneficial owner. If the client is an individual, obtain their statement on whether or not they know that a beneficial owner exists and, where applicable, the documentation to identify them. (Art. 18, sec. III)
Keep records 10 years: Keep the information on every transaction and the client's identification for at least ten years from the transaction date. (Art. 18, sec. IV)
Registry enrollment: Register in the Registry of Persons Carrying Out Vulnerable Activities through the online portal, and update or cancel your registration when applicable. (Art. 18, sec. IV Bis)
Notices to the UIF: Filed through the SAT portal by the 17th of the following month. If there is suspicion, within 24 hours of it arising or of learning the information on which it is based, even if the transaction did not take place. (Arts. 18, sec. VI and 23)
Nil report: If there were no reportable transactions in the month, you file a report saying so. (General Rules, Art. 25)
Risk-based approach: Assess your own risks and those of your clients. The assessment must be available from March 1, 2027. (Art. 18, sec. VII)
Internal policy manual: Criteria and procedures, including monitoring of politically exposed persons. Today, the General Rules require a policy document 90 days after registration (Art. 37); the manual with the risk methodology, from March 1, 2027. (Art. 18, sec. VIII)
Annual training: Annual training programs for the board or sole administrator, management, the compliance officer and staff who deal directly with clients, plus staff selection processes. First annual training period: 2027. (Art. 18, sec. IX)
Automated monitoring: Detect out-of-profile transactions, aggregate totals over up to six months where applicable and apply enhanced monitoring to politically exposed or high-risk clients. Today, tracking and aggregation (Regulations, Art. 7; General Rules, Art. 19); automated mechanisms by June 1, 2027. (Art. 18, sec. X)
Annual audit: Internal or independent external review; external if your risk is high. First audited year: 2028. (Art. 18, sec. XI)
Compliance representative: Legal entities and those acting through trusts or any other legal arrangement appoint one before the Ministry of Finance and keep the appointment current. Individuals comply personally and directly, unless they file their notices through a collegiate entity (entidad colegiada). (Art. 20)

How SiennaDocs helps

KYC files: One file per client with documents, expiry dates, approvals and audit log.
Document reading: Extracts data from IDs and documents so you don't type it by hand.
Watchlists: Screening against OFAC, the UN, the SAT 69-B and 69-B Bis lists and countries on the FATF lists.
Beneficial owner: Record of who controls each legal entity or trust.
Client risk: Risk-based assessment with a traffic-light score per client.
Thresholds and aggregation: Flags when a transaction, or a six-month total, reaches the threshold.
XML notices: Generates the notice in the official format, ready to file with the UIF through the SAT portal.
Alerts and audit trail: Alerts on expiries and incidents, and traceability of every action.

Frequently asked questions

Is a points program covered?

Yes, if points are loaded on a regular or professional basis, without a prior deposit by the holder, onto an e-wallet, certificate or coupon that can be used at businesses other than the issuer or to withdraw cash, and the transaction is 645 UMA or more (Art. 17, section II(c) of the Act and Art. 22, section II of the Regulations).

From what amount must I identify and file a notice?

From 645 UMA per transaction (about MX$75,664.95 in 2026), for both identification and notice, no later than the 17th of the month after the month in which the transaction took place (Art. 23 of the Act). From November 30, 2026, the transaction date for the notice is the date on which the issuance, sale or load is deemed settled and the notice threshold has been reached (General Rules, Art. 24 Bis, section II(ii), as amended by Agreement 115/2026).

Does it apply to financial institutions?

Not through this route: section II refers to issuance or sale other than by financial institutions, which comply under the LFPIORPI financial institutions section (Arts. 3, section VI, and 13 to 15) and the laws that govern them.

Other vulnerable activities

Book a private demo