LFPIORPI, Article 17, section II(a)

AML compliance for service and credit cards in Mexico

If you regularly or professionally issue or sell service or credit cards without being a financial institution, you must identify the client when accumulated monthly spending on the card account reaches 805 UMA and file a notice with the UIF when it reaches 1,285 UMA. SiennaDocs watches the accumulated spending on every account.

Who is covered?

Article 17, section II(a) of the LFPIORPI treats as a vulnerable activity the regular or professional issuance or sale of service or credit cards by anyone other than financial institutions, when accumulated monthly spending on the account is 805 times the daily UMA or more.

II. La emisión o comercialización, habitual o profesional, distinta a la realizada por las Entidades Financieras de:

a) Tarjetas de servicios o de crédito cuando el gasto mensual acumulado en la cuenta de la tarjeta sea igual o superior al equivalente a ochocientas cinco veces el valor diario de la UMA;

(…)

Serán objeto de Aviso ante la Secretaría, en el caso de tarjetas de servicios o de crédito, cuando el gasto mensual acumulado en la cuenta de la tarjeta sea igual o superior al equivalente a mil doscientas ochenta y cinco veces el valor diario de la UMA. En el caso de tarjetas prepagadas e instrumentos de almacenamiento de valor monetario, cuando se comercialicen o se abonen recursos por una cantidad igual o superior al equivalente a seiscientas cuarenta y cinco veces el valor diario de la UMA;

LFPIORPI, Article 17, section II(a). Official Spanish text in force; latest amendment to the Act: DOF, July 16, 2025.

Key points

The threshold is not per purchase: it is the accumulated monthly spending on the card account.
If you are a financial institution as defined in Article 3, section VI of the LFPIORPI, this section does not apply to you: you comply under that Act's financial institutions section (Arts. 13 to 15) and the law that governs you.
Prepaid cards and vouchers follow a different rule: 645 UMA per transaction.
When the UIF or the SAT requests it, you must provide, no later than two months after notification, information on the destination or use of the cards, including the places and dates where they were used. To that end, you must agree in writing with the third party holding that information that it will provide it to you (General Rules, Art. 20).

Typical businesses

Credit card issuers that are not financial institutions
Service card issuers that are not financial institutions
Credit card sellers

Identification and notice thresholds

In multiples of the daily UMA. Peso amounts use the 2026 UMA of MX$117.31.

Case	Identification	Notice to the UIF
Accumulated monthly spending on the account	≥ 805 UMA (≈ MX$94,434.55)	≥ 1,285 UMA (≈ MX$150,743.35)

Source: LFPIORPI (current text, amended in the DOF on July 16, 2025), its Regulations (amended in the DOF on March 27, 2026) and the General Rules. See the full list of vulnerable activities for 2026

Your obligations as an obligated party

Identify the client: Identify and know the client directly, verify their identity with documents or other officially recognized means of identification, and obtain a copy of them. (Art. 18, sec. I)
Business or occupation: Ask for it whenever there is a business relationship. (Art. 18, sec. II)
Beneficial owner: If the client is a legal entity, trust or other legal arrangement, obtain documents or other officially recognized means of identification that identify its beneficial owner. If the client is an individual, obtain their statement on whether or not they know that a beneficial owner exists and, where applicable, the documentation to identify them. (Art. 18, sec. III)
Keep records 10 years: Keep the information on every transaction and the client's identification for at least ten years from the transaction date. (Art. 18, sec. IV)
Registry enrollment: Register in the Registry of Persons Carrying Out Vulnerable Activities through the online portal, and update or cancel your registration when applicable. (Art. 18, sec. IV Bis)
Notices to the UIF: Filed through the SAT portal by the 17th of the following month. If there is suspicion, within 24 hours of it arising or of learning the information on which it is based, even if the transaction did not take place. (Arts. 18, sec. VI and 23)
Nil report: If there were no reportable transactions in the month, you file a report saying so. (General Rules, Art. 25)
Risk-based approach: Assess your own risks and those of your clients. The assessment must be available from March 1, 2027. (Art. 18, sec. VII)
Internal policy manual: Criteria and procedures, including monitoring of politically exposed persons. Today, the General Rules require a policy document 90 days after registration (Art. 37); the manual with the risk methodology, from March 1, 2027. (Art. 18, sec. VIII)
Annual training: Annual training programs for the board or sole administrator, management, the compliance officer and staff who deal directly with clients, plus staff selection processes. First annual training period: 2027. (Art. 18, sec. IX)
Automated monitoring: Detect out-of-profile transactions, aggregate totals over up to six months where applicable and apply enhanced monitoring to politically exposed or high-risk clients. Today, tracking and aggregation (Regulations, Art. 7; General Rules, Art. 19); automated mechanisms by June 1, 2027. (Art. 18, sec. X)
Annual audit: Internal or independent external review; external if your risk is high. First audited year: 2028. (Art. 18, sec. XI)
Compliance representative: Legal entities and those acting through trusts or any other legal arrangement appoint one before the Ministry of Finance and keep the appointment current. Individuals comply personally and directly, unless they file their notices through a collegiate entity (entidad colegiada). (Art. 20)

How SiennaDocs helps

KYC files: One file per client with documents, expiry dates, approvals and audit log.
Document reading: Extracts data from IDs and documents so you don't type it by hand.
Watchlists: Screening against OFAC, the UN, the SAT 69-B and 69-B Bis lists and countries on the FATF lists.
Beneficial owner: Record of who controls each legal entity or trust.
Client risk: Risk-based assessment with a traffic-light score per client.
Thresholds and aggregation: Flags when a transaction, or a six-month total, reaches the threshold.
XML notices: Generates the notice in the official format, ready to file with the UIF through the SAT portal.
Alerts and audit trail: Alerts on expiries and incidents, and traceability of every action.

Frequently asked questions

How is the threshold measured?

By accumulated monthly spending on the card account: identification from 805 UMA (about MX$94,434.55 in 2026) and notice from 1,285 UMA (about MX$150,743.35).

Who is covered?

Anyone who issues or sells these cards on a regular or professional basis without being a financial institution.

When is the notice due?

No later than the 17th of the month after the month in which the reportable transaction took place (Art. 23 of the Act). From November 30, 2026, the transaction is the accumulated monthly spending on the card and its date is the last day of the spending month (General Rules, Arts. 24 Bis, section II(i), and 24 Bis 1, as amended by Agreement 115/2026).

Other vulnerable activities

Book a private demo