LFPIORPI, Article 17, section X

AML compliance for cash and valuables transport in Mexico

If you regularly or professionally transport or safeguard other people's cash or valuables, every client must be identified and a UIF notice is due from 3,210 UMA — or always, if you cannot tell how much you moved or held. SiennaDocs makes sure none slips through.

Who is covered?

Article 17, section X of the LFPIORPI treats as a vulnerable activity the regular or professional transport or custody of cash or valuables, except those in which the Bank of Mexico and securities depository institutions take part.

X. La prestación habitual o profesional de servicios de traslado o custodia de dinero o valores, con excepción de aquellos en los que intervenga el Banco de México y las instituciones dedicadas al depósito de valores.

Serán objeto de Aviso ante la Secretaría:

a) Cuando el traslado o custodia sea por un monto igual o superior al equivalente a tres mil doscientas diez veces el valor diario de la UMA, o

b) Cuando no sea posible determinar el monto de lo trasladado o custodiado, se presentará el Aviso ante la Secretaría en todos los casos.

LFPIORPI, Article 17, section X. Official Spanish text in force; latest amendment to the Act: DOF, July 16, 2025.

Key points

There is no minimum amount for identification: every transport or custody service provided on a regular or professional basis is a vulnerable activity (Art. 7, third paragraph, of the Regulations).
The amount is the value of the cash or the value stated on the securities themselves; if they have no intrinsic value, state none and no document sets a value, a notice is filed in every case (Art. 26 of the Regulations).
Services in which the Bank of Mexico and securities depository institutions take part are excluded.
If several services for the same client reach or exceed 3,210 UMA within a period of up to six months, a notice is filed; since there is no identification amount, all of them count toward the total, and the notice relates to the service that reaches or exceeds the threshold, even if the six months have not elapsed (Art. 7 of the Regulations).

Typical businesses

Cash-in-transit companies
Private security firms with custody services
Private vaults
Precious metal custody services

Identification and notice thresholds

In multiples of the daily UMA. Peso amounts use the 2026 UMA of MX$117.31.

Case	Identification	Notice to the UIF
Transport or custody with a known amount	All transactions	≥ 3,210 UMA (≈ MX$376,565.10)
Transport or custody with an unknown amount	All transactions	Always

Source: LFPIORPI (current text, amended in the DOF on July 16, 2025), its Regulations (amended in the DOF on March 27, 2026) and the General Rules. See the full list of vulnerable activities for 2026

Your obligations as an obligated party

Identify the client: Identify and know the client directly, verify their identity with documents or other officially recognized means of identification, and obtain a copy of them. (Art. 18, sec. I)
Business or occupation: Ask for it whenever there is a business relationship. (Art. 18, sec. II)
Beneficial owner: If the client is a legal entity, trust or other legal arrangement, obtain documents or other officially recognized means of identification that identify its beneficial owner. If the client is an individual, obtain their statement on whether or not they know that a beneficial owner exists and, where applicable, the documentation to identify them. (Art. 18, sec. III)
Keep records 10 years: Keep the information on every transaction and the client's identification for at least ten years from the transaction date. (Art. 18, sec. IV)
Registry enrollment: Register in the Registry of Persons Carrying Out Vulnerable Activities through the online portal, and update or cancel your registration when applicable. (Art. 18, sec. IV Bis)
Notices to the UIF: Filed through the SAT portal by the 17th of the following month. If there is suspicion, within 24 hours of it arising or of learning the information on which it is based, even if the transaction did not take place. (Arts. 18, sec. VI and 23)
Nil report: If there were no reportable transactions in the month, you file a report saying so. (General Rules, Art. 25)
Risk-based approach: Assess your own risks and those of your clients. The assessment must be available from March 1, 2027. (Art. 18, sec. VII)
Internal policy manual: Criteria and procedures, including monitoring of politically exposed persons. Today, the General Rules require a policy document 90 days after registration (Art. 37); the manual with the risk methodology, from March 1, 2027. (Art. 18, sec. VIII)
Annual training: Annual training programs for the board or sole administrator, management, the compliance officer and staff who deal directly with clients, plus staff selection processes. First annual training period: 2027. (Art. 18, sec. IX)
Automated monitoring: Detect out-of-profile transactions, aggregate totals over up to six months where applicable and apply enhanced monitoring to politically exposed or high-risk clients. Today, tracking and aggregation (Regulations, Art. 7; General Rules, Art. 19); automated mechanisms by June 1, 2027. (Art. 18, sec. X)
Annual audit: Internal or independent external review; external if your risk is high. First audited year: 2028. (Art. 18, sec. XI)
Compliance representative: Legal entities and those acting through trusts or any other legal arrangement appoint one before the Ministry of Finance and keep the appointment current. Individuals comply personally and directly, unless they file their notices through a collegiate entity (entidad colegiada). (Art. 20)

How SiennaDocs helps

KYC files: One file per client with documents, expiry dates, approvals and audit log.
Document reading: Extracts data from IDs and documents so you don't type it by hand.
Watchlists: Screening against OFAC, the UN, the SAT 69-B and 69-B Bis lists and countries on the FATF lists.
Beneficial owner: Record of who controls each legal entity or trust.
Client risk: Risk-based assessment with a traffic-light score per client.
Thresholds and aggregation: Flags when a transaction, or a six-month total, reaches the threshold.
XML notices: Generates the notice in the official format, ready to file with the UIF through the SAT portal.
Alerts and audit trail: Alerts on expiries and incidents, and traceability of every action.

Frequently asked questions

What if I don't know how much cash I moved?

When the amount transported or held cannot be determined, a notice is filed in every case (Art. 17, section X, item b).

From what amount must I file a notice?

From 3,210 UMA (about MX$376,565.10 in 2026) when the amount can be determined, no later than the 17th of the month after the month in which the transaction took place (Art. 23 of the Act). From November 30, 2026, the transaction date for the notice is the date on which the service is deemed completed and the notice threshold has been reached (General Rules, Art. 24 Bis, section VI, as amended by Agreement 115/2026).

Are private vaults covered?

Yes, if they provide custody of cash or valuables on a regular or professional basis under a federal or state private security authorization (Art. 25 of the Regulations).

Other vulnerable activities

Book a private demo