Vulnerable Activities 2026: full list and thresholds (LFPIORPI) | SiennaDocs

The complete list of 2026 vulnerable activities under Mexico's AML Act, with thresholds in UMA and pesos. See in minutes whether your business is a regulated party.

Pablo Rodríguez · July 30, 2026

Vulnerable Activities 2026: the full list and how to know if your business performs one

One of the most common questions among business owners and accountants in Mexico is as simple as it is important: "is my business required to comply with the AML Act?" The answer depends on one thing: whether you perform a vulnerable activity (actividad vulnerable).

In this guide we give you the full list, updated for 2026, we explain the thresholds without complications, and we leave you a quick way to self-diagnose. Let's take it step by step.

What is a "vulnerable activity"?

A vulnerable activity is a line of business or type of operation that — because it involves high amounts, valuable goods, or cash — is especially attractive to someone trying to launder money. The Federal Law for the Prevention and Identification of Operations with Resources of Illicit Origin (LFPIORPI, or Mexico's AML Act) lists them in its Article 17.

If your business performs any of them, you become a regulated party (sujeto obligado) and take on concrete responsibilities: identifying your clients, assembling their files, keeping the documentation, and — in many cases — filing reports with the UIF, which are submitted through the SAT portal.

The key concept: identification threshold vs. reporting threshold

Before you look at the list, understand these two "steps". Almost every activity has two trigger amounts, measured in UMA (Mexico's Unit of Measurement and Update):

• Identification threshold: at this amount and above you must identify the client and assemble their file (collect their data and documents). This is the lower step.
• Reporting threshold: at this amount and above — never lower than the identification one — in addition to identifying, you must file a report with the UIF informing about the operation.

In other words: identifying means "keep the file"; reporting means "notify the authority about the operation". And note this detail, set by Article 7 of the Regulations as amended in March 2026: if an activity has no identification threshold, then all of its operations count as vulnerable activity, regardless of the amount.

The full list of vulnerable activities (Art. 17 LFPIORPI)

All amounts are expressed as multiples of the daily UMA value. For 2026, the daily UMA is MXN $117.31 (in force since February 1, 2026, per INEGI).

Some sections (such as notaries and public brokers) have several scenarios with their own rules. If you work in public trust or foreign trade, review the detail of your section.

How much is that in pesos? (UMA 2026 = MXN $117.31)

To put the numbers into context, here are the most consulted thresholds converted to pesos:

Because thresholds are set in UMA, their peso value changes every year. Recalculate with the UMA in force.

How to know in 2 minutes whether your business performs a vulnerable activity

Ask yourself these questions. If you answer "yes" to any of them, you are very likely a regulated party:

• Do you sell or broker real estate, or develop real estate projects?
• Do you lease real estate for a monthly rent above 1,605 UMA (MXN $188,282.55 in 2026)?
• Do you sell cars, motorcycles, aircraft, or boats, new or used?
• Do you trade jewelry, watches, precious metals or stones?
• Do you extend loans, financing, or credit without being a financial institution?
• Do you receive donations as a non-profit association or society?
• Do you issue cards, vouchers, or stored-value instruments for services or prepaid use?
• Do you run betting games, contests, or raffles?
• Do you issue or sell traveler's checks without being a financial institution?
• Do you offer armoring, works of art, transportation of valuables, or professional services that involve handling client resources?
• Do you offer others, through a platform, the purchase, sale, exchange, custody, or transfer of virtual assets?
• Are you a notary, public broker, or customs agent?

I am already a regulated party — now what?

If your line of business made the list, these are your basic obligations under the current framework:

1. Register in the Registry of Persons Carrying Out Vulnerable Activities through the SAT portal (you will need your RFC and a valid e.firma). If you stop carrying out the activity, deregister: while you remain registered, you must keep filing reports or nil reports.
2. Identify your clients and assemble their files when they reach the identification threshold.
3. File your reports no later than the 17th day of the month following the operation (when the reporting threshold is reached or exceeded).
4. File the nil report: if you had no reportable operations in a month, you file a report stating so (General Rules, Art. 25).
5. 24-hour report: if there is suspicion that the funds may come from or be intended for operations with resources of illicit origin, you file a report within 24 hours of the suspicion arising or of learning the information on which it is based, even if the operation did not take place (Art. 18, section VI, of the Act).
6. Keep the documentation for 10 years (the period was extended from 5 to 10 years under the reform).
7. Compliance representative: if you are a legal entity or act through a trust or other legal arrangement, appoint one before the Ministry of Finance and keep the appointment current. If you are an individual, you comply personally and directly, unless you file your reports through a collegiate entity (entidad colegiada).
8. New obligations from the reform: risk-based assessment (available from March 1, 2027), internal policy manual with the risk methodology (from March 1, 2027), annual training (first period: 2027), monitoring with automated mechanisms (by June 1, 2027) and annual audit (first audited year: 2028), on the dates set by the General Rules as amended by Agreement 115/2026.

A couple of fine details worth keeping in mind:

• Accumulation: operations with the same client are added up by type of operation over a period of up to 6 months. Only operations that on their own require identification are added (if the activity has no identification threshold, all of them are), and the report relates to the operation that reaches or exceeds the reporting threshold, even if the six months have not elapsed (Art. 7 of the Regulations). You can reach a threshold "in installments", so you need to keep track.
• Cash restrictions: there are operations (real estate, vehicles, jewelry, etc.) where the law prohibits payment in cash at or above certain amounts (Article 32 of the LFPIORPI).

Do not run this in Excel

Identifying clients, monitoring thresholds, accumulating operations over 6 months, generating reports on the 17th, and keeping everything for 10 years — doing it by hand, in spreadsheets and folders, is exactly where mistakes start… and fines follow.

At SiennaDocs we automate the entire cycle for the vulnerable activities that most need it — real estate, real estate development, leasing, vehicles, and loans, among others: structured KYC files, automatic threshold and accumulation control, and reports ready to file with the UIF through the SAT portal. Book a demo and we will review your case together.

Frequently asked questions

How many vulnerable activities are there? Article 17 of the LFPIORPI lists 17 sections: I through XVI, plus section V Bis added in 2025 (some with several scenarios, such as notaries and public brokers). They cover everything from real estate and vehicles to virtual assets.

If I do not reach the reporting threshold, do I still have to do anything? Yes. If you reach the identification threshold, you already have to assemble the client's file, even if you do not yet have to file a report. And if you had no reportable operations that month, you file the nil report (General Rules, Art. 25).

Are the thresholds in pesos or in UMA? In UMA. That is why their peso equivalent changes every year. In 2026, the daily UMA is MXN $117.31.

What happens if I register late or fail to file reports? It is an infringement sanctioned by the SAT. Failing to file reports carries fines of 10,000 to 65,000 UMA, or 10% to 100% of the operation's value when it can be quantified, whichever is greater. Filing up to 30 days late, or registering late, carries 200 to 2,000 UMA; beyond 30 days, it is sanctioned as a failure to file (Arts. 53 and 54 of the LFPIORPI). Voluntarily regularizing your status before a verification visit begins can reduce or avoid the sanction.

This content is informational and does not constitute legal advice. Thresholds and obligations may change; always verify the current text of the LFPIORPI, its Regulations, and the general rules, or consult a specialist.