Mexico's AML Act reform 2025–2026 | LFPIORPI changes | SiennaDocs
A clear summary of the 2025 reform to LFPIORPI and the 2026 reform to its Regulations: 25% beneficial owner threshold, 24-hour report, 10-year retention, and new obligations.
Pablo Rodríguez · August 4, 2026
Mexico's AML Act reform 2025–2026: the changes that actually affect you
Mexico's Anti-Money Laundering Act has just gone through its most significant overhaul in more than a decade. It was not one but two back-to-back reforms: first to the Act itself (LFPIORPI), published in the Official Gazette of the Federation on July 16, 2025, and then to its Regulations, published on March 27, 2026. Together, they raise the bar for every regulated party.
If your business performs a vulnerable activity, this is what changed — explained directly and without filler.
Update · August 2026: Mexico also published Acuerdo 115/2026, which reforms the AML General Rules and activates five obligations this Decree had left suspended since 2025. It complements what follows.
1. The ultimate beneficial owner is now identified from 25%
Previously, in order to identify the "real owner" behind a company (the ultimate beneficial owner, known in Mexican law as beneficiario controlador), the threshold was anyone holding more than 50% of the capital. The reform lowered that threshold to more than 25% (Article 3, section III of the Act).
In practice: when your client is a legal entity or a Mexican trust (fideicomiso), you now have to identify more individuals sitting behind that structure — not only the majority partner. The Act also clarifies that "beneficiario controlador" is equivalent to beneficial owner and real owner. Commercial companies must record this information in an electronic system.
What to do: update your onboarding forms so they capture ownership and control from the 25% threshold.
2. Expanded definition of PEP (and an official UIF list)
Politically Exposed Persons (PEPs) are individuals who hold or have held public office — and their close associates — because they carry a higher risk. The reform expanded the definition to include both domestic and foreign public officials (Article 3, section IX Bis).
In addition, the new Regulations created an entire chapter on PEPs: the Financial Intelligence Unit (UIF) will maintain a List of Politically Exposed Persons, and regulated parties will be able to consult it to verify whether a client is a PEP, in accordance with the general rules.
What to do: your compliance manual must include specific criteria for detecting PEPs and applying enhanced monitoring.
3. The new "24-hour report" (aviso de 24 horas)
This is one of the most demanding changes. When you have a suspicion that an operation involves illicit proceeds, you must file a report within 24 hours of detecting it (Article 18, section VI of the Act).
Here is the sensitive part: the report is filed even if the operation was not completed, and even if you only have the data of the person who attempted to carry it out (Article 7 Bis of the Regulations). The monthly reports (avisos mensuales) due on the 17th are no longer enough: this real-time obligation is on top of them.
What to do: define internally what qualifies as an "unusual" or "suspicious" operation and who is authorized to trigger the report, so you do not miss the 24-hour deadline.
4. Record retention: now 10 years
The period for keeping documentation of your operations and client files increased from 5 to 10 years (Article 18, section IV of the Act and Article 20 of the Regulations).
An important detail: the 10-year period applies to operations carried out from July 17, 2025 onward; earlier operations retain the 5-year period.
What to do: review your records policy (physical and electronic). Keeping a decade of retrievable, complete files is far easier with a system than with folders.
5. New formal compliance obligations
Perhaps the biggest substantive change: the Act now requires a compliance structure similar to what banks have. These obligations were added to Article 18:
- Risk assessment with a risk-based approach: identify and mitigate your own risks and those of your clients.
- Internal compliance policy manual (including PEP criteria).
- Annual training for directors, compliance officers, and staff dealing with clients.
- Automated, ongoing monitoring to detect operations outside the client's profile.
- Audit: internal or external for low/medium risk, and mandatory external audit for high risk.
What to do: if you were only filing reports until now, this is a big leap. You need to document policies, train, and — in practice — rely on technology for monitoring.
6. Mandatory registration in the SAT Registry (including trusts)
The obligation to register in the SAT Registry of Vulnerable Activities was formalized, using RFC and a valid e.firma. The Regulations clarify that this includes trusts and other legal figures that perform vulnerable activities (Article 12 of the Regulations).
7. Other changes worth keeping on your radar
- 6-month accumulation: operations with the same client are added up by type of operation over a period of up to six months; the report is filed when the threshold is reached, without waiting for the period to end (Article 7 of the Regulations).
- Loans: a loan, financing, or credit is deemed to have been made when the funds are made available to the client, not when the contract is signed (Article 24 of the Regulations).
- Games and raffles: linked transactions totaling 325 UMA or more with the same person over a 24-hour period are treated as a vulnerable activity.
8. The good news: self-correction with benefits
Not all of it is more burden. The reform introduces a voluntary self-correction (regularización espontánea) mechanism: if you acknowledge and correct your failures with the SAT before an audit is initiated, the Ministry will reduce the corresponding fines by up to 50%; and it may even waive them entirely on a one-time basis if you disclose the full set of infractions (Article 55 of the Act). The formal procedure — filing a written statement before the SAT, specifying the failures, declaring under oath that they have been corrected, and attaching the supporting evidence — is set out in Article 55 Bis of the Regulations.
What to do: if you find that you have been out of compliance, taking the initiative is much better than waiting for the SAT to knock on the door.
In short: your to-do list
- Update client files to identify the ultimate beneficial owner from the 25% threshold.
- Incorporate the detection and follow-up of PEPs (both domestic and foreign).
- Define a protocol for the 24-hour report.
- Adjust your records to 10 years.
- Prepare your risk assessment, manual, training plan, monitoring, and audit.
- Confirm your registration in the SAT Registry.
It is a lot, and that is why many regulated parties are migrating from spreadsheets to a system that can sustain it. At SiennaDocs, we cover this new standard end to end: beneficial owner identification, KYC files, threshold and accumulation control, monitoring, and generation of reports — both monthly and 24-hour — with all the supporting documentation that the reform requires to be kept for 10 years. Book a demo and we will show you how to comply without friction.
Frequently asked questions
When did the changes take effect? The reform to the Act was published on July 16, 2025, and the reform to its Regulations on March 27, 2026 (the latter took effect the day after its publication).
Is the beneficial owner threshold now 25% or 50%? 25%. The reform lowered the threshold: it identifies anyone holding voting rights over more than 25% of the company's capital, or anyone who exercises control.
What is the 24-hour report? It is a report you must file within 24 hours of detecting an operation suspected of involving illicit proceeds, even if the operation was not completed.
How long do I have to keep my files now? 10 years, counted from the date the vulnerable activity was carried out (for operations from July 17, 2025 onward).
Do these obligations also apply to individuals and trusts? Yes. Any individual, legal entity, or legal figure (including trusts) that performs a vulnerable activity is a regulated party.
This content is informational and does not constitute legal advice. The reform is based on the LFPIORPI (DOF July 16, 2025) and the Decree amending its Regulations (DOF March 27, 2026); always verify the current text and the general rules, or consult a specialist.