Acuerdo 115/2026: Mexico AML General Rules reform guide

Guide to Mexico's AML General Rules reform (Acuerdo 115/2026): 25% beneficial owner, risk assessment, annual audit and the full compliance timeline.

Pablo Rodríguez · August 10, 2026

Mexico's 2026 AML General Rules reform: the complete guide

On August 7, 2026, Mexico's Official Gazette published Acuerdo 115/2026, which amends the General Rules (Reglas de Carácter General) of the Anti-Money Laundering Act. It takes effect on November 30, 2026, with obligations phased in through 2029.

It adds eleven chapters, sixty-six articles and three new annexes. This is the broadest change to Mexico's Vulnerable Activities regime since 2013.

If you already read our piece on the reform to the Act and its Regulations, this is the missing piece. And it is the most important one, for a reason almost nobody is explaining.

First, what nobody is telling you

The July 16, 2025 reform to the Act created five new obligations in Article 18: risk assessment, internal policies manual, training and personnel screening, automated mechanisms, and audit.

But the third transitory article of that Decree stated, literally, that the obligations in Article 18, sections VII through XI "shall take effect within the timeframes established by the general rules".

In plain terms: those five obligations were never enforceable. They sat frozen for thirteen months waiting for this Acuerdo. And this Acuerdo is what finally puts dates on them.

That is why it matters. This is not one more reform: it is the start button for everything announced in 2025.

1. Beneficial owner: from a data point to a procedure

The threshold had already dropped to 25% with the reform to the Act. What these rules add is how you must search for the beneficial owner, and that is the substantive change.

Article 23 Quinquies sets a mandatory order of identification that only lets you move down a step when the previous one yields no result:

1. Whoever holds more than 25% of the capital, directly or indirectly.
2. If no one reaches it, whoever exercises control by other means: strategy, decision-making and main policies.
3. If still no one, the highest-ranking administrative officer.

The practical consequence is that the field can never be left empty. A company with five partners holding 20% each and no identifiable control has, by definition, a beneficial owner: its general manager. And you must document the procedure you followed to get there, not just the outcome.

For trusts the universe widens: beyond the trustee, settlors and beneficiaries, the protector and the members of the technical committee now count. And if any of them is a legal entity, you must climb the ownership chain until you reach the ultimate individual.

What about the files you already have? This deserves precision. The fourth transitory article ties this chapter to acts or transactions carried out from March 1, 2027, so it does not order a retroactive review of your entire archive.

But there is a distinction that does matter. When there is an ongoing business relationship — a lease, a loan — the rule requires beneficial owner information to be kept current for the entire duration of that relationship, and Article 21 requires verifying at least once a year that those files are complete and up to date. In those cases you will have to revisit them.

By contrast, for occasional transactions that have already ended — a sale closed in 2024, for example — there is no obligation to reopen the file.

What to do: split your portfolio between ongoing business relationships and closed transactions. For the former, revisit ownership under the new criterion before your next annual verification. It is the most time-consuming work in the reform and it is worth not leaving to 2027.

2. Your company now has to assess itself

Until now you classified your clients. Chapter II Quáter adds something different: assessing the risk of your own business.

It is a proprietary, documented and measurable methodology that combines four mandatory elements: the acts or transactions you carry out, the type of clients you serve, the countries and geographic areas where you operate, and the transactions and channels you use. Each element with its indicators and weighting.

On top of that sits the effect of your mitigants, meaning everything you already have in place to reduce that exposure. And the rule is explicit that their existence is not enough: you must consider their effective application. A manual nobody reads mitigates nothing.

Concrete requirements: at least twelve months of real data (number of clients, number of transactions and amount transacted), specific money laundering and terrorist financing indicators for each of the four elements, review at least annually, and retention for ten years.

What makes this assessment different from everything else is its consequence: the result determines whether your annual audit can be internal or must be external. More on that below.

If you do not yet have twelve months of operation, the rule allows you to run the initial assessment with projected data and update it at the one-year mark.

3. The client file now depends on the risk grade

Chapter III Bis requires classifying every client into at least three grades: low, medium and high, with reassessment at least every six months and greater frequency at higher risk.

And here is the change that will most affect daily operations: the file you must build depends on the grade. Only low risk allows a simplified regime. Medium and high risk require a complete file.

There are also two cases where high risk is mandatory, overriding any weighting you have defined:

• Non-resident clients linked to jurisdictions applying preferential tax regimes or with deficient anti-money laundering measures.
• Foreign politically exposed persons.

The Financial Intelligence Unit will publish the list of jurisdictions on its portal.

4. Transaction profile: what the client says they will do

This concept did not exist and is among the most demanding. Every client must declare the maximum monthly amounts they expect to transact, and that initial profile governs for at least the first six months.

The rule is explicit that this profile must be loaded into your alert system, in order to detect inconsistencies between what the client declared and what they actually transact. It is not a filing data point: it is an operating parameter.

The profile is reassessed every six months. For clients with a single transaction that ends the relationship, the profile is built from that one transaction.

What to do: add expected amount and frequency to your client onboarding, and define in writing what deviation triggers an alert. That threshold must be in your manual.

5. Enhanced due diligence for high risk

When a client falls into the high grade, additional obligations kick in:

• A questionnaire on the source and destination of funds, which may be applied remotely with an electronic signature.
• For individuals: data on the spouse and economic dependents, and on companies with which they hold financial ties.
• For legal entities: consulting the Ministry of Economy's electronic registries to verify the shareholder information the client provided.
• If the client is also a politically exposed person: approval by a senior officer before carrying out the transaction.

6. Politically exposed persons: at last, the procedure

It is worth being precise about what is new. The reformed Regulations had already created, since March 2026, the List of Politically Exposed Persons maintained by the Financial Intelligence Unit and the ability of regulated parties to consult it. What was missing was the procedure, and that is what Chapter III Quáter adds, alongside the precision of who counts as a close associate.

The Act defined politically exposed persons as including "persons related to them who meet the conditions and characteristics that the Ministry establishes in rules," without specifying which. Now they are set out: spouse, domestic partner, relatives by blood or marriage up to the second degree, and partners in companies with which they hold financial ties. One public official easily brings fifteen or twenty people with them.

The status lasts one year after leaving office, with an anti-avoidance rule: if they left office within the year prior to the transaction, they must be classified as such during the year following the one in which they transacted with you.

Most usefully, the process for consulting is defined. Consultation will take place through an official Financial Intelligence Unit application, using the regulated party's advanced electronic signature (e.firma), and authorities will be required to populate it with data on their officials and their economic dependents. It becomes available in August 2027.

7. The manual stops being a generic document

Simply "having a manual" is no longer enough. Article 37 Bis sets fourteen mandatory sections: client identification and knowledge, risk classification, due diligence by grade, monitoring of politically exposed persons, detection of profile deviations, reports, retention, aggregation, watchlists, compliance officer duties, training, internal control and audit, confidentiality, and updating the manual itself.

It must be ready within ninety calendar days of registration, include the design of the risk methodology and the procedure for opening, limiting or terminating commercial relationships. And the tax authority can order you to amend it.

A little-known relief: if you decide not to carry out certain acts or transactions, you are exempt from establishing policies for them, provided you record that decision in the manual.

8. Training and personnel screening

The program is annual and covers the board or sole administrator, senior officers, the compliance officer, and employees who deal with clients, take part in identification, file reports or perform audit work.

The requirements are specific: mandatory assessments to issue certificates, instructors who can evidence five years of experience in the field, training before or upon new staff joining, and documentary evidence retained for ten years.

Personnel screening is added: a signed declaration from each employee about regulated sectors where they previously worked and confirming they have not been sentenced for property crimes or barred from office.

Watch the calendar: the first annual period runs from January 1 to December 31, 2027. It starts before the bulk of the other obligations, and without documented records it does not count.

9. Automated mechanisms: six minimum functions

Article 41 stops speaking in the abstract. Your systems must:

1. Retain, update and allow consultation of each client's single identification file.
2. Group each client's transactions into a consolidated base, to monitor them, detect those departing from the transaction profile, and perform aggregation.
3. Provide the information that feeds the risk methodology.
4. Run the risk grade model and retain the history of grade and profile changes for at least ten years.
5. Run an alert system for high risk, politically exposed persons, listed persons and high-risk jurisdictions.
6. Monitor the use of cash and precious metals.

The rule expressly allows anything from specialized software to processes built on spreadsheets, provided they perform these six functions and are verifiable by the authority. In practice, the ten-year per-client history requirement is what makes spreadsheets unworkable.

10. Annual audit: an opinion that grades obligation by obligation

This is the largest change in financial exposure.

If your company is assessed as low or medium risk, your own internal area can audit it, using staff independent from the compliance officer. If it is assessed as high risk, it must be signed by an independent external auditor meeting, among other requirements: a university degree and professional license, three years of experience in the field, a current certification from the Financial Intelligence Unit, and not having served as your compliance officer during the audited period or the two following years.

The opinion is divided into seven sections and grades each obligation separately across five levels: complies, largely complies, partially complies, does not comply, and not applicable. It must include findings with corrective actions, deadlines, owners and a financial projection of the fines if they go unaddressed, plus follow-up on the prior year's opinion.

The first review period runs from January to December 2028, and the opinion is delivered no later than the last business day of March 2029.

What to do: estimate now whether you will land in high risk. It is the difference between auditing in-house and hiring a certified external auditor every year, and it is worth knowing before you budget for 2027.

11. Reports: four concrete changes

The transaction date is now defined by activity. Article 24 Bis sets the date that starts the filing deadline: real estate and vehicles at settlement, real estate development at the last contribution of the calendar month, donations upon receipt. Worth knowing that leasing and lending do not appear on that list, so for those two the general rules of the Regulations still apply.

Co-owners in leasing. When several co-owners lease a property, the threshold is measured against the total monthly rent agreed, but each one reports their individual payment. It is counterintuitive: three siblings leasing at ninety thousand pesos each measure against ninety thousand, not thirty thousand.

The nil report splits in two. Previously a single article covered two situations. Now there is one report for when there were no reportable transactions, and a new one for when there were only transactions exempted under Article 27 Bis. In addition, the report can no longer be amended or deleted once filed.

Two twenty-four-hour reports, not one. It is worth being precise about what is new here too. That the report is filed even if the transaction was not completed was already set by Article 7 Bis of the Regulations since March 2026. What these rules add is the separation into two scenarios with their own rules: the report based on suspicion, which arises from what you observe in the transaction, and the report based on facts or indications, which arises from public or private information outside the client. And it is clarified that both apply even if the threshold is not met. They become enforceable six months after the Financial Intelligence Unit publishes the new formats, still pending as of today.

12. Virtual assets: the most detailed regime yet

Virtual assets have been a vulnerable activity since 2018, but the 2025 reform to the Act broadened it and these rules develop it in a level of detail it never had.

There are two reporting thresholds and they work independently: when the client's transaction reaches or exceeds 210 times the UMA, and when the fee charged for the service reaches or exceeds 4 times the UMA. Article 24 Bis 5 clarifies how they combine: if only one is met, the report is filed under that subsection; if both are met in the same transaction, a single report is filed. And importantly, fees are determined per individual transaction and are not aggregated.

Two concepts that were previously undefined now have definitions. There is custody or storage when you provide platforms that let you maintain control, safekeeping or administration of the assets on the client's behalf; in that case the report must include the custody start date, the wallet address and the value in local currency. And there is facilitation or intermediation when you provide infrastructure or interfaces that connect or match transactions, even when you do not hold control of the assets.

On traceability, you must obtain and retain for ten years precise information on the originator, the recipient and, where applicable, the beneficial owner: name, country of residence, account or wallet identifier, and for each transaction the date and time, asset type, amount in virtual assets and its equivalent in local currency, transaction type and fee charged.

Registration is also tightened: you must submit the list of shareholders with amounts and their beneficial owner, the trade name, the sites and applications through which you operate, and complete details of the legal representative. Those already registered have six months from the effective date to update that information.

13. Other changes worth tracking

• Tax authority notifications. The portal must be checked every business day, not on the 15th and last day of the month as before. You have three business days to open a document and the notification is deemed served on the fourth business day, whether you opened it or not. The email alert is eliminated.
• Information requests. When the tax authority asks for information to verify your registration, you have ten business days, extendable by five upon request.
• Trusts and joint ventures. Those operating through these structures register as such and must use the advanced electronic signature tied to their own tax ID, not that of the representative or the trustee. In a joint venture the managing partner handles the filing.
• Broader confidentiality. It now covers beneficial owner documentation and employees regardless of their contracting arrangement. Alerting the client about information requests and about asset freezing orders before they are executed is prohibited.
• Corporate groups. Obligation to maintain centralized compliance policies applicable to all majority-owned branches and subsidiaries, including foreign ones.
• Non-profit organizations. The Financial Intelligence Unit will issue terrorist financing risk measures, including monitoring of donors and high-risk countries, and they apply even if the organization is not a Vulnerable Activity.
• UIF certification. Valid for five years. Optional for the compliance officer, but mandatory for the external auditor.
• Identification documents. The professional license is no longer valid identification. As a simplification, the population registry certificate is no longer required when the number already appears on another official document.
• Beneficial owner declaration. Individual clients must sign a declaration stating whether they are aware of the existence of a beneficial owner.
• Business days. The calendar of non-business days is now closed and includes the tax authority's holiday period. Deadlines do not run during those days.

Timeline: when each obligation applies

The Financial Intelligence Unit has yet to publish the resolution with the new reporting formats. The two twenty-four-hour reports become enforceable six months after that publication.

In short: your to-do list

1. Review corporate client files. With the threshold at 25% and the three-step cascade, beneficial owners you have not identified will surface. This is the most time-consuming work and the clock is already running.
2. Estimate whether your company will land in high risk. It determines whether you audit in-house or hire a certified external auditor every year.
3. Prepare training from January 2027. Without documented records, it does not count.
4. Verify your systems retain history. Ten years of risk grade and transaction profile changes per client are required.
5. Rewrite the manual with the fourteen sections and the risk methodology built in.
6. Add the transaction profile declaration to client onboarding and define deviation thresholds.

It is a lot, and much of it rests on being able to evidence what you did and when. At SiennaDocs we are already adapting the platform across everything that is resolved inside the system: the beneficial owner threshold and its order of identification, the obliged entity's risk assessment, client classification and reassessment, the transaction profile with its alert system, the file according to risk grade, the treatment of politically exposed persons, the internal policies manual, and the changes to reports, aggregation and filings, along with the record retention the reform requires. Book a demo and we will review together what applies to your company and in what order.

Frequently asked questions

When does the General Rules reform take effect? On November 30, 2026, except for the transitory provisions, which phase obligations in through 2029.

Does every company have to hire an external auditor? No. Only if its institutional risk assessment results in high risk. With low or medium risk an internal audit suffices, provided it is performed by staff independent from the compliance officer. Anyone may opt for an external audit voluntarily.

What is the transaction profile? It is the client's expected behavior. Each client declares the maximum monthly amounts they expect to transact, that profile governs for at least six months, and it must be loaded into the alert system to detect deviations.

Can I keep using spreadsheets? The rule expressly allows it, provided they perform the six minimum functions of Article 41 and are verifiable by the authority. In practice, retaining ten years of risk grade and profile history per client is hard to sustain that way.

When will the twenty-four-hour suspicion and indication reports become enforceable? Six months after the resolution amending the official reporting formats takes effect, which has not been published as of today.

This content is informational and does not constitute legal advice. It is based on Acuerdo 115/2026 published in Mexico's Official Gazette on August 7, 2026, on the LFPIORPI (Official Gazette 07-16-2025) and on the Decree amending its Regulations (Official Gazette 03-27-2026); always verify the current text or consult a specialist.