Generated
2236 chars
Mexico's Finance Ministry Amends Anti-Money Laundering Rules to Strengthen Risk-Based Compliance Framework
On August 7, 2026, Mexico's Ministry of Finance and Public Credit (Secretaría de Hacienda y Crédito Público) published Agreement 115/2026 in the Official Journal of the Federation, substantially reforming the general rules under the Federal Law for the Prevention and Identification of Operations with Illicit Proceeds (Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita).
The amendment introduces a comprehensive risk-based approach to anti-money laundering compliance. Key changes include: establishment of a National Risk Assessment framework to guide vulnerable activity operators; implementation of mandatory risk classification systems for clients and customers across low, medium, and high-risk categories; enhanced due diligence requirements for politically exposed persons; and new provisions addressing virtual asset service providers, including custody, intermediation, and facilitation services.
The reform expands the definition of vulnerable activities to explicitly include virtual asset providers and introduces new chapters addressing risk-based methodologies, client risk classification, customer knowledge procedures, politically exposed persons lists, and beneficial ownership identification. Operators must now develop internal policy manuals incorporating risk assessment methodologies, implement automated monitoring systems, and conduct annual audits evaluating compliance effectiveness. The rules establish specific requirements for training programs, personnel selection procedures, and internal controls. Notification procedures transition to electronic means through an official internet portal, with three-business-day receipt periods and specific protocols for document access.
The amendment becomes effective November 30, 2026, with phased implementation timelines. Operators must establish risk-based evaluations by March 1, 2027; implement internal policy manuals incorporating new methodologies by the same date; deploy automated mechanisms by June 1, 2027; and complete first-year audits by December 31, 2028. Virtual asset providers already registered must update and deliver required information within six months of the agreement's effective date.
Published
6834 chars · nid 94487
Mexico's Finance Ministry Amends Anti-Money Laundering Rules
On August 7, 2026, the Ministry of Finance and Public Credit published Agreement 115/2026 in the Official Gazette of the Federation, comprehensively amending the General Rules referred to in the Federal Law for the Prevention and Identification of Operations with Resources of Illicit Origin , originally published on August 23, 2013 and previously amended on July 24, 2014 and November 30, 2020.
Key provisions include:
Extension of scope to virtual asset service providers: The framework is extended to apply to virtual asset service providers in addition to financial institutions, other BCB-authorised entities, and payment institutions. Virtual asset service providers in the process of adapting under applicable regulations are expressly included. New provisions address notice obligations for virtual asset operations, including custody and storage, facilitation and intermediation, and the information required on originators, recipients, and beneficial owners for each transaction.
Risk-based approach: A new Chapter II Quarter requires entities carrying out vulnerable activities to design and implement a risk assessment methodology covering their acts or operations, clients or users, transactions, and distribution channels. The methodology must identify risk elements and indicators, apply a consistent measurement method, and incorporate mitigating factors. It must be updated at least every twelve months, whenever new risks are detected, or when the National Risk Assessment issued by the Financial Intelligence Unit (UIF) is updated. Results and documentation must be retained for at least ten years.
Client and user risk classification: A new Chapter III Bis requires entities to maintain a risk assessment model classifying clients and users into at minimum three risk levels: low, medium, and high. Risk levels must be reviewed at least every six months, with higher frequency for higher risk clients. Classification criteria must consider inherent characteristics such as client background, nationality, and source of income, as well as transactional characteristics including volume, frequency, and origin and destination of funds.
Client knowledge obligations: A new Chapter III Ter requires entities to develop and observe a client knowledge policy including procedures for tracking and monitoring transactions, establishing and maintaining transactional profiles for each client, detecting deviations from those profiles, and determining when risk level reclassification is appropriate. An alert system must be implemented to detect changes in client transactional behaviour. High-risk clients are subject to enhanced due diligence including questionnaires on the origin and destination of funds, and senior management approval is required before conducting operations with clients who are both politically exposed persons and high risk.
Politically exposed persons: A new Chapter III Quarter defines politically exposed persons to include current and former holders of public functions in Mexico or abroad, their spouses, concubines, and relatives up to the second degree by blood or affinity, and associated legal entities. National politically exposed persons retain that status for one year following departure from their position. Entities must consult the UIF's PEP Consultation 2.0 application using their advanced electronic signature to verify politically exposed person status.
Beneficial ownership identification: A new Chapter III establishes a priority order for identifying beneficial owners of legal entity clients, beginning with individuals holding 25% or more of share capital, followed by those exercising effective control by other means, and finally the highest-ranking administrative official. For trust clients, the beneficial owner is any natural person exercising effective control over the trust's assets, administration, or dissolution. Identification must be completed prior to or at the time of establishing the business relationship and kept updated throughout its duration.
Notices and reports: New provisions clarify the dates from which notice deadlines run for each category of vulnerable activity, including specific rules for virtual asset operations. Suspicion notices and notices based on facts or indications must be submitted within 24 hours of the triggering event. Entities must submit a nil report for any month in which no notifiable acts or operations are carried out.
Internal policies manual: Entities must have an internal policies manual within 90 calendar days of registration covering at minimum client identification and knowledge policies, risk classification mechanisms, due diligence measures, politically exposed person procedures, transactional profile monitoring, notice and report submission procedures, information preservation mechanisms, personnel training programmes, and internal audit mechanisms. Entities forming part of a business group must implement centralised compliance policies applicable to all majority-owned branches and subsidiaries.
Audit requirements: A new Chapter XIV requires entities to undergo annual audit review from January 1 to December 31 each year, conducted by internal audit for low and medium risk entities and by an independent external auditor for high risk entities or by election. The audit must evaluate the effectiveness of compliance with all obligations under the law and its regulations, producing a structured opinion with findings categorised across five levels from full compliance to non-compliance. The first audit period begins January 1, 2028.
Automated mechanisms: Entities must implement automated mechanisms to preserve and update client identification files, consolidate transaction records for monitoring purposes, execute the risk assessment model and alert system, and monitor cash and precious metals transactions. These mechanisms must be operational by June 1, 2027.
Electronic notifications: The UIF and Tax Administration Service (SAT) will carry out notifications electronically through the internet portal. Entities must consult the portal at least once per business day and have three business days to open pending notifications. The Ministry must implement the necessary technological mechanisms for the electronic notification system within eight months of the Agreement entering into force.
The amendment becomes effective November 30, 2026, with phased implementation timelines. Operators must establish risk-based evaluations by March 1, 2027; implement internal policy manuals incorporating new methodologies by the same date; deploy automated mechanisms by June 1, 2027; and complete first-year audits by December 31, 2028. Virtual asset providers already registered must update and deliver required information within six months of the agreement's effective date.