Flash | Decree reforming and adding provisions to the LFPIORPI

In relation to the initiative presented in the Senate of the Mexican Congress to combat money laundering, on July 16, 2025 was published in the Official Gazette of the Federation (DOF, per its acronym in Spanish) a “Decree amending and adding various provisions of the Federal Law for the Prevention and Identification of Operations with Resources of Illegal Proceeds (LFPIORPI, per its acronym in Spanish) and amending Article 400 Bis of the Federal Criminal Code”. According to the transitional provisions, the decree came into effect on July 17, 2025, and the Ministry of Finance and Public Credit (SHCP, per its acronym in Spanish), with prior opinion from the Tax Administration Service (SAT, per its acronym in Spanish), will have up to 12 months to modify the general rules.

In this regard, the Senate, through the Joint Commissions of Justice and Legislative Studies, organized two open parliament sessions in January 2025 called: "Analysis and discussion of legislative reforms to combat money laundering and terrorist financing”, in which the corresponding proposals were discussed with the participation of members of civil society, academy, and the private sector.

As a result of these sessions, various modifications were made to the content of the reform project, including:

a) Clarification of the party responsible for compliance in the case of operations through trusts

b) Extension of the retention period for documentation related to vulnerable activities from five to ten years

c) Inclusion of flexibility mechanisms in the sanction regime

d)Distinction of obligations between individuals and legal entities regarding the identification of their controlling beneficiaries, allowing declarations of ignorance in certain cases

On the other hand, it is worth noting that during the approval process of the opinion in the Senate, a proposal to eliminate all references to the figure of “terrorist financing” was submitted and approved, considering that the purpose of the reform is to strengthen actions that mitigate operations with illicit resources focused on money laundering, and not the purpose of including the prevention of terrorist financing, consequently eliminating the proposed reform to Article 11 Bis of the Federal Penal Code.

In this sense, the reform decree updates provisions of the LFPIORPI to facilitate its implementation and compliance, through clarifications and additions in the definitions section, substitution of minimum wage references with units of measure and update (UMA, per its acronym in Spanish), the inclusion of the General Law of Credit Instruments and Operations as supplementary regulation, as well as the following relevant aspects:

I. Additions or modifications to the list of vulnerable activities

• The reception of resources intended for real estate developments is added as vulnerable activities, defined as such projects for the construction of buildings or subdivisions of lots intended for sale or rent. A notification threshold of 8,025 UMA per act or operation is established
• A threshold of 645 UMA per operation is included to identify those vulnerable activities that constitute monetary value storage instruments, whether by issuance, marketing, or crediting of resources
• Regarding the vulnerable activities of habitual and professional offering of virtual asset exchange by subjects other than financial entities, the obligation to submit a notice is added in case the operations result in charging consideration for the service provided, equal to or greater than 4 UMA
• Clarifications are made for vulnerable activities related to construction work, as well as the issuance or marketing of service, credit, or prepaid cards
• The assumptions and thresholds for the submission of notices regarding vulnerable activities related to the exchange of virtual assets by subjects other than financial entities are adjusted
• Finally, it is specified that those who act through trust or any other legal figure will be considered to perform vulnerable activities
  

II. New obligations

On the other hand, the reform decree includes the following requirements for obligated subjects:

• Regarding the obligation to identify and validate the existence of controlling beneficiaries resulting from carrying out operations with those who perform vulnerable activities, the approach is modified to distinguish between:

o  Clients or users, legal entities, trusts, or other legal figures, from whom documents, or other means of official recognition identification must be collected to identify their controlling beneficiaries, according to the general rules to be issued by the SHCP

o  Clients or users, individuals, from whom a declaration must be collected about whether they are aware of the existence of controlling beneficiaries or not

• Regarding the obligation of custody, safeguarding, and protection of documentation and information supporting vulnerable activities, the obligation to keep records of operations that allow individual reconstruction is added, in addition to the commercial correspondence that the parties involved may have shared to carry out the operation, among others
• The following obligations, previously provided in the LFPIORPI Regulation or general rules, are relocated in the LFPIORPI:

o  Registration and registration, as well as modification or deregistration in the register of people performing vulnerable activities

o  Preparation and observation of an Internal Policy Manual* containing the necessary criteria, measures, and procedures to comply with anti-money laundering obligations, including those that allow identifying and monitoring operations carried out with politically exposed persons, according to the general rules issued by the SHCP. In the case of people who are part of the same business group, the implementation of the Manual is required to be extended to all majority-owned branches and subsidiaries, including foreign ones

o  Submission of notice within 24 hours of becoming aware of the use of resources that may be intended for the commission of crimes with illicit resources, even if the act or operation did not take place

On the other hand, the following new obligations are incorporated for obligated subjects, including those who carry out vulnerable activities through trusts:

• The designation by legal entities and those acting through trusts or any other legal figure of the person responsible for compliance. In this regard, it is specified that when this person has not been designated in the case of trust, compliance with the obligations will correspond to the trustor or their representative or the person acting as administrator in any other legal figure
• Conducting a risk-based evaluation, according to the general rules issued by the SHCP, that allows identifying, analyzing, understanding, and mitigating risks, as well as those of client or user persons
• Developing personnel selection processes and adopting annual training programs* for members of the Administration team, executives, compliance representatives, and collaborators who have direct relationships with clients and users
• The implementation of automated mechanisms* that allow permanent monitoring of acts or operations to identify:

o  Operations that are not within the transactional profile of clients or user people according to the general rules issued by the SHCP

o  That must be accumulated in terms of the Law

o  Allow intensified monitoring of client or user persons considered as politically exposed or high-risk persons

• Conducting reviews by the internal audit area or an independent external auditor,* depending on the risk level of the person carrying out the vulnerable activities, to evaluate and issue an opinion in a calendar year on the effectiveness of compliance with the obligations and provisions of the LFPIORPI
  

*Through transitional provisions, it is specified that the new obligations provided in sections VII to XI of Article 18 of the Law will come into effect within the timeframes established for this purpose by the general rules.

III. Ultimate Beneficial Owner (UBO)

In terms of UBO, the decree contains modifications and new obligations, including a new chapter in the LFPIORPI, applicable generally to all commercial companies, regardless of whether they perform vulnerable activities or not, among which we can highlight the following:

1.  The concept of UBO is adjusted, including the percentage of effective control by ownership of rights that allow voting, decreasing from 50% to more than 25% of the share capital
2.  It is considered that the definition of UBO is equivalent to the final beneficiary and real owner
3.  The obligation for legal entities to attend to the competent authorities' request to determine who their UBO is and to keep supporting documentation is incorporated
4.  The obligation to register in the electronic system of the Ministry of Economy the necessary information to identify the legal entities UBO, according to certain guidelines to be issued by the SHCP, is added
5.  A new economic sanction is incorporated for those who fail to comply with the new obligations regarding UBO, ranging from 2,000 to 10,000 UMA
6.  Finally, the SCHP is empowered to promote among the authorities of the federal entities, through its competent administrative unit, that civil societies and associations also identify their respective UBO, according to the general rules issued by the SCHP

In this regard, we consider that these new obligations should be analyzed in detail once the general rules are published, taking into consideration the concept and information required in tax matters related to controlling beneficiaries.

IV. Politically exposed persons

The definition of politically exposed persons is included, as a natural person who performs or has performed public functions in national or foreign territory, as well as people related to them who meet conditions and characteristics established by the SCHP in the general rules.

On the other hand, it is established as the faculty of the SHCP to prepare and maintain an updated nominative list of public servant positions that will be considered politically exposed; while the Legislative and Judicial powers, as well as other government bodies, state public companies, and any other organization over which any of the powers and public bodies have control, will send the SHCP their specific list of politically exposed persons with identification data.

V. Authorities of the SHCP

The SHCP is empowered to interpret, in the administrative scope, the LFPIORPI, its regulation, and the general rules, as well as to coordinate its functions with those of the Ministry of Security and Citizen Protection and the National Guard, to fulfill the purposes of the LFPIORPI.

Additionally, Article 22 Bis is added to establish that the supervision, verification, and monitoring of compliance with the obligations applicable to those performing the vulnerable activities of Article 17 of the LFPIORPI will be carried out by the SHCP.

VI. Spontaneous Compliance

It is recognized that the SHCP will refrain from sanctioning the offender, on a single occasion, for the total number of infractions incurred, if they comply spontaneously, prior to the initiation of verification powers, and acknowledge the fault within the initial period of the sanctioning procedure.

VII. Restrictions on the use of cash and metals

Additionally, the Reform Decree includes the following additions related to restrictions on the use of cash and metals:

• It is added that the settlement of payment in cash will also be updated when it is made in "cash" through a Financial Entity
• The "Payment Consignment" is added, which is related to any of the acts or operations established for the restriction of the use of cash and metals, according to the thresholds set in each section
• Finally, it is added that SHCP, through the general rules, may determine when this prohibition applies to fungible goods

VIII. Crimes and penalties

In this regard, concerning the crimes regulated by the current law, the following criminal behaviors are added:

i.  Modifying or altering information, documentation, data, or images in responses to information requests made by the SHCP, and

ii.  Including in notices or responses to requests made by the SHCP, illegible information, documentation, data, or images that prevent effective knowledge of their content

On the other hand, considering recommendations made at the open parliament sessions, it is specified that the crimes provided for in LFPIORPI will admit culpable commission, which, when there is an overdue type error and this is spontaneously corrected before the authority becomes aware of the offense, will not be sanctioned.

Finally, the decree also modifies Article 400 Bis of the Federal Penal Code.

As always, the Tax and Legal staff of KPMG Mexico, through the Legal Services Practice, especially the Corporate Legal area, is at your disposal to work together with you to support you in analyzing the possible implications arising from the reform.