On August 7, 2026, the Ministry of Finance and Public Credit published the reform to the General Rules of the Federal Law for the Prevention and Identification of Operations with Resources of Illicit Proceeds (LFPIORPI, per its acronym in Spanish, or Anti-Money Laundering Law).
These modifications derive from the reform of the LFPIORPI of July 2025, and its Regulations in March 2026, seeking to strengthen a risk-based approach, the identification of the controlling beneficiary, the use of technological tools, as well as the professionalization, training and internal control of the obligated subjects.
Among the main modifications that are established, the following stand out:
Risk-based approach
The obligation to have a documented risk assessment methodology that is applied prior to the offer of new products or services, as well as the attention of new clients or users, and that considers, at least, the following, is incorporated:
- Analysis of clients, products, services, shipping or distribution channels, geographical areas and types of operations.
- The factors set forth in the National Risk Assessment issued by the Financial Intelligence Unit (UIF, per its acronym in Spanish).
- Update of the methodology, at least, every 12 months or when new risks are identified.
- Be incorporated into the Internal Policies Manual.
Classification of the degree of risk of the person Client or User
The obligation to classify clients or users (individuals and legal entities) by degree of risk (low, medium-high) is established, being able to establish the intermediate degrees of risk that the obligated subjects consider relevant. Likewise, the due diligence (KYC) measures applied to such clients or users must be proportionate to the risk and must include:
- Documented transactional profile.
- Enhanced measures for high-risk clients.
- Monitoring and updating the transactional profile at a minimum periodicity according to the client’s profile and risk level.
Controlling Beneficiary
- As in the Anti-Money Laundering Law, the definition of controlling beneficiary is specified and expanded.
- The obligation to establish measures, criteria and procedures within its Internal Policies Manual to identify, verify and document the controlling beneficiary of clients or users who are legal entities, trusts and other legal entities is established and reinforced.
- The obligation to collect information from shareholders, partners, settlors, trustees, administrative bodies and economic dependents is established, when applicable.
- Identification must be ensured even when the client is acting on behalf of or on behalf of third parties.
- The exceptions in which this identification will not apply are established.
Implementation of automated mechanisms
It defines what shall be understood under this concept, establishing the obligation for the obligated subjects to have such automated mechanisms for:
- Integrate and update identification files.
- Monitor operations and transactional profile.
- Accumulate amounts to identify thresholds and notices.
- Generate and manage internal alerts.
- Classifies clients and operational risks.
- Monitor the use of cash and precious metals.
Internal Policy Manual
Similar to what was observed in the amendment to the Anti-Money Laundering Law, the new rules add the following requirements:
- Risk assessment methodology and client’s classification.
- Procedures of:
o Identification and knowledge of the clients.
o Identification of the controlling beneficiary.
o Analysis and escalation of unusual, concerning and relevant internal operations.
o Auditing, independent review and archiving of evidence.
o Training programs.
o Confidentiality mechanisms, safeguarding of information and access control.
Annual Compliance Audit
The obligation to carry out an annual audit (internal or external, depending on the profile and level of risk of the obligated subject) is established, which includes:
- Review of the degree of regulatory compliance.
- Identification of gaps and issuance of corrective actions and recommendations.
- For high-risk profiles, or by choice, the independent external auditor shall have, among other requirements, the following:
o degree and professional license in Law, Accounting, Finance, Business Administration, Information Technology, or related fields,
o at least 3 years of experience in anti-money laundering,
o current certification of the UIF, at the time of preparing and signing the compliance opinion.
The first period subject to audit under this new framework shall be from January 1 to December 31, 2028.
Other relevant aspects
- Mandatory to have an annual training program for all personnel involved in carrying out Vulnerable Activities. Documentary evidence of said training program must be kept, and those who provide the training must prove at least 5 years of experience in the field.
- Minimum guidelines are established for the selection and evaluation of personnel who participate in part of the Vulnerable Activities process.
- Reinforcement of deadlines and requirements for notices for unusual, internal operations of concern or relevance, and 24-hour notices.
- The registration and registration of those who act through trusts or other legal figures is regulated.
- The definition of Politically Exposed Persons and assimilated is incorporated.
- The date of the act or operation that must be considered for the presentation of the Notices of each of the Vulnerable Activities is specified.
- Some clarifications are introduced with respect to the vulnerable activity consisting of the habitual and professional offer of exchange of virtual assets, including the requirements regarding the traceability of operations.
Timelines for implementation
- Entry into force of the general rules: November 30, 2026.
- Internal Policies Manual and Risk Methodology: March 1, 2027.
- Automated mechanisms: no later than June 1, 2027.
- Training and selection of personnel
o Rules applicable to new hires: March 1, 2027.
o First annual training period: January 1 to December 31, 2027.
- Annual audit: first period from January 1 to December 31, 2028.
- Notices with new formats: six months after the entry into force of the resolution modifying the official formats.
As always, KPMG Mexico's Tax and Legal professionals, through KPMG Law Mexico, especially the Corporate Legal area, are in the best position to work together with you to support in the analysis of the potential implications that would arise from the amendments to these general rules.
