Overview
- The Secretaría de Hacienda y Crédito Público published the secondary Reglas de Carácter General on Monday, closing a regulatory gap from the LFPIORPI reform and formally shifting Mexico to a risk-based AML/CFT regime.
- The rules take effect on November 30, 2026, with main obligations beginning March 1, 2027, automated monitoring required by June 1, 2027, and the first mandatory audits covering calendar year 2028.
- About 120,000 entities on the activities-vulnerable registry will face new duties that include formal risk assessments, customer files, identification of beneficial owners, special checks for politically exposed persons, annual training and certified compliance officers.
- SHCP published the rules three weeks after a congressional deadline and did not submit the draft to the Comisión Nacional de Mejora Regulatoria for public consultation, a process gap that raises transparency and cost concerns for regulated firms.
- The timing follows a year of UIF strengthening under Omar Reyes Colmenares, a period that saw large increases in account and person blockings, expanded staff and deeper coordination with foreign agencies such as OFAC and FinCEN to support designations and asset freezes.