Mexico Amends its Anti-Money Laundering Law and Federal Criminal Code to Strengthen the Prevention of Money Laundering and Financing Criminal Organizations

The amended Federal Law for the Prevention and Identification of Transactions Involving Illicit Proceeds (commonly referred to as the AML Law) was published in the Official Federal Gazette on July 16, 2025, alongside corresponding amendments to the Federal Criminal Code. This marks a turning point for all obligated parties and actors within the national economic system.

Key Legal Amendments

The reform redefines several core concepts and introduces new regulatory elements, including:

• Mandatory registration of beneficial owners with the Ministry of Economy.
• Amendment to the definition of "beneficial owner" (lowering the control threshold from 50% to 25%).
• Introduction of a risk-based approach (RBA) for all Vulnerable Activities (VAs).
• Mandatory identification and monitoring of Politically Exposed Persons (PEPs).
• Introduction of a 24-hour reporting obligation, even for incomplete or unexecuted transactions.
• Requirement to implement automated systems for transactional monitoring.
• Imposition of annual internal or external audits based on risk level.
• Mandatory annual training on the AML Law.
• Replacement of thresholds expressed in minimum wages with Units of Measure and Update (UMAs).
• New obligations for real estate developers and virtual asset service providers (VASPs).
• Strengthening of supervisory powers of the Financial Intelligence Unit (UIF) and other authorities.
• Extension of the retention period for supporting information and documentation, which increases from five to ten years.

Criminal Law Reform: Expansion of Article 400 Bis of the Federal Criminal Code

The amendment to Article 400 Bis facilitates prosecutorial efforts by the Public Prosecutor, as they may investigate conduct involving the use of the financial system. However, to initiate criminal proceedings, a complaint from the Ministry of Finance is required, as it is considered the affected party.

What Does This Mean for Entities Engaged in Vulnerable Activities?

Entities subject to the VA regime must overhaul their compliance systems, formally train their personnel, and adopt technological tools—even basic ones—to meet the new legal requirements.

In particular, obligated parties must:

• Accurately and continuously register their ultimate beneficial owners.
• Implement automated systems for detecting unusual transactions.
• Undergo specialized audits where required by risk level.
• Document and retain evidence of compliance to respond to potential supervisory inquiries.
• Update their internal policies and manuals in accordance with the new legal framework.

What’s Next?

The reform enters into force on the day following its publication in the Official Gazette of the Federation, except for certain aspects that will be implemented pursuant to the provisions set forth below.

The Ministry of Finance and Public Credit (Secretaría de Hacienda y Crédito Público), following prior consultation with the Tax Administration Service (SAT), must amend the applicable General Rules within twelve months from the effective date of the Decree. Consequently, the new obligations established under Sections VII to XI of Article 18 (risk assessment, internal policies manual, personnel screening, automated systems, and audits) shall become effective according to the timelines to be defined in the forthcoming General Rules issued by the competent authority.

With respect to the obligations concerning:

• Annual training (Section IX of Article 18)
• Internal or external audits (Section XI of the same Article)

These shall be fulfilled on a calendar-year basis, with the first applicable period beginning on January 1 of the year following the publication of the Decree and ending on December 31 of that same year. For entities beginning to carry out Vulnerable Activities for the first time, the applicable period shall commence on the date such activities begin and conclude on December 31 of the following year.

Furthermore, the new obligations established under Sections VII to XI of Article 18 (risk assessment, internal policies manual, personnel screening, automated systems, and audits) shall become effective in accordance with the deadlines set forth in the future General Rules issued by the competent authority.

It is worth noting that, although the explanatory memorandum of this reform acknowledged the need to include the collection of information to investigate and prosecute the financing of terrorism as an objective of the law, aligned with the recommendations of the Financial Action Task Force (FATF), this objective was not expressly incorporated into the final text of the reform.

This reform requires immediate action from regulated entities. Its implementation is not optional: it represents a profound overhaul of compliance in the areas of anti-money laundering and the financing of criminal organizations, with a more technical approach, increased oversight, and exposure to legal consequences, such as imprisonment and fines.

Compliance will require investment, technology, and specialized legal and technical guidance.