Impact note

Anti-money laundering: the 2025 amendment and the rules taking effect on November 30, 2026

Suspicious activity reports within 24 hours, risk assessment, manual, automated monitoring and annual audit. The schedule is set and begins in weeks.

LEXURE Regulatory Compliance Practice Team 6 min read Regulatory status verified in 2026

The amend­ment to the anti-money laun­der­ing law pub­lished on July 16, 2025 turned a report­ing regime into a risk man­age­ment regime. The oper­a­tional detail arrived on August 7, 2026 with the agree­ment amend­ing the gen­eral rules, which takes effect on Novem­ber 30, 2026 and whose sched­ule runs through 2027.

What changes for your company

Who is cov­ered. The Fed­eral Law for the Pre­ven­tion and Iden­ti­fi­ca­tion of Trans­ac­tions with Illicit Pro­ceeds (Ley Fed­eral para la Pre­ven­ción e Iden­ti­fi­cación de Opera­ciones con Recur­sos de Proce­den­cia Ilícita) imposes obli­ga­tions on those who carry out vul­ner­a­ble activ­i­ties. In tech­nol­ogy and unreg­u­lated finan­cial ser­vices, the most common ones are in Arti­cle 17, sec­tions II, IV and XVI. Grant­ing loans or credit by per­sons other than finan­cial insti­tu­tions requires a report start­ing at 1,605 Units of Mea­sure­ment and Update, or UMA (MXN 188,282.55). Issu­ing pre­paid cards and stored value instru­ments is also a vul­ner­a­ble activ­ity. For the exchange of vir­tual assets by par­ties other than finan­cial insti­tu­tions, includ­ing trans­ac­tions with Mex­i­cans car­ried out from another juris­dic­tion, a report is required when a client’s trans­ac­tion reaches 210 UMA (MXN 24,635.10) or when the fee charged reaches 4 UMA (MXN 469.24).

The 24-hour sus­pi­cious activ­ity report. When there is sus­pi­cion, or infor­ma­tion based on facts or indi­ca­tions, that the funds may come from or be intended for trans­ac­tions with illicit pro­ceeds, the report must be filed within the fol­low­ing 24 hours, even if the act or trans­ac­tion was not car­ried out (Arti­cle 18, sec­tion VI).

Risk man­age­ment obli­ga­tions. The amend­ment added five new obli­ga­tions to Arti­cle 18:

  1. Risk-based assess­ment (sec­tion VII).
  2. Inter­nal policy manual, includ­ing mon­i­tor­ing of polit­i­cally exposed per­sons (sec­tion VIII).
  3. Per­son­nel selec­tion pro­cesses and annual train­ing (sec­tion IX).
  4. Auto­mated mon­i­tor­ing mech­a­nisms (sec­tion X).
  5. Annual review by an inde­pen­dent inter­nal or exter­nal audit; an exter­nal audit is manda­tory if the risk is high (sec­tion XI).

The rules sched­ule. The agree­ment pub­lished on August 7, 2026 takes effect on Novem­ber 30, 2026 (first tran­si­tional arti­cle) and phases in its obli­ga­tions as fol­lows:

  1. March 1, 2027: the risk assess­ment and the manual with its method­ol­ogy must be avail­able upon request by the author­ity, and the selec­tion pro­ce­dures for new hires apply (second, third and sixth tran­si­tional arti­cles).
  2. Jan­u­ary 1 to Decem­ber 31, 2027: first annual train­ing period (sev­enth tran­si­tional arti­cle).
  3. June 1, 2027: auto­mated mon­i­tor­ing mech­a­nisms must be in oper­a­tion (ninth tran­si­tional arti­cle).
  4. Year 2028: first audit review period (eighth tran­si­tional arti­cle).

What to do and by when

  1. Before Novem­ber 30, 2026, con­firm whether any of your busi­ness lines is a vul­ner­a­ble activ­ity and whether it is reg­is­tered in the cor­re­spond­ing reg­istry.
  2. Define today the pro­ce­dure for filing sus­pi­cious activ­ity reports within 24 hours, with a des­ig­nated owner and an alter­nate.
  3. Between Decem­ber 2026 and Feb­ru­ary 2027, pre­pare the risk assess­ment using infor­ma­tion from the imme­di­ately pre­ced­ing year, and the manual with its method­ol­ogy.
  4. Sched­ule the 2027 annual train­ing and doc­u­ment atten­dance and con­tent.
  5. Con­tract or develop auto­mated mon­i­tor­ing early enough for it to be oper­at­ing on June 1, 2027.
  6. Decide whether your audit will be inter­nal or exter­nal based on the risk your assess­ment shows.

Recommendations to mitigate risk

Fail­ing to comply with the obli­ga­tions in Arti­cle 18 or to respond to requests from the author­ity is pun­ish­able by a fine of 200 to 2,000 UMA (MXN 23,462 to MXN 234,620), under Arti­cles 53, sec­tions I and II, and 54, sec­tion I. Fail­ing to file reports is pun­ish­able by a fine of 10,000 to 65,000 UMA (MXN 1,173,100 to MXN 7,625,150), or ten to one hun­dred per­cent of the value of the act or trans­ac­tion when it can be quan­ti­fied, which­ever is greater (Arti­cle 54, sec­tion III). The author­ity may also order the tem­po­rary sus­pen­sion of trans­ac­tions with spe­cific clients (Arti­cle 54 Bis).

The law allows room to cor­rect in time: on a one-time basis, no penalty is imposed on anyone who com­plies vol­un­tar­ily, before ver­i­fi­ca­tion begins, and acknowl­edges the vio­la­tion (Arti­cle 55).

How we approach it at LEXURE

We assess whether your oper­a­tions con­sti­tute vul­ner­a­ble activ­i­ties, pre­pare the risk assess­ment and the manual together with your team, design the report­ing pro­ce­dure and the train­ing pro­gram, and sup­port the selec­tion of auto­mated mon­i­tor­ing with inter­na­tional providers spe­cial­iz­ing in elec­tronic trust ser­vices.

If your com­pany has not begun pre­par­ing for the 2027 time­line, sched­ule a diag­nos­tic meet­ing with us.

Schedule a diagnostic meeting See our service lines

Legal basis

  1. Federal Law for the Prevention and Identification of Transactions with Illicit Proceeds, last amended in the Official Gazette of the Federation (DOF) on July 16, 2025, Articles 17, sections II, IV and XVI, 18, sections VI to XI, 53, 54, 54 Bis and 55. Current text (opens in a new tab)
  2. Agreement amending the General Rules referred to in the Federal Law for the Prevention and Identification of Transactions with Illicit Proceeds (Acuerdo por el que se modifican las Reglas de carácter general a que se refiere la Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita), DOF August 7, 2026, transitional articles. Official text (opens in a new tab)
  3. 2026 value of the Unit of Measurement and Update, National Institute of Statistics and Geography (INEGI). Official publication (opens in a new tab)

This note is for information only and describes the law in force on the verification date. It is not legal advice on a specific matter. It is a translation of the Spanish original: Mexican law is published in Spanish, and the official Spanish texts prevail.

Keep reading

Related notes.

See all notes