Risk bulletin

When a corporate client audits its supplier: what it will ask for and how to prepare

Your client asks for your REPSE registration because the law holds it liable for you. Understanding its risk is the best way to pass the audit.

LEXURE Preventive Diagnostics Practice Team 4 min read Regulatory status verified in 2026

When a cor­po­rate client audits its spe­cial­ized ser­vices provider, it does so because the law makes it liable for what­ever that provider fails to comply with, more than out of dis­trust. If you under­stand that risk, you will know exactly what you will be asked for and why.

What changes for your company

Sub­con­tract­ing of per­son­nel is pro­hib­ited; only the sub­con­tract­ing of spe­cial­ized ser­vices or spe­cial­ized works that are not part of the client’s cor­po­rate pur­pose or pre­dom­i­nant eco­nomic activ­ity is per­mit­ted, and only if the provider is reg­is­tered with the Min­istry of Labor and Social Wel­fare (STPS), under Arti­cles 12, 13, and 15 of the Fed­eral Labor Law (Ley Fed­eral del Tra­bajo). A client that hires a non­com­pli­ant provider is jointly and sev­er­ally liable to that provider’s work­ers, under Arti­cle 14 of that law and Arti­cle 15 A of the Social Secu­rity Law (Ley del Seguro Social), and it loses the deduc­tion and the value added tax credit on its pay­ments if the provider is not reg­is­tered, under Arti­cle 15-D of the Fed­eral Tax Code (Código Fiscal de la Fed­eración).

That is why, in the audit, the client will ask you to prove four points: a valid reg­is­tra­tion, a writ­ten con­tract stat­ing the approx­i­mate number of work­ers, the infor­ma­tional return filed every four months with the Mex­i­can Social Secu­rity Insti­tute (IMSS), and the tax com­pli­ance opin­ion. If the provider pro­cesses the client’s per­sonal data, the con­tract that gov­erns it as a data pro­ces­sor is added.

What to do and by when

  1. Check that your reg­is­tra­tion is cur­rent: it must be renewed every three years (Arti­cle 15 of the Fed­eral Labor Law).
  2. For­mal­ize each ser­vice with a writ­ten con­tract stat­ing its pur­pose and the approx­i­mate number of work­ers (Arti­cle 14).
  3. File the con­tracts infor­ma­tional return with the IMSS every four months, no later than the 17th of Jan­u­ary, May, and Sep­tem­ber (Arti­cle 15 A of the Social Secu­rity Law). The next one is due Jan­u­ary 17, 2027.
  4. Also file the four-month infor­ma­tional return with the Insti­tute of the National Work­ers’ Hous­ing Fund (Infon­avit) on the same dates, under Arti­cle 29 Bis of the Infon­avit Law (Ley del Insti­tuto del Fondo Nacional de la Vivienda para los Tra­ba­jadores).
  5. Keep a recent tax com­pli­ance opin­ion on hand, and a data pro­cess­ing agree­ment when you process the client’s data.

Recommendations to mitigate risk

Pro­vid­ing sub­con­tract­ing ser­vices with­out reg­is­tra­tion car­ries a fine of 2,000 to 50,000 Units of Mea­sure­ment and Update, or UMA (MXN 234,620 to MXN 5,865,500), and the same fine applies to the client that ben­e­fits from the irreg­u­lar sub­con­tract­ing (Arti­cle 1004-C of the Fed­eral Labor Law). In prac­tice, beyond facing the penalty, a provider that cannot prove these points loses the con­tract, because its client cannot take on that risk.

How we approach it at LEXURE

Blin­daje Cor­po­ra­tivo reviews the provider’s labor and reg­u­la­tory front before its client does: reg­is­tra­tion, con­tracts, infor­ma­tional returns, tax opin­ion, and data pro­cess­ing, with an action plan clas­si­fied as IMMEDIATE, SHORT TERM, and MEDIUM TERM.

If you expect an audit from a cor­po­rate client, let’s talk before the request arrives.

Schedule a diagnostic meeting Discover Blindaje Corporativo

Legal basis

  1. Federal Labor Law, Articles 12, 13, 14, 15, and 1004-C. Current text (opens in a new tab)
  2. Social Security Law, Article 15 A. Current text (opens in a new tab)
  3. Law of the Institute of the National Workers’ Housing Fund, Article 29 Bis. Current text (opens in a new tab)
  4. Federal Tax Code, Article 15-D. Current text (opens in a new tab)
  5. 2026 value of the Unit of Measurement and Update, National Institute of Statistics and Geography (INEGI). Official publication (opens in a new tab)

This note is for information only and describes the law in force on the verification date. It is not legal advice on a specific matter. It is a translation of the Spanish original: Mexican law is published in Spanish, and the official Spanish texts prevail.

Keep reading

Related notes.

See all notes