The primary law: LFPIORPI
The Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita (LFPIORPI), commonly called the anti-money laundering law, is the primary AML statute for non-financial businesses in Mexico. It was enacted in 2012, and its implementing regulations have been refined several times since. The law is administered by the Unidad de Inteligencia Financiera (UIF), which operates under the Secretaría de Hacienda y Crédito Público (Ministry of Finance).
Financial institutions (banks, exchange houses, and insurance companies) operate under separate AML frameworks supervised by the CNBV and the CNSF. LFPIORPI covers the non-financial sector—what the FATF calls "Designated Non-Financial Businesses and Professions" (DNFBPs).
Who is subject to LFPIORPI: the vulnerable activities list
The LFPIORPI establishes a defined list of “vulnerable activities.” Any person or entity that performs these activities professionally or habitually becomes an “obligated person” with compliance obligations under the law. The list includes:
- Real estate brokers and developers: Buying, selling, or brokering the purchase or sale of real estate. This covers real estate agents, developers who sell units to end buyers, and companies that facilitate property transactions. The threshold for mandatory UIF reporting is transactions with a value at or above MXN 168,678 (this amount is periodically adjusted).
- Accountants and auditors: Performing specified transactions for clients, including creating or managing legal entities, buying or selling businesses, managing bank accounts or securities, and managing assets. Routine bookkeeping and audit services are not covered—the specific transactions listed in the law trigger coverage.
- Legal professionals: Lawyers and legal firms that provide services on specified transactions for clients. These include creating, operating, or managing legal entities; buying and selling businesses; managing bank or investment accounts; organizing contributions for real estate acquisition; and managing client assets. Note that litigation and advocacy services are generally not covered—it is the transactional advisory that triggers LFPIORPI obligations.
- Vehicle dealers: Dealers in automobiles, aircraft, and watercraft.
- Jewelry, art, and precious metals dealers: Sales of precious metals, precious stones, watches, jewelry, and works of art above threshold values.
- Casinos and gaming establishments: All gaming activities.
- Credit unions and unregulated financial entities: Entities that provide credit or factoring outside the banking system.
- Notaries and commercial brokers: In real estate transactions and corporate transactions (incorporation, share transfers, capital increases). Notaries have among the most comprehensive LFPIORPI obligations of any professional group because they formalize most of the transactions the law targets.
- Armored transport companies and customs agents: Also included in the vulnerability list.
Core compliance obligations
Every obligated person must implement four core obligations:
1. KYC—Know your customer
Before establishing a business relationship or executing a transaction, the obligated person must identify and verify the client’s identity. For individuals: government-issued ID, RFC, CURP, address, and information about the origin of funds. For legal entities: notarial deed, RFC, list of shareholders or partners (and their individual ID documents), and identification of the beneficial owner (the natural person who ultimately owns or controls the entity—the “UBO”).
The UBO identification requirement is particularly important for foreign-owned structures. A chain of holding companies does not obscure the obligation—you must identify the natural person at the top of the ownership chain.
2. Vulnerable activity notices—transaction reporting to the UIF
When a transaction reaches or exceeds the applicable monetary threshold, the obligated person must file a notice with the UIF. Reporting thresholds vary by activity type:
- Real estate transactions: MXN 168,678 (cash component)
- Vehicle sales: MXN 168,678
- Jewelry and art: MXN 168,678
- Legal and accounting services for specified transactions: MXN 168,678 aggregate per client per year
Notices are filed through the UIF’s IUSE electronic portal. The filing deadline is the 17th business day of the month following the transaction. Cash transactions above the threshold in any covered activity must be reported regardless of the client’s KYC status.
Certain activities trigger reporting obligations even below the monetary threshold—these are called “vulnerable activities without a threshold” and include any transaction where the professional suspects money laundering, regardless of amount.
3. Record Retention
All client identification documents, transaction records, and UIF filings must be retained for five years from the date of the transaction. The records must be maintained in a format accessible to the UIF for inspection.
4. Appointing a Compliance Officer
Entities with significant transaction volume must appoint a compliance officer responsible for overseeing the AML program, training employees, filing notices, and serving as the primary contact with the UIF. The compliance officer must be registered with the UIF.
The UIF and its enforcement role
The Unidad de Inteligencia Financiera receives and analyzes financial intelligence reports from financial institutions and LFPIORPI-obligated persons. When the UIF develops grounds to suspect that assets are proceeds of crime, it can issue a “blocking order” (lista negra) that freezes the assets of suspected persons—a power it has used increasingly aggressively in recent years. The UIF works in coordination with the Fiscalia General de la Republica (FGR) on criminal prosecution.
Criminal liability: Código Penal Federal Art. 400 Bis
Money laundering is criminalized under Article 400 Bis of the Código Penal Federal. The offense covers acquiring, possessing, using, converting, or transferring resources knowing or having reason to know they are proceeds of unlawful activity. The penalty is imprisonment of 5 to 15 years and a fine of up to 50,000 days of minimum wage.
Criminal liability extends to legal persons (companies) as well as individuals. Directors and officers who knew of or facilitated money laundering through the company can face personal criminal prosecution.
AML in real estate and corporate transactions
Real estate transactions and corporate work are two areas where LFPIORPI compliance and legal services intersect most directly. A real estate attorney advising a foreign buyer on a coastal property acquisition is performing a vulnerable activity. A corporate attorney helping a client incorporate a company or transfer shares is performing a vulnerable activity. These professionals must fulfill their own LFPIORPI obligations—including KYC on their clients—before providing the service.
For foreign buyers and investors, this means that your Mexican attorney will ask for documents that may seem like intrusive due diligence. This is not optional. The attorney is fulfilling a legal obligation, and providing false or incomplete information to satisfy a KYC request is itself a criminal risk.
Building a compliance program
An effective LFPIORPI compliance program for an obligated entity includes a written AML policy document, a client identification and verification procedure, a documented risk classification for clients and transactions (higher risk = enhanced due diligence), a notice-filing calendar, a record retention system, and annual training for all relevant personnel.
For multinationals whose Mexican entities perform vulnerable activities, the AML compliance program should align with the parent’s global AML framework while meeting all Mexican-specific requirements.
Frequently asked questions
Yes, if the Mexican subsidiary performs any of the designated vulnerable activities. The law applies to persons and entities performing vulnerable activities in Mexico regardless of where the parent is based. Additionally, the US parent’s own AML obligations (Bank Secrecy Act and OFAC) may be implicated by transactions involving Mexico.
Late or missing notices can result in administrative fines. LFPIORPI administrative penalties range from a warning to fines of up to MXN 34 million depending on the severity and frequency of the violation. Deliberate noncompliance—particularly if linked to actual money laundering activity—can escalate to criminal prosecution. The UIF has increased enforcement activity significantly since 2019.
Real estate transactions above the MXN 168,678 threshold must be reported by the obligated professionals involved—the real estate broker, the notary, and potentially the legal advisor. The threshold applies to the cash component of a transaction. Non-cash transactions (full bank wire transfers) may still be subject to reporting under the activity-level rules, but the cash threshold triggers mandatory reporting regardless.
Not based solely on the client being foreign. However, LFPIORPI requires enhanced due diligence for certain higher-risk clients, including politically exposed persons (PEPs) and clients from high-risk jurisdictions on the FATF grey list or black list. If a client’s risk profile triggers enhanced due diligence, the notice obligation may apply even at lower transaction amounts if suspicion of money laundering exists.
Banks in Mexico operate under a separate AML framework under the CNBV, including specific anti-money laundering guidelines (Disposiciones de Carácter General). LFPIORPI applies to non-financial entities and professionals. Both frameworks require KYC and transaction reporting, but the specific thresholds, reporting formats, and regulators differ. A business that interacts with both a bank and a covered professional (e.g., a notary and a real estate agent) will encounter both frameworks simultaneously in a real estate transaction.