Global companies operating in Mexico carry a dual compliance burden. Mexican domestic law imposes its own regulatory requirements. Home-country legislation\u2014US, Canadian, or European\u2014often reaches conduct that occurs in Mexico. Managing both layers simultaneously, without gaps or redundant cost, requires a structured compliance program designed for the Mexican operating environment.<\/p>\n\n\n\n
A US-listed company with a Mexican subsidiary faces at least four regulatory frameworks simultaneously: Mexican corporate and commercial law; the US Foreign Corrupt Practices Act (FCPA); Sarbanes-Oxley (SOX) internal control and financial reporting obligations; and Mexican anti-corruption law (Ley General del Sistema Nacional Anticorrupci\u00f3n and Ley General de Responsabilidades Administrativas).<\/p>\n\n\n\n
A Canadian company faces the Corruption of Foreign Public Officials Act (CFPOA) alongside Mexican requirements. A UK entity faces the UK Bribery Act, which is broader than the FCPA in that it covers commercial bribery, not just public official bribery.<\/p>\n\n\n\n
The practical consequence is that your Mexican compliance program cannot be designed in isolation. It must satisfy both the home regulator looking over your shoulder and the Mexican authorities with direct jurisdiction.<\/p>\n\n\n\n
The Comisi\u00f3n Federal de Competencia Econ\u00f3mica (COFECE) enforces Mexican competition law. Price-fixing, market allocation, bid-rigging, and other horizontal cartel conduct are absolute prohibitions with criminal exposure. Vertical arrangements (distribution agreements, exclusivity, and resale price maintenance) require case-by-case analysis.<\/p>\n\n\n\n
Mexico adopted a leniency program modeled on US and EU precedents. Companies that self-report cartel conduct and cooperate can obtain reduced or eliminated fines. For companies in distribution-intensive industries\u2014manufacturing, consumer goods, pharmaceuticals, and construction\u2014a competition compliance policy and training program are baseline requirements.<\/p>\n\n\n\n
Merger control also falls under COFECE. Transactions that meet the thresholds (based on asset and revenue values in Mexico) require pre-closing notification. Missing the filing obligation triggers fines regardless of whether the transaction raises competitive concerns.<\/p>\n\n\n\n
The Ley Federal para la Prevenci\u00f3n e Identificaci\u00f3n de Operaciones con Recursos de Procedencia Il\u00edcita (LFPIORPI) designates certain activities as \u201cvulnerable\u201d and imposes mandatory KYC, transaction reporting, and record-keeping obligations on those who perform them. See our dedicated article on AML compliance for the full list of vulnerable activities and obligations.<\/p>\n\n\n\n
For global companies, the key intersection with corporate work arises when the company or its professional advisors perform activities covered by LFPIORPI\u2014particularly real estate transactions, accounting and auditing for specific transaction types, and legal advisory on corporate restructuring and M&A. Ensure that your advisors in Mexico are meeting their LFPIORPI obligations and that your transaction documentation is consistent with what will be reported to the UIF.<\/p>\n\n\n\n
The Ley Federal de Protecci\u00f3n de Datos Personales en Posesi\u00f3n de los Particulares (LFPDPPP) is Mexico\u2019s primary data privacy law for private-sector entities. It is enforced by the Instituto Nacional de Transparencia, Acceso a la Informaci\u00f3n y Protecci\u00f3n de Datos Personales (INAI).<\/p>\n\n\n\n
Core obligations for any company that handles personal data of Mexican residents:<\/p>\n\n\n\n
INAI enforcement has accelerated. Fines range from approximately MXN 100 to MXN 320 million depending on violation type and company size. More significant for multinationals is reputational risk from public INAI resolutions.<\/p>\n\n\n\n
Labor misclassification is one of the highest-risk compliance areas for foreign companies in Mexico. The Ley Federal del Trabajo (LFT) establishes a presumption of employment: if a person performs personal, subordinate, paid work for your benefit on a regular basis, Mexican courts will likely classify that person as an employee regardless of how the relationship is documented.<\/p>\n\n\n\n
The 2021 subcontracting reform (amendments to the LFT, IMSS Law, INFONAVIT Law, and tax code) eliminated the prior model of outsourcing all employees through a service company. Under the current rules:<\/p>\n\n\n\n
An effective compliance program for a Mexican subsidiary includes a documented calendar of recurring obligations:<\/p>\n\n\n\n
Internal audit coordination with the home country requires translating Mexican compliance metrics into frameworks the parent\u2019s audit committee recognizes\u2014mapping Mexican regulatory requirements to SOX control frameworks or ISO standards.<\/p>\n\n\n\n