Amendment to the General Rules under the Mexican Anti-Money Laundering Law, New Obligations for Parties Conducting Vulnerable Activities

The purpose of this note is to inform you that on August 7^th, 2026, the Ministry of Finance and Public Credit published in the Federal Official Gazette Agreement 115/2026 (the “Agreement”), amending the General Rules issued under the Federal Law for the Prevention and Identification of Transactions with Illicitly Sourced Funds (the “AML Law” and the “General Rules”, respectively).

The Agreement comprehensively restructures the compliance framework applicable to those conducting vulnerable activities (the “Vulnerable Activities”). This note highlights the six changes with the broadest impact across all Vulnerable Activities listed in Article 17 of the AML Law.

Relevant Amendments

We highlight below six changes applicable to all Vulnerable Activities:

1.- Risk-based approach. Every obligated party must design and implement its own risk assessment methodology covering its transactions, clients, channels, and geographic areas, considering the National Risk Assessment published by the Financial Intelligence Unit (the “UIF”, Mexico’s equivalent to FinCEN). This means documenting in writing the risk associated with the type of transactions conducted, the client profile, the geographic areas involved and payment methods, and reviewing it at least every 12 (twelve) months.

2.- Client classification and knowledge (KYC). Each client must be classified at a low, medium, or high-risk level and reassessed at least every 6 (six) months. A transactional profile must also be built for each client, together with an alert system to detect deviations. Politically exposed persons are subject to enhanced due diligence and must be screened through the “Consulta PEP 2.0” application of the UIF.

3.- Beneficial Owner. A three-tier cascade must be exhausted in order, starting with any person directly or indirectly holding 25% (twenty-five percent) or more of the capital and, only in the absence of such person, moving to whoever exercises control by other means and, ultimately, to the most senior managing officer. For trusts, the control chain must be traced upward to the individual who exercises effective control, who may be the settlor, the beneficiary, or a member of the technical committee.

4.- Trusts and other legal vehicles. Those carrying out Vulnerable Activities through a trust or a joint venture agreement (asociación en participación) must be enrolled in the corresponding registry in that capacity, using the advanced electronic signature (e.firma) associated with the vehicle’s own Federal Taxpayer Registry  number rather than that of the trustee, the settlor or the legal representative.

5.- Notices. The Agreement defines, activity by activity, the transaction date that triggers the filing deadline, reducing uncertainty as to late filings. Two new notices with a 24 (twenty-four) hour deadline are created, one for suspicion and one for facts or indications, both applicable even where the relevant threshold is not met and even if the transaction was never completed. The nil report stating that no reportable transactions took place may not be amended or deleted once filed.

6.- Internal compliance. An Internal Policies Manual containing 14 (fourteen) minimum sections becomes mandatory. Automated mechanisms must be implemented to consolidate transactions per client, run the risk model, and generate alerts. An annual training program delivered by instructors with at least 5 (five) years of experience and a mandatory annual audit are also introduced.

Effective Dates

In general terms, the Agreement will enter into force on November 30^th, 2026; however, it sets out a phased implementation timetable for certain obligations.

Recommendations

We recommend promptly conducting a gap analysis between the current compliance program and the new obligations, prioritizing the risk assessment methodology, client risk classification, and automated mechanisms.

We remain available to discuss the scope of the amendment as it applies to your operations. We have prepared a memorandum analyzing all the changes chapter by chapter, together with the implementation calendar, which we will gladly make available upon request.