How the New 2026 General Rules of the LFPIORPI Change the Rules of the Game
H&G Abogados
Mexico is updating its financial and corporate regulations through amendments to the Federal Law for the Prevention and Identification of Transactions with Resources of Illicit Origin (LFPIORPI), its Regulations and the General Rules (Agreement 115/2026) issued by the Ministry of Finance and Public Credit (SHCP).
These measures, which respond to international pressure from the Fifth Round of Mutual Evaluation of the Financial Action Task Force (FATF), seek greater transparency. This article reviews these changes, including control over trusts, the use of fictitious capital, and the application of the Risk-Based Approach (RBA) for tax legal defense, distinguishing the responsibilities of accountants, lawyers and certified compliance officers.
Historical Evolution of Anti-Money Laundering Enforcement and FATF Oversight
The prosecution of money laundering and terrorist financing is a recently created legal discipline when viewed from the perspective of legal history.
Its origins date back to the United Nations Convention against Illicit Traffic in Narcotic Drugs and Psychotropic Substances, signed in Vienna in 1988. This treaty forced signatory nations to criminalize in their domestic criminal laws the conversion, transfer and concealment of assets derived from drug trafficking. However, isolated criminalization proved inefficient in the face of the globalization of financial markets and the free movement of capital.
In response to this systemic vulnerability, the G7, meeting at the Paris summit in July 1989, created the Financial Action Task Force (FATF). Originally an intergovernmental working group, the FATF issued its first Recommendations in April 1990. The recommendations became established as soft law instruments.
Their effectiveness lies in the fact that failure to meet the established standards condemns jurisdictions to appear on the organization's gray or black lists, triggering de-risking by international banks, which makes cross-border transactions more expensive and drastically reduces foreign direct investment.
These recommendations evolved to adapt to emerging threats. After the events of September 11, 2001, they were expanded to cover terrorist financing. Mexico became a full member of the FATF in 2000 and was a co-founder of the Financial Action Task Force of Latin America (GAFILAT) in 2006.
The Transparency Revolution: The Beneficial Owner
In February 2012, the FATF restructured its Recommendations to prioritize transparency and the precise identification of the participation of persons and corporate legal structures through a new figure: the beneficial owner.
The FATF defined it as the natural person who owns, controls or exercises effective control over a client or entity. In Mexico, its adoption began with the LFPIORPI in 2012, but the FATF Fourth Round of Mutual Evaluation (2018) exposed persistent failures in access to this information.
This evaluation forced Mexican legislators to amend, among other things, the Federal Tax Code (CFF) for fiscal year 2022, introducing Articles 32-B Ter, 32-B Quáter and 32-B Quinquies, which turned the identification of the beneficial owner into an accounting and tax obligation for all legal entities, trust institutions and legal figures, imposing devastating financial penalties for non-compliance.
The Fifth Round of Mutual Evaluation (2025-2026): The Effectiveness Paradigm
The 2025 and 2026 reforms do not seek theoretical alignment, but positive results in the FATF Fifth Round of Mutual Evaluation, a review that began assessing Mexico in 2025 and whose final results will be shown between late 2026 and early 2027.
The FATF requires empirical demonstration of the system's effectiveness through 11 Immediate Outcomes.
FATF Evaluation Methodology
Main Focus
Operational Implication for Mexico
Technical Compliance
Enactment of laws, regulations and secondary rules aligned with the 40 Recommendations.
Demonstrate that the LFPIORPI, the CFF and financial laws provide for prevention and sanction mechanisms.
Effective Compliance
11 Immediate Outcomes (assessment of statistical results, convictions and forfeitures).
Demonstrate that the system generates useful financial intelligence that culminates in convictions and asset recovery.
The Architecture of the 2025-2026 LFPIORPI Reform
The pressing need to demonstrate effectiveness to the FATF led to a redesign of the federal anti-money laundering legal architecture.
This legal re-engineering was deployed in three hierarchical phases: the amendment to the Law, the modernization of the Regulations and the issuance of a new body of General Rules.
The LFPIORPI amendment (of July 16, 2025) extended anti-money laundering control to the entire corporate sector through Chapter IV Bis (Arts. 33 Bis, 33 Ter and 33 Quáter). It imposes on all commercial companies the non-waivable obligation to identify their beneficial owners and to register on the Ministry of Economy's PSM portal every transfer of shares or rights over them.
On March 27, 2026, the amendment to the Regulations of the Law accelerated the response times required of private parties by instituting the "24-hour Notice" for attempted suspicious transactions (Art. 7 Bis) and imposing, in Chapter Six Bis, detection systems and enhanced due diligence for Politically Exposed Persons (PEPs) using FIU databases.
The regulatory framework was completed on August 7, 2026 with Agreement 115/2026 (General Rules), which regulated technical aspects such as the Risk-Based Approach (Chapter II Quáter), client risk classification (Chapter III Bis), the Internal Policies Manual (Chapter X) and independent annual audits (Chapter XIV).
Main Figures Facing Stricter Review
Trusts and Irregular Structures: simulated injections of resources through the overvaluation of trademarks, patents, software, etc., with the sole purpose of inflating financial statements or laundering money by simulating capital gains.
Shell or Front Companies: undervalued or overvalued real estate purchases and sales (to justify the entry of illicit money into the financial system).
Simulation of Specialized Professional Services.
Fictitious Loans and Debt Injections.
Arbitrage and Virtual Asset Mixers (Crypto-assets): use of cryptocurrencies or exchange platforms without formal registration with the SAT.
Non-Bank Service and Prepaid Cards: improper issuance or distribution of electronic wallets, gift cards or loyalty wallets as mechanisms to transfer value outside the monitoring of the traditional financial system.
Fiduciary Opacity: The Main Figure Regulated by the New General Rules
The trust (regulated by Art. 381 of the General Law of Negotiable Instruments and Credit Operations, or LGTOC) creates autonomous assets that separate the property from the assets of the settlor and the beneficiary. Although it originally seeks to provide legal certainty, this figure has been used to hide the real owners through complex corporate structures.
Current regulations put an end to this concealment. Following FATF Recommendation 25 and the 2026 General Rules (Chapter III Quinquies), in-depth due diligence is required. It is no longer enough to identify the trust institution; those carrying out vulnerable activities must break down the entire structure until they find the natural person who exercises effective control. This means fully identifying the settlor, beneficiaries, technical committee members and any protective figure.
Other Affected Accounting and Tax Dynamics: Capital Movements with Assets of Dubious Value or Material Amount
Other critical typologies targeted by the new regulatory framework, including the General Rules amended in August 2026, involve the misuse of accounting principles to launder capital flows or generate fictitious tax shields.
The mechanism operates at the intersection of corporate, banking and credit law and various tax fraud schemes. Organizations operating with illicit assets need to handle funds of irregular origin, either by inflating their assets to access credit lines or justify deductions, or simply to launder capital derived from criminal activities.
Closing the Operational Net: the 2025 LFPIORPI amendments and the 2026 rules implement an early detection system through three key axes:
Oversight of Valuation: under Art. 17, Section XII, Paragraph B of the LFPIORPI, appraisals performed by experts on assets equal to or greater than 8,025 UMA (approx. $941,000 MXN) are vulnerable activities. The appraiser must identify the beneficial owner and send a preventive notice to the FIU.
Monitoring of the Capital Structure: under Art. 33 Bis of the LFPIORPI, every transfer of shares or change in equity must be reported immediately on the Ministry of Economy's portal, eliminating the opacity of private corporate books.
Tax Audit and Intelligence: the traceability obtained by the SAT and the FIU makes it possible to detect discrepancies between profits and the value of contributed assets, triggering anti-money laundering verification visits and in-depth tax audits.
The Risk-Based Approach (RBA): From Obligation to Administrative Defense Tool
Chapter II Quáter of the 2026 General Rules enshrines the mandatory implementation of the Risk-Based Approach (RBA). It is the main focus of corporate prevention and a vital procedural tool in administrative tax defense before bodies such as the Federal Court of Administrative Justice (TFJA).
The regulations require the obligated party to structure a risk assessment methodology segmented into three main phases:
Design Phase: involves identifying threats and vulnerabilities by analyzing the type of clients, the financial or commercial products offered, distribution channels and geographic areas involved, and this design must always be aligned with the results of the National Risk Assessment (ENR 2023) issued by the FIU.
Implementation Phase: covers the practical execution of internal policy manuals, the use of automated technological monitoring systems and the continuous classification of the client portfolio into risk levels (low, medium, high).
Assessment Phase: involves an annual or semi-annual critical review, often verified through an audit report (internal or external, depending on the entity's risk level), to confirm the effectiveness of the controls.
Who Does What?
Role
Who Can Do It?
Main Function in the RBA
Operations (Regulatory Compliance)
Accountants, Lawyers (external or In Counsel), Administrators.
Collect KYC, document the Beneficial Owner and build files.
Address
Certified Compliance Officer.
Design the methodology, authorize transactions and send Notices to the FIU.
Validation (Audit)
External Firm or Independent Internal Auditor.
Issue the Effectiveness Report (Assessment Phase) for defense in SAT and TFJA administrative proceedings.
Conclusion
Mexico's regulatory transition toward the FATF Fifth Round of Evaluation marks a point of no return: the shift from formal technical compliance to the demonstration of real effectiveness. In this new ecosystem, the precise identification of the beneficial owner and the rigorous execution of the Risk-Based Approach (RBA) are no longer administrative formalities but have become the strategic pillars of legal and tax defense. Full transparency is no longer an option, but the only way to guarantee the operational viability and legal integrity of organizations in the face of the SAT's and FIU's verification and oversight powers.
Mexico amends the LFPIORPI and its Regulations and issues Agreement 115/2026 (General Rules) in response to the FATF Fifth Round of Mutual Evaluation, whose results will be known between late 2026 and early 2027.
Chapter IV Bis of the Law (Arts. 33 Bis, 33 Ter and 33 Quáter) requires every commercial company to identify its beneficial owners and register any transfer of shares or rights on the Ministry of Economy's PSM portal.
The new "24-hour Notice" (Art. 7 Bis of the Regulations) requires immediate notification of attempted suspicious transactions and strengthens enhanced due diligence for Politically Exposed Persons (PEPs).
Trusts come under greater scrutiny: it is no longer enough to identify the trust institution; the entire structure must be broken down until the natural person exercising effective control is found.
The Risk-Based Approach (RBA) becomes the central tool for administrative tax defense before the SAT and the TFJA, structured in three phases: design, implementation and assessment.
Compliance is distributed across three roles: operations (accountants and lawyers, external or In Counsel), management (Certified Compliance Officer) and validation (independent audit).
News and legal updates
The most recent changes in laws and regulations, issues of national and international interest and emerging trends in the legal world that directly impact our clients and their industries.
Historically, the trust has constituted a fundamental legal instrument in Mexico for the structuring of assets and real estate developments, based on its ability to provide