KYC, KYB and AML 2026 Playbook for Mexico

What the 2025 LFPIORPI reform actually changed

Mexico's July 2025 LFPIORPI reform is the country's deepest AML overhaul in a decade. From 17 July 2025 it cut the beneficial-owner threshold from 50% to 25%, made a documented risk-based approach and automated monitoring mandatory, and set record retention at ten years.

A second reform to the LFPIORPI Regulations took effect on 28 March 2026 and turned those duties into daily practice. Firms now identify beneficial owners directly, monitor transactions continuously, and file a report within 24 hours of a suspicious operation, even one that never completes.

Who regulates KYC and AML in Mexico?

Mexico spreads AML authority across several agencies, and a single onboarding decision can answer more than one. The LFPIORPI is the core statute. The Federal Tax Code adds its own beneficial-owner regime, and the 2018 Fintech Law governs virtual assets.

Two bodies shape day-to-day work. The CNBV sets how identity and AML controls are examined, and the UIF decides which names are blocked and which reports are filed. You can satisfy the CNBV on paperwork and still fail by missing one name on the UIF list.

Mexico remains in enhanced follow-up from its 2018 FATF evaluation.

Why a valid Mexican ID does not prove a real person

A valid Mexican ID proves registry enrollment, not that the person holding it is real. A CURP confirms someone exists in RENAPO's records. It says nothing about who is on the other side of the screen.

That is the personhood gap, and it is where fraud rings work, pairing genuine registry data with forged or synthetic documents. Closing it takes face verification with liveness detection and biometric matching, so the file binds to a living person instead of a document anyone can copy.

MXN$11.3B

Identity-theft fraud in Mexico's banking system in 2024, up 77% year on year. About 1.4% was reimbursed to victims.

Source, CONDUSEF.

Mexican IDs are issued by federal, state and municipal bodies, many with holographic overlays printed straight over the data fields, and names often stack multiple given names with paternal and maternal surnames. Reliable document reading and verification across this variety is the first real test of any verification partner.

How to onboard and verify a customer

Mexico's CNBV scales identity checks to account risk through four tiers, Nivel 1 to Nivel 4. Lower tiers allow lighter checks and small balances. Higher tiers require full identification and biometrics and support business accounts.

Remote onboarding is well established at the higher tiers. Since 2020, banks and fintechs can open Nivel 3 and Nivel 4 accounts for Mexican nationals over video, using an INE photo, a selfie and a live call of at least 30 seconds, matched against the INE and confirmed with RENAPO.

Beneficial ownership after the 25% rule

Since 17 July 2025, a beneficial owner in Mexico is anyone who ultimately owns or controls 25% or more of an entity, down from 50%. The Federal Tax Code keeps its own 15% threshold under Article 32-B Quarter, so companies now document beneficial owners under two regimes at once, 25% for AML and 15% for tax.

The two thresholds do not line up, and that gap is where the work lives. Every AML owner at 25% or more is screened against the LPB and international lists through AML screening, while KYB business verification maps the ownership chain behind them. The tax regime wants the SAT notified within 15 days of any ownership change.

Under the old 50% rule, Company X had zero beneficial owners. The 25% AML rule captures two. The separate 15% tax rule captures four, including two holders the AML rule misses. One cap table, two owner lists, and that gap is where the complexity lives.

PEPs, sanctions and the US-Mexico enforcement axis

Mexico runs two sanctions tracks at once. A domestic one through the UIF's Lista de Personas Bloqueadas (LPB), and an international one across OFAC, the UN, the EU and FinCEN. A match triggers suspension and a 24-hour unusual-operation report. A politically exposed person moves straight to enhanced due diligence.

The 2025 CIBanco, Intercam and Vector case shows why continuous screening is now the floor. A bank with decades of history was liquidated after control failures it could not document, and correspondent banks worldwide cut their Mexico exposure in response.

USD$377,700

2025 maximum IEEPA civil penalty per violation, or twice the transaction value, whichever is greater.

“A decades-long banking history is no shield when controls cannot be proven. Mexico now punishes missing evidence, not only missing policy.”

Sources: FinCEN's first FEND Off Fentanyl orders; 53 fines totalling MXN$185M.

Sector rules for fintech, crypto, iGaming and lending

Mexico regulates every sector through one shared AML core, the LFPIORPI, then adds licence-specific duties on top. A fintech, a crypto provider, an iGaming operator and a lender all run the same tiered KYC, documented risk-based approach and ten-year retention, but each reports to a different supervisor and carries different sector risks.

Crypto shows where the risk is heading. UIF virtual-asset alerts jumped almost fivefold in a year, the fastest-rising vulnerable activity in the country.

How to choose an identity verification partner for Mexico

Choosing a verification partner for Mexico comes down to five local tests. Document coverage, liveness quality, screening breadth, data residency and configurability for the risk-based tiers. A vendor that shines in a global demo can still fail on Mexican documents.

Document coverage is the test that decides it. Holographic overlays sit directly over the fields an engine reads, and multi-surname names break naive parsers. Ask every vendor to run real Mexican documents through the platform, not a curated sample.

Your Mexico AML compliance checklist

This checklist maps each duty to the control it needs and the evidence an examiner will ask to see. One thread runs through every 2024 and 2025 CNBV finding. Regulators punish missing documentation harder than missing policy.

A programme with written procedures, training sign-offs, internal audits and monitoring trails can defend itself. One with policies but no proof of execution cannot.

Common CNBV findings, 2024 and 2025

No documented proof that KYC happened, with unsigned CDD files or missing timestamps

Beneficial-owner thresholds misapplied, stopping at 50% instead of 25%

LPB screening run only at account opening rather than continuously

Monitoring alerts left unreviewed with no escalation decision on file

Training not completed by the 1 January 2026 deadline

How Mexican customers actually verify

Verification performance is the proof that ties this playbook together. How often genuine Mexican customers pass on the first try, and how reliably documents authenticate across the country's many issuers. A high first-time pass rate keeps real customers from dropping out and cuts the manual-review load that slows every downstream AML check.

One connected system for identity proofing, beneficial-owner verification and transaction monitoring means fewer manual reviews, faster onboarding and a higher first-attempt pass rate. That is the difference between a clean exam and a queue of exceptions.

How Shufti maps to Mexico's LFPIORPI duties

Shufti is a Glocal Platform that manages the full compliance lifecycle, from sign-up and onboarding through authentication and monitoring to remediation. Built for every industry, every region and every use case, it works across 240+ countries and territories, with SaaS, private-cloud and on-premise deployment and ISO 27001, SOC 2 Type II and GDPR alignment.

Disclaimer: This guide is educational and does not constitute legal advice. Verify current obligations against the LFPIORPI, its Regulations, and CNBV and UIF provisions before acting.