Mexico issues new anti-money laundering rules

Update August 21, 2026: KPMG Mexico уточ? Actually no. KPMG Mexico clarified the key effective and compliance dates for the new LFPIORPI General Rules. The rules take effect on November 30, 2026, the internal policies manual and risk methodology must be ready by March 1, 2027, and automated mechanisms must be implemented no later than June 1, 2027.

Mexico’s Ministry of Finance and Public Credit published amendments to the LFPIORPI General Rules through Resolution 115/2026. The change adds a requirement to have a documented risk assessment methodology before offering new products or services, or before onboarding new customers.

The reform also requires customers to be classified by risk level as low, medium or high, with the option to create intermediate tiers. Based on the materials reviewed, the risk-based approach now serves as the operating framework for covered entities.

What does the new resolution require?

The new rules require companies to design and implement a methodology to identify, analyze, measure and mitigate money laundering risks. That assessment must consider customers, transactions, products, services, channels and geographic areas, as well as amounts, frequency, and the origin and destination of funds.

Piranirisk said the methodology must be in writing, use information from a period of at least 12 months, and be reviewed at least every 12 months, or whenever new risks emerge or the National Risk Assessment is updated. It also said customer classification must be reassessed at least every six months.

What deadlines did Hacienda set?

Hacienda set a phased effective date for the new rules, with separate deadlines for general applicability, the internal manual, the risk methodology and automated mechanisms. KPMG Mexico reported that the general rules will take effect on November 30, 2026.

Under that same report, the internal policies manual and risk methodology must be ready by March 1, 2027. Automated mechanisms must also be implemented no later than June 1, 2027.

CTW Mexico added that the risk-based assessment must be available to the authority and that existing obligated entities must have the updated manual by March 1, 2027. Infobae, for its part, reported that Hacienda changed the anti-money laundering rules so that vulnerable-activity entities identify, assess, classify and document risks tied to customers, transactions, products, services, channels and geographic areas.

What changes for banks?

The resolution also changes provisions for credit institutions on identity verification using biometric technology. According to El Cronista, banks will have 90 business days to make the required adjustments.

The same outlet reported that the regulation adds facial biometrics as an official verification method, with a minimum 90% match threshold against INE, SRE or other federal authority records.

ObsidianRISK said the rules published by the SHCP in the Official Gazette on August 7, 2026 operationalize the 2025 LFPIORPI reform and the 2026 reform to its Regulations, and establish the risk-based approach as the guiding principle for obligated entities.