Mexico AML Obligations for Accountants: LFPIORPI and Vulnerable Activities

Mexico does not regulate accountants under a single heading. Instead, its anti-money-laundering law lists "vulnerable activities", and an accountant is caught when the services they provide match one of them. This guide explains how the federal law works for independent professional services, what the filing duties are, and how long records must be kept. For the general ideas, see our guide to KYC and customer due diligence for accountancy practices.

Where this guide comes from

We used the current text of the Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita (LFPIORPI) from the Chamber of Deputies website, which shows its last reform as published on 16 July 2025, and a frequently-asked-questions document from the tax authority (SAT) on vulnerable activities, which is undated and says its answers have no regulatory value. Article numbers are from the law. The criminal provisions were not in the text we could read. This is general information, not legal advice.

When an accountant is covered

The law does not name accountants. Article 17, fraction XI, covers independent professional services, meaning services provided without an employment relationship with the client, when the provider prepares or carries out for the client: sales or transfers of real estate; the management of funds, securities or other assets; the management of bank, savings or securities accounts; the organisation of capital contributions for companies; or the formation, merger, operation or administration of legal entities or vehicles, including trusts, and the purchase or sale of companies. An aviso (notice) is triggered when the provider carries out a related financial operation for the client. The text we read sets no peso threshold for fraction XI, so whether a given engagement is within scope needs careful reading. On our reading, salaried in-house accountants fall outside the wording because it refers to services without an employment relationship, but we have not confirmed that with the authority.

Identifying clients and beneficial controllers

Article 18 requires vulnerable activities to identify and verify clients with official identification and keep copies (fraction I), to obtain information on the client's activity or occupation where there is a business relationship (fraction II), and to identify the beneficial controller of legal entities, trusts and similar vehicles, with individuals declaring whether they know of one (fraction III). Article 3 treats the beneficial controller as equivalent to the beneficial owner. The SAT FAQ adds that a single file is kept for each client, opened before or during the operation, and that the file includes a beneficial controller certificate. Our guide to ultimate beneficial ownership explains the concept in general.

Notices and deadlines

Under article 23, avisos are due no later than the 17th of the month following the operation, filed electronically in official formats under article 24. Separately, article 18 fraction VI requires a notice within 24 hours of becoming aware of suspicion or factual indications, even if the operation was not completed. The SAT FAQ says registration is done through the online portal using an electronic signature, and that if there are no reportable operations a nil notice may still be required. Our guide to suspicious activity reports and tipping off explains why confidentiality matters.

Record keeping

Article 18 fraction IV requires supporting records to be kept for at least ten years from the date of the activity. Some commentary refers to five years, but in the law text we read, five years is a different period that limits how far back the authority's verifications may look. Plan for ten.

Compliance representative

Under article 20, legal entities must designate a compliance representative before the authority, who must receive training every year. Until a designation is made or accepted, the duties fall to the board or sole administrator.

Sanctions

Articles 52 to 54 provide administrative fines expressed in multiples of the daily UMA (the unit of measure and update). The tiers shown are 200 to 2,000 times the daily value for some breaches, 2,000 to 10,000 times for others, and 10,000 to 65,000 times, or 10 percent to 100 percent of the operation's value if quantifiable, whichever is greater, for the most serious. Article 53 gives a 30-day window for late notices, and article 55 allows a waiver for spontaneous compliance or a reduction of up to 50 percent in later cases. The SAT FAQ says obstructing a verification visit can attract a fine of 200 to 2,000 times the UMA.

Practical steps (our suggestions)

• Map your Mexican engagements against the five service types in fraction XI.
• Create a client file template that captures identification, activity and beneficial controller details.
• Diarise the 17th of each month for filings and a 24-hour route for suspicion.
• Set a ten-year retention date for records.
• Keep your team up to date. Our CPD courses include financial crime topics.

What we could not confirm

The law text we read was cut off before articles 60 to 65, so we cannot describe the criminal provisions. The SAT FAQ is undated and non-binding, and it did not address accountants by name. We did not read the implementing regulations or general rules, the monetary threshold if any applies to fraction XI engagements, or professional body guidance. Check the current text and the SAT portal before relying on this guide.

Frequently asked questions

Are accountants covered by Mexico's AML law?

When they provide independent professional services of the types listed in article 17, fraction XI.

When are notices due?

By the 17th of the following month, and within 24 hours for suspicion.

How long are records kept?

At least ten years under article 18, fraction IV.

What is a beneficial controller?

Article 3 treats it as equivalent to a beneficial owner.

Explore more country guides in our AML and KYC hub.