August 10, 2026
On August 7, 2026, Agreement 115/2026 was published in the Federal Official Gazette, through which the Ministry of Finance and Public Credit amends, adds to, and repeals various provisions of the General Rules issued under the Federal Law for the Prevention and Identification of Transactions with Illicit Proceeds. This is a structural amendment that adds seven new chapters and completes the regulatory framework begun with the July 2025 amendment to the Law and the March 2026 implementing regulations.
Who is affected by this change
The amendment reaches all individuals and legal entities that carry out any of the vulnerable activities listed in Article 17 of the Law, as well as those conducting such activities through trusts or other legal arrangements, virtual asset service providers, notaries and public brokers, non-profit associations and companies, and collegiate entities. It likewise affects designated compliance officers and those who provide audit services in this field.
Principal changes
The rules applicable to trusts and other legal arrangements have been completed. A specific enrollment and registration procedure is created for parties acting through these structures, with dedicated schedules for identifying their members and an obligation to use the advanced electronic signature associated with the tax identification number of the arrangement itself. Particular criteria are also established for identifying the beneficial owner of a trust, requiring the chain of ownership and control to be traced upward until an individual is identified.
A risk-based approach chapter has been incorporated, differentiating by sector, by type of commercial relationship, by activity, and by client or user. Each obligated party must design and implement its own risk assessment methodology and classify its clients as low, medium, or high risk. The practical consequence is that obligations are no longer uniform: low risk allows simplified identification measures, medium risk requires a complete identification file, and high risk imposes enhanced due diligence, including information on the source and destination of funds and approval by a senior officer where the client is also a politically exposed person.
The content of compliance manuals is now specifically defined. The Internal Policies Manual must be in place within ninety calendar days following enrollment and registration, and the rules list fourteen minimum sections it must contain, among them risk classification mechanisms, due diligence measures by client risk level, enhanced monitoring of politically exposed persons, detection of transactions that depart from the client’s expected transaction profile, and internal control, supervision, and audit mechanisms.
Auditor certification requirements and the circumstances in which each modality applies have been clarified. The annual compliance review may be conducted by the internal audit or internal control function where the obligated party’s risk is assessed as low or medium, provided that the personnel are independent from the designated compliance officer and can evidence annual training. Where the risk is assessed as high, or where the obligated party so elects, the review and opinion must be issued by an independent external auditor, who must hold a university degree and professional license in the specified fields, have at least three years of experience in the field, and hold a current certification granted by the Financial Intelligence Unit. The audit opinion must be delivered no later than the last business day of March.
Staggered effective dates
The new provisions take effect on November 30, 2026, except for a significant group of obligations that become enforceable on March 1, 2027, among them the risk assessment methodology, its incorporation into the Internal Policies Manual, client risk classification, the client knowledge policy, the beneficial owner identification procedure, and personnel selection procedures. Each company should use these timeframes to determine precisely which provisions apply to it and what adjustments it must implement at each stage.
It will be essential to review and, where appropriate, adjust compliance programs to ensure alignment with the new provisions. Our team remains at your disposal to address any questions regarding the scope of these amendments and their practical implications.
Sincerely,
Diana Rangel
drangel@basham.com.mx
Regina Ocejo
rocejo@basham.com.mx
Ricardo Tagle
rtagle@basham.com.mx