Acuerdo 115/2026: Mexico's New AML Rules Take Effect November 30, and the Compliance Calendar Runs Through 2028

On November 30, 2026, the compliance framework governing every Actividad Vulnerable in Mexico changes. Acuerdo 115/2026, published in the DOF (Diario Oficial de la Federación, Mexico's federal gazette) on August 7, 2026, rewrites the general rules of the LFPIORPI, the federal anti-money laundering law that regulates non-financial businesses performing "vulnerable activities." It is the first full overhaul of those rules since November 2020, and it implements the July 16, 2025 reform of the LFPIORPI at the operational level: risk methodologies, client files, monitoring systems, training, and audits.

Every summary of the Acuerdo quotes the same date: November 30. The date that will actually decide whether an operation absorbs this cleanly comes earlier, and it is buried in the transitional provisions. For a CFO, this is not a legal memo to forward to compliance. It is a multi-year budget item with board-level governance attached, and the budget window for it is the one being drafted right now.

What Acuerdo 115/2026 actually requires

The core of the reform is a shift from checklist compliance to a documented, risk-based system. Obligated entities must design and implement a risk evaluation methodology covering at least four elements: the acts and operations they perform, the types of clients they serve, the countries and geographic zones they touch, and the transaction and distribution channels they use. The methodology is not a one-time exercise. It must be revisited when new risks appear, when the UIF (Mexico's financial intelligence unit) updates the national risk assessment, and in any case within twelve months of implementation results.

That methodology feeds everything downstream. Clients must be classified into at least three risk grades, low, medium and high, re-evaluated at least every six months. Each client gets a transactional profile, built from amount, frequency, geography, origin and destination of funds, and economic activity, with an alert system that flags operations that deviate from it. High-risk clients and Personas Políticamente Expuestas (politically exposed persons) require reinforced due diligence, and in the PEP case, sign-off from a senior executive before the operation proceeds.

The rules also harden the Beneficiario Controlador obligation. Identification now follows a mandatory cascade: first the natural person holding 25% or more of the capital, then whoever exercises effective control by other means, and only as a last resort the senior management position. The procedure must be documented, kept current for the life of the business relationship, and completed before the act or operation, not after.

Around that core, the Acuerdo rebuilds the supporting structure: a Manual de Políticas Internas with fourteen minimum content requirements, annual training delivered by instructors with at least five years of accredited AML experience, personnel vetting with signed declarations, automated mechanisms with six minimum functions including consolidated per-client operation tracking and alert execution, ten-year retention for risk-grade histories, and an annual audit whose results must be presented to the board of directors or its equivalent.

Trade operations are not spectators here. Article 17 of the LFPIORPI lists customs brokerage services for specific categories of goods among the vulnerable activities, alongside real-estate leasing above thresholds, vehicle commercialization, and virtual asset services. Trusts get their own new chapter: entities operating through a fideicomiso must register their members through an XML filing on the SAT portal. If any activity in your Mexican entity is on the article 17 list, these obligations attach to the entity, whatever the size of its compliance team.

The dates that matter, in order

The Acuerdo was signed on July 24, 2026 and published on August 7. Its first transitional article sets the general entry into force at November 30, 2026. From there, the calendar fans out.

March 1, 2027 is the heaviest date on it. Four obligations converge that day. The risk evaluation must be available to the SAT and the UIF on request. Entities already registered must have the methodology written into their Manual de Políticas Internas. The chapters on client risk grading, know-your-customer policy and Beneficiario Controlador identification apply to all acts and operations from that date forward. And every new hire must pass through the new personnel selection procedure, including the signed declaration of no disqualifying record.

June 1, 2027 is the systems deadline: automated mechanisms must be operational, containing the acts and operations performed from that date onward. Nine months after entry into force, around the end of August 2027, the Consulta PEP 2.0 application opens for obligated entities to query the national PEP list. Calendar year 2027 is the first mandatory training period. Calendar year 2028 is the first audit period, and under article 50 the auditor's dictamen must be issued within the first three months after the audited year closes, which puts the first report in your hands by March 2029.

Two quieter provisions deserve a CFO's attention. Virtual asset service providers already registered have six months from entry into force to update their registration information. And the Acuerdo activates an electronic notification regime: once a notice lands in the SAT portal, the entity has three business days to open it before it is deemed served on the fourth, and must check the portal at least every three business days. Missing a served notice is now a process failure, not bad luck.

The trap: the effective date is not the start date

On paper, November 30, 2026 is when the new rules begin. In practice, the second transitional article moves the real start line into the past: the risk evaluation that must be ready by March 1, 2027 has to be built on "the information and factors corresponding to the immediately prior year." The evaluation you hand the authority in March 2027 describes calendar 2026. If your Mexican operation is not capturing client, operation, geography and channel data in a usable form today, the base year is already leaking away. The rules accept partial data only for entities without a full year of activity; an established operation is expected to show the full-year picture.

This is why the Acuerdo belongs in the Q4 2026 budget discussion rather than next year's. The cost lines are identifiable now. Systems: article 41 requires automated mechanisms "reasonably adequate" to the volume, complexity and risk of the operation, which scales the spend but not the six mandatory functions. People: training must come from instructors with five-plus years of accredited experience, and evidence must be retained for ten years. Assurance: an entity whose own methodology grades it low or medium risk may use internal audit; a high-risk grade makes an independent, UIF-certified external auditor mandatory. Your own risk model will decide that invoice. And governance: the audit result goes to the consejo de administración, which makes AML compliance a standing board agenda item from 2028 onward.

In our KYC file work with importers after the 2026 customs reform, one gap repeated across otherwise disciplined operations: the company could produce its corporate structure but not the natural person behind it. In one recurring pattern, ownership ran from the Mexican entity through a foreign holding company into a trust, and no document in the file named a person exercising effective control. Under the new identification cascade, that gap now has a deadline attached, and closing it takes weeks of document work across jurisdictions, not an afternoon.

If you want a second set of eyes on where your Mexican entity stands, talk to a Joffroy expert about mapping your article 17 exposure and the 2027 calendar against your current files.

What to run before November 30

The sequence below is the work we would front-load between now and the entry into force.

1. Confirm scope. Inventory every activity of your Mexican entities against the article 17 catalog, including leasing, vehicle operations, trade services and virtual assets, and verify that registrations on the SAT portal are current.
2. Stand up the 2026 data year. Define the four risk elements now and start capturing client, operation, geography and channel data so the March 2027 evaluation has a defensible base year behind it.
3. Gap-assess the Manual de Políticas Internas against the fourteen minimum contents of article 37 Bis. If you operate as a Grupo Empresarial, decide the centralized-policy question early: the rules reach majority-owned subsidiaries, including foreign ones.
4. Build the Beneficiario Controlador procedure and start collecting on live business relationships. Identification must exist before the operation or at the start of the relationship, and the cross-border document work is the slowest item on this list.
5. Scope the automated mechanisms against the six functions of article 41, with June 1, 2027 as the operational date. The build-versus-buy decision needs to close in 2026 for the system to be live in time.
6. Budget training and the audit. Certified instructors, ten-year evidence retention, and the internal-versus-external auditor decision that your own risk grade will make for you.

We read Acuerdo 115/2026 the way we read every DOF publication that touches the corridor: as operators. Parts of the customs brokerage lane are themselves listed in article 17, and the client identification files we maintain across 190,000+ annual operations at 39+ ports are built to survive exactly this kind of framework shift. The pattern we see is consistent: the operations that absorb a change like this without disruption are the ones that moved the data work upstream before the deadline forced them to.

The five grades that will define 2028

When the first audit cycle closes, every obligation in this framework will be scored on the five-level scale of article 48: cumple, cumple mayoritariamente, cumple parcialmente, no cumple, no aplica. That grade will not be decided in 2028. It will be decided by what your operation builds between now and March 2027, starting with whether the 2026 data year exists at all. The Acuerdo gives you the full calendar in advance. Few regulations are that courteous twice.

When your board asks in Q1 2027 what this framework costs and who owns it, will the answer already be in the budget they approved?

TRADE. UNDER CONTROL.