Mexico's Secretariat of Finance and Public Credit (SHCP) published the Reglas de Caracter General (RCG) under the Ley Federal para la Prevencion e Identificacion de Operaciones con Recursos de Procedencia Ilicita (LFPIORPI) in the Diario Oficial de la Federacion on August 7, 2026. The Unidad de Inteligencia Financiera (UIF) issued Comunicado Hacienda No. 65 on August 10, 2026 confirming the gazette publication. The rules operationalize the 2025 reform of the LFPIORPI and the 2026 reform of its Reglamento, and install the Enfoque Basado en Riesgo (EBR), the risk-based approach, as the guiding principle for every obliged entity performing Actividades Vulnerables.
For Mexican law firms, notarios, corredores publicos, real-estate developers, precious-metals traders and the other non-financial obliged entities caught by LFPIORPI Article 18, the publication ends a wait that ran past the statutory one-year deadline of July 17, 2026. It also unlocks the operative obligations of Article 18 fracciones VII to XI, covering automated monitoring, external audits, training and related controls, which stayed dormant until the secondary rules dropped. The UIF communiqué frames the package as alignment with the FATF standard and a consolidation of Mexico's preventive regime.
What changed for obliged entities performing Actividades Vulnerables?
The RCG move Mexican AML compliance from a rules-only checklist to a documented risk-based methodology. Every obliged entity must now identify, assess, classify and document the risks tied to its clients or users, operations, products, services, delivery channels and geographic zones, and calibrate its controls to that risk profile. The communiqué emphasizes that SHCP, through UIF, will itself supervise on a risk-based footing, concentrating verification on the sectors and activities most exposed to laundering.
The rules also strengthen five control pillars: customer due diligence (conocimiento del cliente), beneficial-ownership identification (beneficiario controlador), PEP screening (Personas Politicamente Expuestas), internal controls and record-keeping, and the filing of avisos. A proportional compliance model ties the depth of obligations and supervision to the risk level of each Actividad Vulnerable, so lower-risk actors face lighter duties while high-risk actors carry the full weight.
Which Article 18 duties become operable, and by when?
The RCG set a staggered entry into force. According to the UIF presentation on the RCG, the rules enter into force in November 2026, with a six-month training window for OSFL and other Actividades Vulnerables actors running from that point. Compliance with the new obligations is timed for March 2027, the new avisos layouts take effect in June 2027, the first annual audit period runs through 2028, and the first audit opinion (dictamen) is due by March 2029. Article 18 fracciones VII to XI, which require automated monitoring, audit programs, training and related internal controls, become enforceable on these RCG timelines. Obliged entities that deferred building these systems while the rules were pending must now stand them up inside the transition window.
Who is most exposed, and what should compliance leads do now?
The actors most exposed are the DNFBPs (designated non-financial businesses and professions) that perform Actividades Vulnerables under LFPIORPI: law firms handling transactions or client funds, notarios and corredores publicos, real-estate intermediaries, precious-metals and stone dealers, and the cluster of service providers flagged in the Annex. Because the proportional model concentrates supervisory pressure on high-risk sectors, these actors face the earliest and deepest obligations.
| Obligation | Status before RCG | Under the RCG |
|---|---|---|
| Risk-based methodology (RBA/EBR) | Not codified as binding principle | Mandatory: identify, assess, classify, document risks |
| Beneficiario controlador and PEP screening | Required in principle | Strengthened CDD, beneficial-owner and PEP identification |
| Art. 18 VII to XI (monitoring, audits, training) | Dormant, awaiting rules | Operable on staggered EIF (Nov 2026 RCG in force; Mar 2027 obligations; Jun 2027 layouts; 2028 audit year; Mar 2029 first dictamen) |
| Supervision model | Uniform | Risk-based and proportional to activity risk |
For a compliance lead, the immediate work is to build or buy an RBA methodology that documents client, product, channel and geographic risk; to map every Actividad Vulnerable the firm performs to a risk tier; and to confirm that CDD, beneficiario controlador and PEP workflows are wired into onboarding and periodic review. Teams should also scope automated monitoring, training and external-audit workstreams against the UIF calendar through March 2029 rather than treating them as remote. Continuous, per-jurisdiction monitoring surfaces this kind of secondary-rule drop the moment it publishes in the DOF, which is the difference between starting on the November 2026 EIF and scrambling after it.
Take advantage of this real-time watch
What to do next
Confirm whether your firm performs an Actividad Vulnerable listed in LFPIORPI Article 17 and the Annex, and at what volume threshold. Map your current CDD, beneficial-ownership and PEP controls against the strengthened RCG requirements, and identify the gaps to close before the November 2026 entry into force. Brief your compliance team and, where applicable, your notario or corredor publico networks on the new proportional obligations, and lock training, avisos-layout, monitoring and external-audit workstreams against the March 2027, June 2027, 2028 and March 2029 milestones. The rules text and the UIF presentation are the authoritative references; Obsidian tracks them as they move from publication to enforcement.
