Back to all jurisdictions

Mexico

MX · MEX · Americas

1 regulator · 5 laws & regulations · 6 obligations

Mexico is a federal, representative, democratic and secular republic in North America, and its legal tradition is civil law, built on codes.

Overview

Mexico is a federal, representative, democratic and secular republic in North America, and its legal tradition is civil law, built on codes. INEGI's 2025 Intercensal Survey counted 130.9 million people at 15 October 2025. The IMF names the United States, the European Union and Canada as its main export markets and urges Mexico to keep trade open as an engine of growth. Mexico has belonged to the OECD since 1994 and to the WTO since 1 January 1995, and the peso is the monetary unit under the Ley Monetaria.

In its October 2025 Article IV conclusion, the IMF Executive Board described Mexico's fundamentals as strong and its financial system as sound, but called for more ambitious fiscal consolidation to stop public debt rising. It said growth depends on strengthening the rule of law, called for stronger judicial independence and action against corruption and crime, and urged stronger interagency coordination and risk-based supervision against financial crime. The November 2023 national risk assessment names organised crime, illicit proceeds and corruption as the main money laundering threats. Its vulnerabilities include cash, cross-border movements, e-commerce and cyber fraud, public procurement and the informal economy, with virtual assets and ransomware emerging.

Banxico is the autonomous central bank; the CNBV supervises banks and securities markets as a body attached to the finance ministry (SHCP), the CNSF covers insurance and surety, and CONSAR retirement savings. The Unidad de Inteligencia Financiera (UIF) is the financial intelligence unit, and the SHCP supervises non-financial 'vulnerable activities' under the illicit-proceeds prevention law (LFPIORPI). Anti-corruption rests on the Ley General de Responsabilidades Administrativas, the Ley Federal Anticorrupción en Contrataciones Públicas and the Ley General del Sistema Nacional Anticorrupción. The 2025 Ley Federal de Protección de Datos Personales en Posesión de los Particulares replaced the 2010 law and names the Secretaría Anticorrupción y Buen Gobierno as its authority; its transitional provisions pass the former data protection institute's staff and pending cases to that ministry and to Transparencia para el Pueblo.

The Ley General de Sociedades Mercantiles of 1934 lists seven company types, including the sociedad anónima, managed by revocable agents who form a board of directors when there are two or more, and overseen by statutory auditors (comisarios). For listed companies, the Ley del Mercado de Valores sets a maximum of 21 directors, at least 25% of them independent, and requires audit and corporate practices committees of at least three independent directors, with a lower threshold for the practices committee in companies controlled by one person or group. The illicit-proceeds law defines the beneficiario controlador, requires obliged persons to identify it for corporate clients, and provides for companies to file share-transfer notices and beneficial-controller information in an electronic system run by the Secretaría de Economía (Arts. 33 Bis and 33 Ter). The law does not say whether that system is open to the public.

In the sources reviewed, banks apply United Nations Security Council designations through the SHCP's Lista de Personas Bloqueadas, passed to them through the CNBV under Article 115 of the Ley de Instituciones de Crédito. Under the general provisions published in April 2014, listing grounds include the lists derived from Security Council resolutions 1267 (1999) and 1373 (2001), and designations by other authorities. A credit institution that finds a match must suspend operations with the person at once and report within 24 hours. The sources reviewed do not describe a separate autonomous or regional sanctions regime. United States measures also reach Mexican firms: a State Department notice published on 20 February 2025 designated cartels including the Cartel de Sinaloa, the Cartel de Jalisco Nueva Generación and the Cartel del Golfo as Specially Designated Global Terrorists, and on 25 June 2025 FinCEN issued orders barring covered US financial institutions from transmittals of funds to or from CIBanco, Intercam Banco and Vector Casa de Bolsa, which it found of primary money laundering concern.

Essential obligations

All obligations →
Obligation Timing Regulator Source Detail
Adopt an integrity policy (weighed in corporate liability) — — source
Lawful basis, privacy notice and data subject rights At collection and on request — source
Notify data subjects of security breaches Immediately (no fixed period stated) — source
Retain identification and reported-operation records At least 10 years — official
Put in place measures to prevent and detect money laundering and terrorist financing (fintech institutions) — — official
Report suspicious operations within 24 hours (vulnerable activities) Within 24 hours of suspicion — official

Quick links — official sites

Newsletter

Get CRCGS Weekly

A free weekly email from the Centre for Risk, Compliance & Governance Studies: the week's regulatory news, new regulations, updated country profiles, and the Knowledge Hub's latest reading and events.

Free. We first email you a link to confirm the address; you can unsubscribe at any time. How we handle your address: our Privacy Policy.