LFPIORPI: Mexico’s Federal AML Law

LFPIORPI is not a standalone crypto licensing law. It is an AML/CFT identification and notice regime that brings certain crypto-asset activity into Mexico’s broader vulnerable-activities framework. Covered persons may need to identify clients and users, gather beneficial ownership information where applicable, register or update their vulnerable-activity status through the official portal, retain supporting documentation, and present notices to the Secretaría de Hacienda y Crédito Público.

• Virtual-asset scope: Article 17(XVI) covers habitual and professional exchange, purchase or sale facilitation, custody, storage, and transfer services for virtual assets by persons other than financial entities.
• Notice thresholds: the current consolidated text requires notices when a customer operation equals or exceeds 210 times the daily UMA value, or when service consideration equals or exceeds four times the daily UMA value.
• Suspicion notices: Article 18 requires a notice within 24 hours when the regulated person has facts, indications, or suspicion that resources may be linked to covered illicit-source offenses.
• Recordkeeping and registration: Article 18 includes duties to keep supporting information and documentation for at least ten years and to register, update, or deregister through the official vulnerable-activities registry.

The statute is in force, but some 2025 reform obligations are still phase-in dependent. The July 2025 decree generally entered into force on July 17, 2025. However, the new risk-based obligations in Article 18 sections VII through XI take effect on the dates set in updated general rules. SAT and UIF guidance states that the pre-existing regulation and general rules continue to apply until those instruments are updated.

The official anti-money-laundering portal also lists a March 27, 2026 reform to the LFPIORPI regulation. As of this draft’s verification date, the same official source still listed the general rules reforms through the Nov. 30, 2020 amendment, making the next key review item the general-rules update contemplated by the 2025 statutory reform.

Mexico treats the covered virtual-asset activities as part of its AML vulnerable-activities regime rather than as a general authorization to offer crypto products. SAT guidance states that persons other than financial entities that provide exchange platforms, wallets, purchase-and-sale sites, ATMs, or digital platforms for virtual assets may be supervised by SAT for this activity. Separate fintech, banking, payments, consumer, tax, and securities questions may apply outside this profile.

The law also distinguishes the treatment of financial entities from the treatment of non-financial vulnerable activities. Financial entities remain subject to the AML provisions in their sectoral financial laws, while Article 17 captures listed non-financial activities, including the virtual-asset activity added through Mexico’s fintech-law reform process.

This profile should be read as a legal-reference summary, not legal advice. Editors should verify any updated SAT forms, general rules, UMA amounts, and regulator guidance before publication because the 2025 reform changed statutory thresholds and the implementation materials may be updated independently of the consolidated statute.