The anti-money-laundering reform published on July 16, 2025 significantly changed compliance for those who carry out vulnerable activities. On March 27, 2026, the Regulation of the LFPIORPI was amended; that publication was not an amendment to the general rules. Several new obligations of Article 18, sections VII to XI —including a risk-based approach, training, monitoring and audit— will take effect on the dates those rules establish. Therefore, each company must distinguish between obligations already enforceable, duties whose implementation is still pending and internal preparation measures. This guide is general and does not replace the legal classification of each transaction.
First: determine whether there is a vulnerable activity
The LFPIORPI lists activities such as certain games and raffles, cards, non-financial loans, construction or real-estate development, the sale of real estate, metals and jewelry, vehicles, works of art, virtual assets, professional services and public attestation, among others. Each case has rules and, frequently, identification or reporting thresholds expressed in UMA. The analysis must consider the actual transaction, not only the corporate purpose or the tax activity. It must also aggregate acts with the same person when the law and the rules require it. If there is a vulnerable activity, it is appropriate to review the registration, representative, files, restricted means of payment and the reporting calendar on the specialized portal.
The compliance program was expanded
The reform incorporated duties of risk assessment, internal policies, personnel screening, annual training, automated monitoring mechanisms, enhanced monitoring of politically exposed or high-risk persons, and internal or external audit as applicable. The Second transitory provision identifies 2026 as the first annual period, but the Third transitory provision provides that the obligations of Article 18, sections VII to XI, will take effect within the periods the general rules establish. Therefore, the reference to 2026 must not be presented as automatic enforceability while those rules have not set those periods. The ten-year retention period is different, applicable to the acts or transactions carried out since July 17, 2025. While the applicable rules are published and verified, the company can prepare methodology, owners, data and controls, without presenting a deferred obligation as being in force.
Ordinary reports and 24-hour alerts
Ordinary reports are filed, in general, no later than the 17th day of the month following the transaction that originates them. The legal reform added a report within 24 hours when there are facts or indications of possible links to illicit operations, even if the act or transaction was not completed. Article 7 Bis of the amended Regulation provides for reporting the attempt with the available data that identify the person; however, its Fifth transitory provision conditioned that modality on the updating of the official forms. Before operating the expanded scenario, it must be verified that those forms are already in force, without failing to attend to the 24-hour reports enforceable under the current rules. The file must record identification, analysis, decision, filing, acknowledgment and follow-up, without improperly informing the client.
Key points
- The classification depends on the actual transaction, the thresholds and aggregation, not only on the declared line of business.
- The decree places the first annual period in 2026, but the enforceability of the obligations of Article 18, sections VII to XI, depends on the periods the general rules establish.
- Documentation of clients and transactions must be kept for ten years.
- The expanded 24-hour report for uncompleted attempts requires verifying that the official forms provided for by the Regulation are in force.
What to review
- Update the matrix of vulnerable activities, thresholds, aggregation and cash restrictions.
- Prepare the risk assessment, manual, training, monitoring and audit, and verify in the current rules which obligations are already enforceable.
- Implement a confidential alert protocol and confirm that the official forms allow filing the expanded 24-hour report.