LFPIORPI is the acronym for Mexico's Federal Law for the Prevention and Identification of Transactions with Resources of Illicit Origin (Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita), commonly known as Mexico's anti-money laundering law.
This legislation sets out measures to prevent and detect transactions that may be linked to resources of illicit origin. To do so, it imposes specific obligations on individuals and legal entities that carry out certain economic activities considered likely to be used to introduce illicit resources into the financial or economic system.
But which companies must comply with the LFPIORPI? What are Vulnerable Activities? What obligations does the law establish, and what roles do the SAT and the Financial Intelligence Unit play?
In this article we explain the basic concepts of the LFPIORPI and what companies that carry out Vulnerable Activities need to know.
What is the LFPIORPI?
The Federal Law for the Prevention and Identification of Transactions with Resources of Illicit Origin (LFPIORPI) is the Mexican legal framework focused on preventing and detecting transactions related to resources of illicit origin.
In general terms, the law seeks to establish mechanisms that allow authorities to identify certain transactions and know the people who take part in them.
To achieve this, the LFPIORPI sets obligations for those who carry out certain economic activities, known as Vulnerable Activities (Actividades Vulnerables).
The goal is not only to detect transactions that could be linked to illicit resources, but to establish preventive measures that generate information so authorities can analyze and, where appropriate, investigate transactions that present certain risks.
The regulatory framework has changed recently. In July 2025 a reform to the LFPIORPI was published, and during 2026 new provisions and amendments to the General Rules (Reglas de Carácter General) were issued to develop and clarify the obligations that apply to reporting entities.
For this reason, companies that carry out Vulnerable Activities should stay alert to updates in the regulations and in the criteria issued by the authorities.
What are Vulnerable Activities?
One of the most important concepts for understanding the LFPIORPI is that of Vulnerable Activity.
Article 17 of the law defines which activities are considered vulnerable. According to the SAT, these are economic activities that, by their nature, may offer a path for resources from illicit activities to enter the economic system while seeking to appear legitimate.
The activities covered by the legislation include, among others:
- Gambling, contests and raffles.
- Loan, guarantee or credit transactions carried out by certain parties.
- Services related to construction and real estate development.
- Receipt of funds for certain real estate developments.
- Trading of precious metals and stones, jewelry and watches.
- Vehicle sales.
- Provision of certain professional services.
- Notarial and public attestation services (fe pública).
- Receipt of donations.
- Certain foreign trade services.
- Granting of personal rights to use or enjoy real property (leasing).
- Certain activities related to virtual assets.
The complete list and the specific conditions for each activity are found in Article 17 of the LFPIORPI.
It is important to note that not all Vulnerable Activities follow the same rules. Each activity may have different thresholds, obligations and conditions for identifying clients or filing notices.
That is why determining whether a company carries out a Vulnerable Activity is only the first step. It is also necessary to know the specific obligations that correspond to that activity.
Who does the LFPIORPI apply to?
The LFPIORPI applies mainly to individuals and legal entities that carry out any of the activities the legislation considers vulnerable, under the conditions set out in the law itself and its supplementary provisions.
For example, a real estate development company, a person who performs certain professional activities, or a landlord who falls within the relevant scenarios may be subject to prevention and compliance obligations.
The SAT states that those who carry out Vulnerable Activities must consider the obligations established in Article 18 of the LFPIORPI.
Therefore, having a commercial activity does not automatically mean being subject to every LFPIORPI obligation. It is first necessary to determine whether the activity is covered by the law and then review the applicable scenarios and thresholds.
What are the main LFPIORPI obligations?
Obligations may vary depending on the Vulnerable Activity carried out, but the main ones include:
Registration as a person who carries out Vulnerable Activities
Where applicable, the reporting entity must register, update or deregister in the Registry of persons who carry out Vulnerable Activities, through the Anti-Money Laundering Portal System (SPPLD).
The SAT defines the cases in which registration is required.
Identify clients and users
One of the core obligations is to identify the clients or users with whom the relevant acts or transactions are carried out, and to verify their identity.
This means having information and documentation that make it possible to build and maintain the corresponding client files.
Identify the beneficial owner
Depending on the case, the beneficial owner (beneficiario controlador) must also be identified: the person or persons behind a legal structure, or who exercise effective control or receive the effective benefit under the applicable provisions.
Correctly identifying this figure is an important part of anti-money laundering compliance.
Build and keep client files
The information obtained from clients and users must be compiled and retained in accordance with the applicable provisions.
This can be a challenge for companies that handle a large number of clients, transactions and documents, especially when information is spread across paper files, spreadsheets and different systems.
File notices
In the cases established by the LFPIORPI, reporting entities must file notices (avisos) through the mechanisms set by the authority.
Notices contain information about the transactions and the people involved and must be filed according to the corresponding deadlines and requirements.
It is important not to assume that every transaction automatically triggers a notice. The obligation depends on the activity, the amounts and the conditions set by the legislation.
The SAT and the UIF have published criteria and FAQs to clarify different aspects of filing notices.
Have compliance controls and policies
The applicable provisions also include various control and compliance measures that reporting entities must observe, according to their characteristics and activity.
For this reason, LFPIORPI compliance should not be reduced to filing notices when required.
It is a process that involves identification, documentation, analysis, record retention and transaction monitoring.
What roles do the SAT and the UIF play?
Compliance with the law involves different authorities.
The Tax Administration Service (SAT) plays an important role in supervision and support related to people who carry out Vulnerable Activities. Its portal maintains information on activities, obligations, registrations and various guidance materials.
The Financial Intelligence Unit (UIF), part of the Ministry of Finance and Public Credit (SHCP), takes part in the regime for preventing transactions with resources of illicit origin and in analyzing information related to these transactions.
During 2026, the Ministry of Finance published new General Rules related to the LFPIORPI, aimed at developing the law's provisions and clarifying the obligations of reporting entities, as well as the powers of the authorities responsible for its implementation, supervision and verification.
That is why consulting official sources and staying up to date is essential for companies subject to this regime.
What are LFPIORPI notices?
Notices are one of the mechanisms through which those who carry out certain Vulnerable Activities provide information to the authorities about transactions that fall within the scenarios established by the legislation.
The obligation to file a notice depends on the activity carried out and the conditions established for it.
For example, an activity may have an identification threshold and a notice threshold, which are not necessarily the same.
This means a company may be required to identify its client in certain transactions even if that transaction, on its own, does not necessarily require filing a notice.
Thresholds and conditions must be reviewed specifically for each Vulnerable Activity.
Why is it important to identify clients correctly?
Identifying clients and users is one of the fundamental elements of the anti-money laundering regime.
For a company, this means that knowing a client's name is not enough. Depending on the type of transaction and the applicable provisions, it may be necessary to gather information, documentation and data that make it possible to properly know the person with whom the transaction is being carried out.
In addition, in certain cases the beneficial owner must be identified and the corresponding information kept up to date.
For this reason, having an organized system to manage client files can make compliance tasks considerably easier.
What if my company carries out a Vulnerable Activity?
The first step is to determine exactly what activity the company carries out and under which scenario of the LFPIORPI it falls.
Then it is necessary to review:
- Whether the activity is covered by Article 17.
- The applicable identification thresholds.
- The thresholds for filing notices.
- The requirements for identifying clients and users.
- The requirements related to the beneficial owner.
- Record retention obligations.
- Registration and update obligations.
- The corresponding controls and policies.
- The deadlines and procedures for filing notices.
Because obligations can vary by activity, there is no single list of steps that applies the same way to every company.
NoveraPLD: a tool to organize LFPIORPI compliance
Complying with LFPIORPI obligations can involve managing a considerable amount of information: clients, contracts, transactions, documents, beneficial owners, notices and internal controls.
NoveraPLD is a tool built to help companies that carry out Vulnerable Activities organize and track the different processes related to regulatory compliance.
Its features include tools for managing clients and contracts, recording and tracking transactions, managing client files, controls and policies, risk assessment and generating compliance-related documents.
This way, information stays organized in one place, making it easier to track obligations and reducing reliance on manual processes.
Does your company carry out a Vulnerable Activity?
Knowing the LFPIORPI obligations is the first step. Keeping information organized and following up on compliance obligations is a fundamental part of the process.
Learn about NoveraPLD and see how it can help you organize and track your anti-money laundering compliance obligations.
LFPIORPI frequently asked questions
What does LFPIORPI stand for?
LFPIORPI stands for Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita, Mexico's Federal Law for the Prevention and Identification of Transactions with Resources of Illicit Origin.
What is Mexico's anti-money laundering law?
The term "anti-money laundering law" is commonly used to refer to the LFPIORPI, the legislation that sets out measures to prevent and detect transactions related to resources of illicit origin.
What are Vulnerable Activities?
They are the economic activities listed in Article 17 of the LFPIORPI that, under certain scenarios, are subject to specific prevention and identification obligations.
Must every company comply with the LFPIORPI?
No. Obligations depend on whether the individual or legal entity carries out any of the activities covered by the legislation and on the applicable scenarios, conditions and thresholds.
Which authority supervises Vulnerable Activities?
The SAT has functions related to registration, guidance and supervision of those who carry out Vulnerable Activities, while the UIF takes part in the prevention regime and in analyzing information related to transactions with resources of illicit origin. Specific powers depend on the applicable legislation and provisions.
What is an LFPIORPI notice?
It is the information that those who carry out certain Vulnerable Activities must file when the scenarios established by the legislation for filing it are met.
What is a beneficial owner?
It is the person or persons who, under the applicable provisions, exercise control over or receive the effective benefit of a legal entity, structure or arrangement. Identifying them is part of the obligations of certain reporting entities.