The Regulation of the Federal Law for the Prevention and Identification of Transactions with Resources from Illicit Sources is Mexico’s federal implementing regulation for the LFPIORPI anti-money-laundering regime. The official Spanish title is Reglamento de la Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita. It applies nationally and sets operational rules for vulnerable activities, including registration, notices, information retention, and supervisory procedures administered through the Secretaría de Hacienda y Crédito Público, the Unidad de Inteligencia Financiera, and the Servicio de Administración Tributaria.
For crypto-law tracking, the regulation matters because the parent LFPIORPI treats certain virtual-asset services as vulnerable activities. The current law covers habitual and professional virtual-asset exchange, custody, storage, and transfer services provided through electronic, digital, or similar platforms, including certain operations involving Mexican citizens from another jurisdiction. The regulation supplies the procedural layer that determines how notices, registration, verification, alternative compliance methods, and recordkeeping operate.
Key provisions of the Mexico LFPIORPI Regulation
Administrative scope and authorities
The regulation is designed to establish the bases and provisions needed to observe the LFPIORPI. The 2026 reform states that authority powers under the law and regulation are directed toward collecting useful elements to prevent, investigate, and pursue operations involving illicit-source resources and related criminal financing structures.
The regulation allocates important operational powers across the SHCP, UIF, and SAT. It addresses administrative interpretation, official formats, registers of vulnerable-activity participants, receipt of notices and reports, verification visits, information requests, electronic notices, and sanctions. These provisions make the regulation central to how the AML framework is implemented in practice, even though the parent law defines the primary vulnerable activities and sanctions.
Registration, notices, and records
Those carrying out vulnerable activities must use the SAT registration process and official formats, including electronic registration, updates, or deregistration through the relevant portal. The regulation also addresses how the date and value of acts or operations are determined for notice purposes, how certain transactions are accumulated, and how notices can be required even when an operation has not been completed but suspicious facts or indicators exist.
Recordkeeping is a core operational requirement. The regulation, as reformed in 2026, requires vulnerable-activity participants to retain copies of notices and reports, supporting documentation, and electronic acknowledgments for at least ten years. This is directly relevant to virtual-asset businesses because the parent law requires precise information about virtual-asset transactions involving originators, recipients, and, where applicable, beneficial owners.
Crypto and virtual-asset relevance
Article 17, fraction XVI of the LFPIORPI is the main crypto-facing hook. It covers certain virtual-asset exchange and custody-type services conducted outside the financial-entity perimeter and sets notice thresholds based on UMA values. It also defines virtual assets as electronic representations of value used by the public as a means of payment and transferred only by electronic means, excluding legal tender, foreign currency, and assets denominated in those currencies.
The regulation adds a narrower but important notice-coordination point. Article 31 Bis, added in the 2026 reform, provides that where operations meet both covered virtual-asset notice scenarios under Article 17, fraction XVI, only the notice under subsection (a) must be filed. This rule is procedural, not a separate licensing regime, but it helps define how overlapping virtual-asset notice triggers are handled.
Status and timeline
The original regulation was published in the Diario Oficial de la Federación on Aug. 16, 2013, and generally took effect on Sept. 1, 2013. Mexico’s official PLD legal-framework page lists the original regulation and the March 27, 2026 reform, while noting that compiled texts are only informational and that DOF decrees should be used for application of the rule.
The latest reform decree was published in the DOF on Mar. 27, 2026, and its first transitory article provides that it enters into force the day after publication. As of Jun. 30, 2026, this profile treats the regulation as in force, with editor review recommended for future updates to general rules and official notice formats. The parent 2025 LFPIORPI reform required general rules to be modified within twelve months after that decree entered into force, making mid-July 2026 an important review point.