The Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita, commonly referenced as LFPIORPI, is Mexico’s federal anti-money laundering statute for identifying and reporting transactions that may involve illicit-source resources. The law applies throughout Mexico and is in force. Its original text was published in the Diario Oficial de la Federación on Oct. 17, 2012, entered into force nine months later, and the consolidated text reviewed for this profile shows the latest statutory reform published on July 16, 2025.
For crypto markets, the key provision is Article 17, section XVI. It classifies certain virtual-asset services by non-financial entities as “Actividades Vulnerables,” including habitual and professional exchange through electronic, digital, or similar platforms, and services that custody, store, or transfer virtual assets. The current text also reaches covered operations carried out with Mexican citizens from another jurisdiction.
Key provisions for virtual assets
LFPIORPI is not a standalone crypto licensing law. It is an AML/CFT identification and notice regime that brings certain crypto-asset activity into Mexico’s broader vulnerable-activities framework. Covered persons may need to identify clients and users, gather beneficial ownership information where applicable, register or update their vulnerable-activity status through the official portal, retain supporting documentation, and present notices to the Secretaría de Hacienda y Crédito Público.
- Virtual-asset scope: Article 17(XVI) covers habitual and professional exchange, purchase or sale facilitation, custody, storage, and transfer services for virtual assets by persons other than financial entities.
- Notice thresholds: the current consolidated text requires notices when a customer operation equals or exceeds 210 times the daily UMA value, or when service consideration equals or exceeds four times the daily UMA value.
- Suspicion notices: Article 18 requires a notice within 24 hours when the regulated person has facts, indications, or suspicion that resources may be linked to covered illicit-source offenses.
- Recordkeeping and registration: Article 18 includes duties to keep supporting information and documentation for at least ten years and to register, update, or deregister through the official vulnerable-activities registry.
Status and implementation timeline
The statute is in force, but some 2025 reform obligations are still phase-in dependent. The July 2025 decree generally entered into force on July 17, 2025. However, the new risk-based obligations in Article 18 sections VII through XI take effect on the dates set in updated general rules. SAT and UIF guidance states that the pre-existing regulation and general rules continue to apply until those instruments are updated.
The official anti-money-laundering portal also lists a March 27, 2026 reform to the LFPIORPI regulation. As of this draft’s verification date, the same official source still listed the general rules reforms through the Nov. 30, 2020 amendment, making the next key review item the general-rules update contemplated by the 2025 statutory reform.
Jurisdictional impact
Mexico treats the covered virtual-asset activities as part of its AML vulnerable-activities regime rather than as a general authorization to offer crypto products. SAT guidance states that persons other than financial entities that provide exchange platforms, wallets, purchase-and-sale sites, ATMs, or digital platforms for virtual assets may be supervised by SAT for this activity. Separate fintech, banking, payments, consumer, tax, and securities questions may apply outside this profile.
The law also distinguishes the treatment of financial entities from the treatment of non-financial vulnerable activities. Financial entities remain subject to the AML provisions in their sectoral financial laws, while Article 17 captures listed non-financial activities, including the virtual-asset activity added through Mexico’s fintech-law reform process.
Editorial context
This profile should be read as a legal-reference summary, not legal advice. Editors should verify any updated SAT forms, general rules, UMA amounts, and regulator guidance before publication because the 2025 reform changed statutory thresholds and the implementation materials may be updated independently of the consolidated statute.