Compliance in Mexico: Scope, risks, and practical considerations

For foreign-owned or internationally connected businesses operating in Mexico, this category deserves dedicated attention.

Foreign investment registry

Companies with foreign participation must register before the National Registry of Foreign Investment and keep that registration current. Updates are not triggered by a fixed deadline, but by events and thresholds: changes in shareholding, capital increases, new activities, or structural modifications. Many companies register at incorporation and never revisit their status, even after years of changes. The registry sends no reminders, and gaps are typically discovered during due diligence or a regulatory review,  at which point they require retroactive correction, often with fines attached.

Anti-money laundering filings

Mexico's anti-money laundering (AML) framework requires certain companies to determine whether their activities qualify as “vulnerable activities” under federal law. If they do, reporting obligations to the Financial Intelligence Unit apply, including client identification, transaction reporting, and recordkeeping. The determination is not automatic, and companies must assess their own activities against the statutory list which covers real estate transactions, professional services, and certain financing arrangements, among other items. Many businesses operating in these sectors have never conducted this analysis, leaving them exposed to significant penalties.

Annual shareholders meeting

Mexican corporate law requires companies to hold an ordinary shareholders’ meeting at least once per year. The agenda must cover approval of financial statements, allocation of results, and ratification of management. In practice, particularly in subsidiaries where decisions are made at the parent level, or in founder-controlled companies, this obligation is frequently overlooked. Missing or poorly documented meetings can affect the validity of corporate decisions and complicate future transactions.

REPSE registration and ongoing submissions

Companies providing specialised services to third parties must register before the Registro de Prestadoras de Servicios Especializados u Obras Especializadas (REPSE) – the federal registry created under Mexico's 2021 outsourcing reform. Registration alone is not sufficient, quarterly reports documenting active contracts and the workers involved must also be submitted. The company must determine when a new contract triggers a reporting obligation and manage its own calendar. Lapses expose both the service provider and the contracting company to joint liability for labour and social security obligations.

The common thread

What these obligations share is that they require proactive judgment, not just calendar management. Periodically asking whether a change in structure, activities, or contracts has triggered a new obligation, and building that review into an annual compliance cycle is the most practical way to manage exposure before it becomes a problem.

---

Mauricio Saul Ramos, Consulting Director at Guerrero Santana, has more than 15 years of experience advising domestic and international clients on a wide variety of matters. He is also a professor at the undergraduate level teaching courses like Innovation, Project Feasibility, and Strategic Planning.