Mexico expands anti‑money laundering oversight with tighter controls on crypto, casinos and real estate

Mexico is extending its fight against money laundering. The country has published new regulations that require a wide range of activities operating outside the traditional financial system to reinforce their controls to identify clients, track transactions and detect possible illicit funds — from real estate developers and car dealers to nonbank lenders, casinos and art and jewelry dealers — with special emphasis on cryptocurrency platforms.

The reform introduces substantial changes for service providers deemed to carry out “vulnerable activities,” and raises the level of information they must collect, retain and share with financial intelligence authorities. The new legislation (LFPIORPI) also imposes new obligations on these firms, such as automated monitoring systems using technology, annual audits and stricter mechanisms to identify the beneficial owner — that is, the person who ultimately owns the majority of, or exercises control over, a business. That translates into greater tracing of the true owners of the money.

The agreement — published by the Ministry of Finance — comes at a time of growing pressure on Mexico to cut the financial flows of criminal organizations. The United States has increased scrutiny of Mexican cartel networks using intelligence, security and resource-monitoring tools. Recently Washington even raised its rewards in an effort to halt the advance of the powerful Jalisco New Generation Cartel (CJNG), designated as a foreign terrorist organization, a classification that significantly increased pressure on the group and its links.

“It is very much in line with the pressure the United States is exerting on cartel finances. But it also reflects Mexico’s commitments to the Financial Action Task Force (FATF),” said Álvaro Vértiz, partner at advisory firm DGA Group. “At root there is a double pressure: multilateral and bilateral, with Washington,” he added.

As a FATF member, Mexico must implement and demonstrate in periodic evaluations the effectiveness of its anti-money laundering standards, measures against the financing of terrorism and against the financing of the proliferation of weapons of mass destruction. That requires not only updating laws and controls but proving that the ecosystem of companies and authorities can identify who moves and controls the money, detect suspicious transactions in progress, freeze and seize assets and prosecute those responsible. In that vein, the rules include specific procedures to better know customers and raise red flags for atypical operations. In practice, this means a greater operational burden for obligated entities, which must follow an implementation schedule between November 2026 and June 2027.

Crypto businesses

One of the most significant changes affects providers of virtual asset services (VASP), such as cryptocurrency exchange and custody platforms, which are singled out in a new section of the agreement. Their obligations are tightened: these firms must keep detailed records of their operations for up to 10 years to ensure the traceability of transactions in bitcoin and other virtual assets. They must also report suspicious activity within 24 hours of identifying an atypical pattern, according to an analysis of the regulation by consultancy Miranda Intelligence.

“In crypto, the major change is that those offering services with virtual assets who are not already regulated as fintechs are now formally subject to the anti‑money‑laundering regime. They will have to register with the Tax Administration Service (SAT), profile their customers, identify the origin and destination of transactions, including crypto wallets, keep files and report suspicious transactions within 24 hours,” Vértiz added.

Increased control over cryptocurrencies responds to a risk that has grown in the offensive against organized crime. Virtual currencies are increasingly being used to move funds between clients and countries quickly, at low cost and with discretion, the Drug Enforcement Administration (DEA) says. As evidence of the escalation, this week a Mexican national pleaded guilty in the U.S. to acting as an intermediary in a scheme to launder about $1.9 million in drug proceeds using bank transfers and cryptocurrencies. The defendant faces up to 20 years in prison, the Department of Justice reported.

According to Chainalysis, a crypto‑ecosystem analytics firm, illicit cryptocurrency transaction volume reached at least $154 billion in 2025, driven by increased evasion of financial sanctions linked to countries such as Iran and Russia, and also by use of crypto to move illicit proceeds across borders.

Hunting down the beneficiary

The authorities’ other major goal is to unravel corporate structures, reducing the anonymity surrounding companies and trusts used to move or conceal assets. Accordingly, entities are required to identify the natural person who actually owns or controls an organization. Among other criteria, they must identify anyone holding 25% or more of shares, exercising control over the company or serving in senior management. The concept of “beneficial owner” is central to the new rules: the goal is not only to know which company is conducting a transaction but to reach the person behind it.

The reform also tightens scrutiny of so‑called Politically Exposed Persons (PEPs) — officials who hold or have held prominent public positions in Mexico or abroad — as well as their close relatives and business partners. These people will be subject to enhanced monitoring to prevent laundering. The category covers heads of state or government, political leaders, senior judicial or military officials, top executives of state‑owned companies and members of political parties. It also includes their spouses, common‑law partners and family members.

Authorities and public bodies must fill a database with detailed information on these public officials and their economic dependents, on a platform administered by the Financial Intelligence Unit (UIF). The information will allow financial institutions and other obligated parties to cross‑check data to strengthen their controls.

In essence the change points in two directions: knowing where the money comes from and knowing who is behind it, even beyond the traditional banking sphere. Now the test for President Claudia Sheinbaum’s administration will be turning the new arsenal of obligations into actual investigations, seizures and convictions.

Sign up for our weekly newsletter to get more English-language news coverage from EL PAÍS USA Edition