July 2025: amendment to the Law. March 2026: amendment to the Regulations. Today, August 7, 2026, theAgreement amending the General Rules of the LFPIORPI—the regulatory provision needed to set the implementation timeline for the new obligations—was published in the Official Gazette of the Federation (DOF).
This is no minor adjustment.
The new Rules provide operational guidance on the obligations incorporated into Article 18 of the LFPIORPI in 2025 and significantly modify the compliance model applicable to those who carry out Vulnerable Activities.
Among other topics, they include new chapters on risk-based approaches, risk classification of customers and users, know-your-customer (KYC) requirements, Politically Exposed Persons (PEPs), beneficial owners, the Internal Policies Manual, training, automated mechanisms, and auditing.
The regulations will generally take effect on November 30, 2026, but compliance will be phased in: certain obligations will become enforceable during 2027, and the first annual period subject to audit will run from January 1 to December 31, 2028.
For those engaged in Vulnerable Activities, this means something very specific: the period of “waiting for the rules to be released” is over. The implementation phase begins.
Among other actions, it will be necessary to develop the risk assessment methodology, classify the customer portfolio, update the Internal Policies Manual, establish enhanced procedures for higher-risk customers and PEPs, implement automated mechanisms, and prepare training and audit processes in accordance with the new schedule.
We are preparing a comprehensive analysis of the new rules, including the compliance timeline and the specific actions that should be taken by each deadline.
Does your company engage in any “Vulnerable Activities” as defined by the LFPIORPI?
It will be interesting to see how they are approaching this new system.
For more information on the amendment to the LFPIORPI Regulations, visit
