Compliance In Mexico: Scope, Risks, And Practical Considerations

Corporate compliance in Mexico is often understood through the lens of tax filings and payroll obligations, with their fixed deadlines, automated reminders, and clear consequences for non-compliance. But a meaningful portion of a company's compliance exposure sits elsewhere: obligations that are not calendar-driven, that require the company itself to determine whether a filing is needed, and which are easy to overlook precisely because no authority will prompt it.

For foreign-owned or internationally connected businesses operating in Mexico, this category deserves dedicated attention.

Foreign investment registry

Companies with foreign participation must register before the National Registry of Foreign Investment and keep that registration current. Updates are not triggered by a fixed deadline, but by events and thresholds: changes in shareholding, capital increases, new activities, or structural modifications. Many companies register at incorporation and never revisit their status, even after years of changes. The registry sends no reminders, and gaps are typically discovered during due diligence or a regulatory review, at which point they require retroactive correction, often with fines attached.

Anti-money laundering filings

Mexico's anti-money laundering (AML) framework requires certain companies to determine whether their activities qualify as “vulnerable activities” under federal law. If they do, reporting obligations to the Financial Intelligence Unit apply, including client identification, transaction reporting, and recordkeeping. The determination is not automatic, and companies must assess their own activities against the statutory list which covers real estate transactions, professional services, and certain financing arrangements, among other items. Many businesses operating in these sectors have never conducted this analysis, leaving them exposed to significant penalties.

Annual shareholders meeting

Mexican corporate law requires companies to hold an ordinary shareholders’ meeting at least once per year. The agenda must cover approval of financial statements, allocation of results, and ratification of management. In practice, particularly in subsidiaries where decisions are made at the parent level, or in founder-controlled companies, this obligation is frequently overlooked. Missing or poorly documented meetings can affect the validity of corporate decisions and complicate future transactions.

REPSE registration and ongoing submissions

Companies providing specialised services to third parties must register before the Registro de Prestadoras de Servicios Especializados u Obras Especializadas (REPSE) – the federal registry created under Mexico's 2021 outsourcing reform. Registration alone is not sufficient, quarterly reports documenting active contracts and the workers involved must also be submitted. The company must determine when a new contract triggers a reporting obligation and manage its own calendar. Lapses expose both the service provider and the contracting company to joint liability for labour and social security obligations.

The common thread

What these obligations share is that they require proactive judgment, not just calendar management. Periodically asking whether a change in structure, activities, or contracts has triggered a new obligation, and building that review into an annual compliance cycle is the most practical way to manage exposure before it becomes a problem.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.