Anti-money laundering efforts are entering a new phase for the Mexican real estate sector. Amendments published by the Secretaría de Hacienda y Crédito Público in the Diario Oficial de la Federación (DOF) will require those engaged in "vulnerable activities" to go far beyond merely compiling files and filing notices; they must now assess client risk, classify clients, and establish procedures to detect transactions that deviate from expected behavior..
For real estate agencies in Puerto Vallarta and Riviera Nayarit—a market characterized by high-value transactions, foreign buyers, trusts, and corporate structures—this change warrants special attention.
Real Estate Agencies Were Already Subject to Anti-Money Laundering Laws
Regular or professional intermediation in the transfer of real estate is classified as a "Vulnerable Activity" under Article 17 of the Federal Law for the Prevention and Identification of Operations Involving Resources of Illicit Origin (LFPIORPI). The law further stipulates that real estate transactions must be reported (via a formal Notice) when they reach the equivalent of 8,025 UMAs..
Based on the 2026 daily UMA value of 117.31 pesos, that threshold equates to approximately 941,413 pesos..
Consequently, a significant portion of routine transactions in the Puerto Vallarta and Riviera Nayarit market far exceeds the amount requiring such a Notice.
The difference now is that compliance is no longer focused solely on identifying the client and determining the transaction's value..
From Customer Identification to Risk Assessment
The July 2025 reform to the LFPIORPI introduced a risk-based approach. The new rules elaborate on this principle, requiring entities engaged in "Vulnerable Activities" to assess and document their exposure to money laundering risks.
In practical terms, companies must classify their clients or users into risk levels—low, medium, or high—based on factors such as their profile, the products or services used, the transaction channels employed, and the geographic areas involved.
This represents a significant shift for real estate companies.
Simply retaining identification, proof of information, and corporate documentation will no longer suffice. Companies must establish internal criteria to address questions such as: Is this transaction consistent with the client's profile? Who is the actual ultimate beneficial owner? Is a Politically Exposed Person involved? Are there elements warranting enhanced monitoring?
The Law itself stipulates that whenever facts or indications give rise to suspicion regarding the origin or destination of funds, a Notice must be filed within 24 hours—even if the transaction does not ultimately take place.
Manuals, training, and monitoring systems
The administrative burden does not end with classification.
Real estate firms subject to these regulations must draft and implement an Internal Policy Manual outlining prevention criteria and procedures. They must also provide annual training for management, compliance officers, and employees who have direct contact with clients.
Furthermore, the law incorporates automated mechanisms to continuously monitor transactions, aggregate amounts, and identify activity that does not align with the client's transactional profile. Clients deemed high-risk or classified as Politically Exposed Persons (PEPs) must be subject to enhanced monitoring.
For a large developer with dedicated legal and compliance departments, establishing these structures may represent a new operating cost. For a small real estate agency or an independent broker, the challenge can be far greater.
Key dates for the sector to keep in mind
Implementation will be phased in.
The new agreement will generally come into effect on November 30, 2026.Starting March 1, 2027, obligated entities must have their risk assessment and updated Internal Policy Manual available; new rules regarding Know Your Customer (KYC) and controlling beneficiaries will also begin to apply on that date.
The deadline for implementing automated monitoring mechanisms is June 1, 2027..
Another new element follows: the compliance audit. The first period subject to review will cover January 1 to December 31, 2028.If the obligated entity itself is classified as high-risk, the review must be conducted by an independent external auditor.
What should a real estate agency do now?
Waiting until March 2027 would likely be a mistake.
Agencies should start by identifying exactly which of their operations qualify as a "Vulnerable Activity," reviewing how they currently compile their files, and determining who will be responsible for compliance. Legal entities carrying out these activities must designate a compliance officer to the authorities; until such a designation is made, responsibility rests with the administrative body or the sole administrator.
It will also be necessary to review contracts, client onboarding protocols, the identification of beneficial owners, document retention practices, and technological tools.
This is no minor obligation. Failure to comply with the obligations set forth in Article 18 can result in administrative sanctions, while failure to file required notices can lead to significantly higher fines.
Furthermore, for agencies that regularly work with international buyers, it will be especially important to establish clear procedures for obtaining foreign documentation and to explain—right from the start—why such documentation is being requested.
How far should a real estate agency's responsibility extend?
Combating money laundering is an essential obligation of the State, and demanding reasonable controls from sectors historically used to move illicit funds makes sense. The problem arises when regulation begins shifting functions onto private companies that increasingly resemble intelligence work.
A real estate agency can identify its client, document a transaction, verify the ultimate beneficial owner, and report inconsistencies. What is questionable is requiring the agency to precisely determine a person's risk level when it lacks the necessary databases, investigative capabilities, and access to State-held financial, tax, immigration, or criminal records.
The question is not whether companies should cooperate; they must. what tools a real estate agency is expected to use to determine that one person poses a medium risk while another poses a high risk, and what liability it will face if that assessment proves incorrect..
In the legitimate pursuit of closing off avenues for money laundering, the government risks turning thousands of businesses into mini financial intelligence units without providing them with the tools such a task demands.
Prevention requires shared responsibility. However, shared responsibility should not mean offloading an essentially public function onto a private entity and then penalizing it for failing to perform that function just as the authorities would.
