Is your business a "vulnerable activity" without knowing it? The anti-money-laundering identification and reporting thresholds

The Anti-Money-Laundering Law (Ley Antilavado — formally the LFPIORPI) is not just for banks: its art. 17 turns a list of perfectly ordinary businesses into "vulnerable activities" — selling real estate, renting out commercial space, lending money, dealing in cars, jewelry or art, building and selling developments, receiving donations, providing notarial services — and imposes two tiered obligations on them: identify the client above a certain amount and report to the authority (through the SAT portal) above another. Thousands of business owners are subject to it and don't know it; the penalties for not knowing are among the most brutal in the system.

The mechanics: two thresholds, two obligations

Each activity in the catalog has (in general) two cutoffs measured in UMA (the daily reference unit, MXN 117.31 in 2026): crossing the first requires you to assemble a client identification file (ID, data, controlling beneficiary if it's a legal entity); crossing the second additionally requires you to file a monthly report with the UIF (Mexico's financial intelligence unit) through the SAT — due no later than the 17th of the following month. Some activities require identification always, with no threshold. And one rule that catches the clever: transactions with the same client are aggregated across six-month windows for threshold purposes — splitting a transaction doesn't take it off the radar; it puts it there with an aggravating factor.

The cases that surprise people most (indicative thresholds in UMA)

• Granting loans or mutuo (a civil-law loan) (without being a financial institution): identification always; reporting from ~1,605 UMA (~MXN $188,000). The business owner who lends from their own treasury or the individual with a portfolio of loans is a vulnerable activity — almost no one is registered for it.
• Renting out real estate: obligations from monthly rents of ~1,605 UMA, reporting from ~3,210 (~MXN $377,000/month) — the commercial landlord of a certain size is in.
• Real-estate brokerage and development: brokers must identify the client in every purchase-and-sale transaction; developers have their own category and reporting threshold.
• Vehicles (~3,210 id / ~6,420 report), jewelry and metals (~805 / ~1,605), works of art (~2,410 / ~4,815), armoring, cash-in-transit, prepaid cards, gaming and raffles, professional services that handle client funds, notarial services, donations received by non-profits, and virtual assets.

The exact multiples per subsection come with fine print (moderate confidence in each individual figure on this list — the complete, current catalog should be verified against the SAT AML portal and the text of the LFPIORPI, both linked; the general architecture described here is high confidence).

What being in means — and what staying out costs

The obligated party enrolls in the registry of vulnerable activities, appoints a compliance officer where applicable, assembles files, files monthly reports (or "zero" reports when applicable) and retains documentation for 5 years. The penalties for not registering, not identifying or not reporting are assessed per omitted act and escalate to ranges of thousands of UMA per report — entire portfolios of unreported transactions have produced eight-figure sanctions. The contrast is absurd: compliance is a modest administrative process; non-compliance is a devastating and cumulative liability that also contaminates any tax review (the authority that finds you outside the AML registry already knows how to start the next conversation).