Controlling beneficiary: the obligation that can cost you more than an audit

There is a tax obligation that most Mexican companies believe they have covered with the incorporation deed and the shareholders' IDs. They do not. And the fines are not measured in thousands of pesos but in millions — per beneficiary and per infraction.

What the CFF requires, exactly

Since 2022, articles 32-B Ter, Quáter and Quinquies of the CFF (Federal Tax Code) require all legal entities, trustees, settlors and beneficiaries of trusts (fideicomisos) to identify, obtain, keep and maintain up to date the information on their controlling beneficiary — and to hand it to the SAT when it requests it, within 15 days.

The controlling beneficiary is not "the majority shareholder." It is the individual who ultimately benefits or exercises control: whoever can impose decisions at the shareholders' meeting, appoint or remove administrators, or exercises voting rights over more than 15% of the capital — directly or indirectly. If your shareholder is another company (a holding, for example), the obligation requires you to make the entire chain transparent all the way down to flesh-and-blood individuals, wherever they are.

The real file, not the simulated one

Complying does not mean having a list of shareholders. Rule 2.8.1.20 and following of the RMF (the annual tax regulations) detail a file for each beneficiary: full identification, documented chain of ownership and control, percentages, determination dates, and a documented internal procedure for how the company identifies and updates that information. Every corporate change — a shareholders' meeting, a sale of shares, a new board, a relevant power of attorney — requires updating within the following 15 days.

What it costs not to do it

• Failing to obtain, keep or present the information: a fine of more than $1.6 million pesos per controlling beneficiary (art. 84-N, section I, CFF — amounts updated via Annex 5 of the RMF).
• Failing to keep it up to date: fines close to one million pesos per beneficiary (section II).
• Presenting it incomplete or inaccurate: more than half a million per beneficiary (section III).
• The operational blow, new in 2026: non-compliance triggers a negative compliance opinion. Without a positive opinion you cannot contract with the government, you lose corporate clients that require it, and banks close their doors to you. The fine hurts once; the negative opinion hurts every month.

Do the arithmetic with your own company: three poorly documented individual shareholders are not a fine — they are potentially more than $5 million pesos under the harshest section.

The cases that get complicated (and where it pays to get advice)

Structures with holdings — each layer adds indirect-control analysis. Trusts (fideicomisos) — settlors, beneficiaries and members of the technical committee enter the analysis. Foreign shareholders or foreign vehicles in the chain — the Mexican obligation does not stop at the border. And the residual case almost nobody documents well: when no beneficiary can be identified under the law's criteria, the rule orders that the sole administrator or the members of the board be recorded as such — a decision that must be documented, not assumed.