The most relevant matters addressed by the Rules include the following:

1. Risk-Based approach and customer risk classification: Establish the methodology to be implemented to identify, assess, and mitigate AML/CFT risks, considering various risk factors. In addition, customers must be classified by risk level based on their characteristics and transactional behavior.

2. Customer due diligence and monitoring: Customer due diligence requirements are strengthened through the determination of customers’ transactions profile and the monitoring of their transactions. Enhanced measures are also established for high-risk customers, together with specific requirements for the identification and ongoing monitoring of PEPs.

3. Beneficiary owner: Further develop the procedures for identifying beneficiary owners, including specific criteria and an order of priority applicable to legal entities, as well as the requirement to document the process followed for their identification.

4. Internal policies manual and automated mechanisms: The required content of the Internal Policies Manual is enhanced to include, among other matters, the risk assessment methodology and customer due diligence and monitoring procedures. In addition, automated mechanisms must be implemented to monitor transactions, apply risk classification models, and generate alerts.

5. Training, personnel selection, and auditing: Establish requirements regarding annual AML/CFT training and personnel selection, as well as an annual audit framework to assess compliance with AML/CFT obligations.

6. Suspicion- or Indicia-Based notices: Provide for the filing of Notices concerning activities that may be linked to acts or omissions potentially constituting money laundering offenses, related offenses, or the financial structures of criminal organizations.

7. Trusts: Establish the registration procedures applicable to trusts that carry out Vulnerable Activities.

8. Virtual Asset Service Providers (VASP): Require to submit additional information regarding their Beneficial Owner, commercial application, and legal representative.

9. Transitional regime: The amendments will generally become effective on November 30, 2026, with a phased implementation of the key obligations, as follows:

• As of March 1, 2027: Risk-Based Approach, update of the internal policies manual, customer classification by risk level, customer due diligence, beneficiary owner identification, and personnel selection procedures.
• No later than June 1, 2027: Implementation of automated mechanisms.
• From January 1 through December 31, 2027: First annual training period.
• From January 1 through December 31, 2028: First annual audit review period.
• Within six months following the effective date of the Rules: Update and submission of the information required from VASP.

Finally, we recommend conducting an AML compliance assessment at this stage to identify the necessary adjustments to existing controls and compliance programs, particularly with respect to those obligations that will require information generated during 2026.

Our team is available to assess the impact of these amendments and assist with the necessary adjustments and implementation measures to ensure compliance with the new requirements.

Authored by Altamirano C., Jose Carlos and Vega, Dulce S.