2025 marked a turning point in Mexican financial supervision. The CNBV not only broke every record for PLD sanctions since records began (2019), but did so in an accelerated and systematic way. The question every regulated institution must answer is: why are we being sanctioned if we are not committing fraud?
The uncomfortable answer is that the problem isn't with operations but with how they are documented. Incomplete files, manual processes without traceability and the absence of automated systems are currently the first cause of sanction in Mexico.
1. The record year: historic series 2019-2025
The growth of sanctions isn't an isolated event. It's been a trend that's been consolidating with a dramatic acceleration for years in 2024 and 2025.
| Year | Penalties | Total (MXN) | Variation | Context |
|---|---|---|---|---|
| 2019 | 297 | $50.7 M | — | Base line |
| 2020 | 241 | $112.2 M | +121% | Pandemia, remote monitoring |
| 2021 | 422 | $125.0 M | +11% | Post-covid Recovery |
| 2022 | 383 | $102.1 M | −18% | Relativa estabilidad |
| 2023 | 290 | $80.1 M | −21% | Menor actividad sancionatoria |
| 2024 | ~800* | $216.2 M | +162% | Home Intensified scrutiny |
| 2025** | 696 | $411.8 M | +192% | FinCEN case + historic record |
* Enero- December 2024 as Expansion (March 2025). ** November 2025 according to The CEO (November 2025).
2. The trigger: FinCEN case - CIBank, Intercam and Vector
On June 25, 2025, the U.S. Treasury, through the Financial Offences Control Network (FinCEN), appointed three Mexican financial institutions as "Primary care agencies for money laundering" Under FEND Off Fentanyl Act. That was the first time this law was applied and its impact was immediate throughout the Mexican financial sector.
$22 MDD
Combined assets of 3 institutions
$185 mdp
CNBV sanctions published on July 15, 2025
52%
Of the 696 sanctions came after the case
4
Linkages to the designation
| Date | Event | Impact |
|---|---|---|
| 25 jun 2025 | FinCEN appoints CIBank, Intercam and Vector as "primary concern about money laundering." First time FEND Off Fentanyl Act is used. | Prohibition of U.S. banks from operating with these entities as from 21 July 2025. |
| Jul 2025 | CNBV assumed temporary control of CIBank and Intercam. Finance transfers trust businesses to development banks. | Fitch Ratings degrada calificaciones a "grado especulativo". Contrapartes cortaron relaciones. |
| 15 jul 2025 | CNBV publishes formal sanctions against CIBanco, Intercam and Vector for PLD. | A total of 3 institutions have been punished: $185 million pesos. |
| Nov 2025 | President Sheinbaum states that insufficient evidence was found about links with organized crime in Mexican research. | CIBanco is challenging the sanctions in court. The case is still unresolved. |
3. Who was punished: breakdown by type of entity
No figure from the Mexican financial system was exempt. Banks, Sofomes, exchange houses, stockhouses and Sopropos appear on the 2025 sanctions list.
| Type of entity | # Penalties | Total | Highlights |
|---|---|---|---|
| Bank (multiple banking) | 132 | $199 mdp | CIBanco ($52.2M), Intercam ($41M), Mifel ($41M), Ve por Más ($30.9M), Scotiabank ($8.2M) |
| Sofomes | 319 | $77 mdp | Higher number of sanctions. Progreso Cote, Otorgaplus and Capital Haus among those sanctioned. |
| Exchange houses and centers | 138 | $36 mdp | Sector with high vulnerability PLD. 13 public exchange centres and 5 authorized money transmitters. |
| Exchange houses | 12 | $53 mdp | Decreased number but higher average amount. Intercam stock exchange house: $47.9M of total $53M. |
| Sofipos | 43 | $19 mdp | Kubo Financiero ($8.3M), Te Creemos + CAME ($11.6M). Acumulado 2021-2025: $37.6 mdp. |
4. The 9 actual causes of sanctions
Those cases have been documented with specialized journalistic, regulatory and analysis sources, with specific non-compliance and the sanctioned entity indicated.
Mismanagement of client files
The main cause according to Expansion (March 2025). Incomplete, without traceability and with no formal evidence to meet regulator's requirements. The files "are rebuilt every end of the month" generating inconsistencies that have been CNBV easily detects.
Documented case
Bank Autofin ($7.6 mdp) - "Lack of automated systems to preserve records, incomplete files and omission of relevant reports."
No automated systems to detect unusual operations
The CNBV and especially put an end to institutions with no automated tools to identify risk patterns. LFPIORPI 2025 made these systems obligatory since January 2026.
Documented case
Invex was punished for "without an automated system that detects unusual operations or movements from customers." Fines: + $400,000 MXN.
Do not report relevant operations within established deadlines
Article 18 LFPIORPI lays down specific deadlines for reporting to UIFThe 2025 reform reduced the reporting time for suspicious operations to 24 hours. The Sofomes are the sector most affected by this type of non-compliance.
Documented case
Progress Cote, Otorgaplus and Capital Haus have been punished "for not submitting information about the relevant operations that their customers have been performing."
Errors in international transfer and cash use reports
Failed documentation and report of transfers abroad, and acceptance of currency cash above the statutory limit for high-risk operations.
Documented case
Scotiabank ($8.2 mdp) for "errors in international transfer reports, acceptance of cash dollars above the permitted limit and omissions in client verification."
Uncalibrated monitoring alerts
Internal unusual operations detection systems are bad or bad set up for customers' risk profile. They generate warnings that are not properly analysed.
Documented case
Actinver ($5.4 mdp) for "malfunctions in detecting unusual operations and omission of alert analysis generated by its own internal system."
Documentary and manual processes without traceability
Compliance processes depend on specific people, and they have been re-constructed retroactively rather than generated in real time. Regulators have easily detected these inconsistencies.
Documented case
"Documentary dispersion, approvals without clear registration and archives that are rebuilt every end of the month generate inconsistencies that regulators easily detect." - Lemontech, Dec. 2025.
Insufficient identification of the controller recipient
The laxity in processes KYC It allows true owners of capital to be hidden behind complex social and social structures or loans. Reform 2025 lowered the monitoring threshold from 50% to 25% participation.
Documented case
"The laxity in applying processes KYC It allowed true owners of illicit capital to be hidden behind complex social structures or loans. "- Pirani Risk, 2025.
Monitoring lists up to date
The lack of an update to client records and the non-systematic consultation of blacklists (SAT 69-B, OFACINTERPOL, UIF) weakens response capacity and leads to non-compliance with KYC.
Documented case
"The lack of up-to-date monitoring of client and suspicious transaction records has weakened the responsiveness of sanctioned institutions." - Regcheq, ene. 2026.
General internal controls
Absence of a solid framework for monitoring and preventing suspicious operations. It includes both national banks and branches of foreign institutions operating in Mexico.
Documented case
Bank of Welfare ($767,580 for internal control deficiencies) and Morgan Stanley Mexico ($896,200 for lack of internal controls to ensure compliance with their internal standards).
5. What changed in 2025: Reforms LFPIORPI
On 16 July 2025, a Decree amending and supplementing a number of provisions of the Federal Act for the Prevention and Identification of Transactions with Inetidal Promises (LFPIORPI) The first reform since 2013 and its impact are immediate.
Reporting period
Apply to all documentation KYC and operations searches. Be vigilant as from 17 July 2025. Any incomplete file within that period is liable to a fine at a check visit.
5 new obligations Article 18 (Fr. VII-XI)
(VII) Evaluation EBR. (VIII) Manual of documented internal policies. (IX) Annual training required of staff. (X) Internal or external audits where high risks are identified. (XI) Automated monitoring mechanisms - manual compliance is no longer sufficient or legal.
Beneficiaries Controller
Any person with more than 25% participation or effective monitoring should be identified and registered. The registration should be kept up to date. It includes indirect ownership and effective monitoring.
Report time reduced to 24 hours
Unusual or suspicious operations should be notified to the Commission and UIF In up to 24 hours. Before the time was longer. Requires automatic detection tools - impossible to fulfill manually.
Fines up to date UMA
Rango: 200 a 65,000 UMAs. Con valor UMA 2026 de $117.31. Se permite reducción de hasta 50% si el cumplimiento se realiza espontáneamente antes de una revisión regulatoria.
New integrated sectors
Virtual assets (cryptomonedas), real estate development with some amounts, trust, operations from abroad with impact in Mexico and more supervision to PEPs.
6. The actual size of the problem: macroeconomic context
$145 mil M
Estimated washing value in Mexico (INEGI)
+10 M
Reporting of suspicious operations in 2019 (UIF)
1.63%
Mexican GDP (INEGI estimate)
2–5%
Overall GDP whitens every year (FATF)
Money laundering in Mexico represents between 1.63% and 3.6% of GDP according to various estimates by INEGI, FATF (GAFI) and IFAC. According to the 2023 National Risk Assessment of the UIF, between 2019 and 2021 the flow of reported illicit funds reached $43,943 million pesos, a figure that continued to grow to an estimated $145 billion per year according to INEGI.
In this context, the 696 sanctions of 2025 are not a regulatory accident and are the result of monitoring that at last has the instruments, the political will and the international precedent (FinCEN) to be exercised with full force.
7. Why JAAK resolves every point
Each of the 9 documented sanction cases has a direct solution to the platform JAAK. They are not theoretical compliance but operational tools that generate traceability from first contact with the client.
Expedientes incompletos
Automatic generated digital record at every onboarding with biometric, documentary and identity evidence.
Without automated monitoring systems
Automated verification flows with alerts configurable by risk profile from day one.
Unscheduled reports
Native integration with APIs Regulation for real-time notification, consistent with the new 24 hour period.
Beneficiario controlador no identificado
Identification with CURP, INE and face biometrics that automatically register the actual recipient.
Monitoring lists up to date
Real-time automated consultation with SAT 69-B, OFACINTERPOL and UIF with each relevant transaction.
Documentary and manual processes
Retirement end-to-end. Each action of the process is registered with a time seal without retroactive reconstruction.
Conclusion
The 2025 message's clear: CNBV It does not only punish those who wash money. It prevents those who cannot prove that they do not. The difference between both categories lies in the archives, systems and traceability.
Reform LFPIORPI June 2025 leave no room for interpretation: manual compliance is no longer sufficient or legal. KYC and PLD They have been trying to avoid fines and have built up their only valid defence with respect to supervision that came to stay at this level of demand.