Mexico mandates full KYC for all crypto transfers by March 2027

Mexico's Ministry of Finance and Public Credit will require full identity verification for every Bitcoin and cryptocurrency transfer starting March 1, 2027, under new General Rules published in the Official Gazette of the Federation.

"The reform provides greater legal certainty and a homogeneous application of provisions," the SHCP said in its announcement, framing the rules as an alignment with Financial Action Task Force recommendations.

The framework introduces 112 modifications across 12 compliance areas, including mandatory risk-based customer classification, beneficial ownership identification for entities holding 25 percent or more, and automated transaction monitoring by June 2027. Regulatory audits begin in 2028.

The rules expand on Mexico's 2018 Fintech Law, closing previous gaps that allowed transfers below certain thresholds to bypass identification. Providers face higher compliance costs and must implement automated monitoring systems, with the first formal audit opinions due by March 2029.

112 Modifications Across 12 Compliance Areas

The General Rules establish a mandatory Risk-Based Approach for entities performing designated Vulnerable Activities, replacing uniform compliance protocols with risk-proportional obligations. Companies across real estate, cryptocurrency, trust services, and non-profit sectors must implement structured risk management methodologies, enhanced due diligence, and automated monitoring systems aligned with FATF standards.

Obligated entities must also establish an Internal Policies Manual, institute employee selection and training protocols, and implement electronic notification systems. The provisions create specialized controls for trusts, legal arrangements, and Non-Profit Organizations, alongside a mandatory 24-hour urgent notice mechanism for high-risk operations.

The shift follows a 15 percent drop in vulnerable activity notices in the first quarter of 2025 compared to 2024, according to Financial Intelligence Unit data. Notices involving virtual assets fell 57 percent year-over-year following July 2025 threshold adjustments, while service and credit cards generated over 2.1 million notices and cash custody transfers accounted for 1.3 million notices during the year.

Silvia Matus, Anti-Money Laundering Partner at BHR México, said expanded reporting mandates, lower reporting thresholds, and technological adoption are reshaping how compliance teams submit regulatory alerts to authorities.

Phased Implementation Through 2029

Following the August 2026 publication of the rules, SHCP will publish updated reporting layouts for notices in the Official Gazette in November 2026. The General Rules officially enter into force in March 2027, followed by mandatory adoption of the new reporting layouts in June 2027. Obligated entities will complete their first annual audit period between January and December 2028, with the deadline for submitting the initial formal audit opinion set for March 2029.

The Mexican framework joins a wave of global crypto regulation tightening. Russia signed a sweeping crypto licensing law in July that takes effect September 1, requiring exchanges to register with the Bank of Russia and meet minimum capital of 15 million rubles. The European Union's MiCA framework and the US CLARITY Act, which advanced through the Senate Banking Committee in May, represent parallel efforts to bring crypto trading under formal regulatory oversight.

For crypto exchanges operating in Mexico, the compliance burden is significant. Full KYC on every transfer regardless of size means higher operational costs, more extensive identity verification infrastructure, and continuous transaction monitoring. Privacy-focused users may shift activity to decentralized platforms or offshore exchanges, though the SHCP's risk-based supervision model aims to concentrate enforcement on high-risk sectors.

The first regulatory audits in 2028 will test whether providers have fully adapted their systems. With the initial audit opinions due by March 2029, the next three years will determine how effectively Mexico's expanded AML regime balances financial integrity against the operational realities of digital asset businesses.

This article is for informational purposes only and does not constitute investment advice.