Mexico Tightens Anti-Money Laundering Rules for Retail

Regulatory scope for retail and credit

An analysis of Mexico’s retail regulations says financial institutions and merchants that extend credit in the country are subject to LFPIORPI for money laundering prevention, as well as PCI DSS standards for transaction cybersecurity applied to card data. According to the material reviewed, that framework creates technical information security obligations for payment operations.

Personal data and incident handling

The same regulatory review for retailers in Mexico points to the Federal Law on Protection of Personal Data Held by Private Parties, or LFPDPPP, as an applicable framework. That law imposes security obligations, incident management requirements and privacy notices for the processing of personal data, including financial customer data.

Together, those rules leave banks, fintech firms and merchants with credit facing requirements that range from anti-money laundering controls to the protection of information tied to payments and personal data. In the reference material, the obligation is not presented as a single regulatory front, but as a set of controls for operating with cards, retaining information and handling customer data under specific rules.

Framework cited by the analysis

The regulatory reading comes from an analysis published by Pirani Risk on retailers in Mexico. Other materials reviewed for this note include content from CIAL Dun & Bradstreet Mexico, PLD.mx and KYC Systems, all focused on LFPIORPI, vulnerable activities and AML trends in the country, although the verified material for this article is limited to the two points confirmed by Pirani Risk.

Within that framework, the sector’s challenge is simultaneous compliance with anti-money laundering prevention, transaction security standards for cards and personal data protection obligations in the handling of financial customer information.