Mexico tightens AML rules and makes risk-based compliance mandatory for betting operators

The Mexican Ministry of Finance and Public Credit has published new General Rules in the Official Gazette under the Federal Law for the Prevention and Identification of Operations with Illicitly Obtained Funds (LFPIORPI). For gaming operators, the point is simple: betting, contests, and lotteries are now squarely within a more detailed AML framework that expects a documented risk model, not just box-ticking.

1. The rules are part of the implementation of amendments to the law and its regulations, published in 2025 and 2026 respectively. They do not create a brand-new regime, but they do sharpen how the existing one is supposed to work and define both the obligations of regulated entities and the powers of the authorities supervising them.
2. Mexico classifies certain lawful sectors as Vulnerable Activities because of their exposure to money laundering risk. Gaming is explicitly included: betting, contests, and lotteries fall into that category, which brings operators directly under the new requirements.
3. The biggest shift is the adoption of a Risk-Based Approach as the guiding principle for compliance. Operators carrying out Vulnerable Activities, including betting businesses, must identify, assess, classify, and document risks tied to their customers or users, transactions, products, services, operating channels, and geographic areas of activity.
4. In practice, this replaces a more uniform compliance model with one that depends on each operator building its own risk matrix and adjusting internal controls accordingly. The logic is straightforward: higher-risk operators are expected to devote more resources and controls to prevention, while lower-risk profiles can apply proportionate measures.
5. The new rules also strengthen the operational basics: customer or user due diligence, identification of the beneficial owner and Politically Exposed Persons, internal controls, record retention, and filing notices with the relevant authorities. For betting operators, that means stricter identity verification processes and a more formal compliance stack overall.