Mexico to Require Full KYC on All Bitcoin and Crypto Transfers Starting March 2027

Mexico's Ministry of Finance and Public Credit (SHCP) has issued updated anti-money laundering rules that will mandate full identity verification for every Bitcoin and cryptocurrency transfer conducted in the country from March 1, 2027. Published in early August 2026 as amendments to the General Rules under the Federal Anti-Money Laundering Law, the changes mark Mexico's most significant expansion of crypto compliance requirements since the Fintech Law was enacted in 2018. The regulations classify virtual asset transactions as "vulnerable activities," a legal category that activates a broad set of AML obligations for parties that facilitate them. Under the new framework, digital-asset service providers must adopt a risk-based approach to customer due diligence. Firms will be required to assign risk ratings to all customers, apply enhanced due diligence for higher-risk accounts, and identify ultimate beneficial owners (UBOs) when an individual holds 25% or more of an entity involved in a transfer. The 25% UBO threshold is intended to curb the use of shell companies to move crypto without identifying the individuals behind the transactions. Any person meeting that ownership level must have their identity recorded. Service providers must also update and submit internal policy manuals by the March 2027 deadline. These documents will be treated as enforceable compliance materials subject to regulatory review. Automated systems to monitor and flag suspicious transactions must be in place by June 1, 2027, providing a three-month transition period after the main requirements take effect. Full regulatory audits are expected to begin in 2028. The rules add further obligations covering registration, transaction traceability, and custody arrangements for digital assets. Authorities are pushing for end-to-end audit trails on all transfers, while custodial structures will face heightened scrutiny. Mexico's 2018 Fintech Law introduced a regulatory framework for digital assets, including licensing requirements for crypto exchanges, reporting duties, and supervisory oversight. It recognized digital currencies as an electronic means of payment but did not designate them as legal tender. Regulators have long viewed the earlier regime as incomplete. Previous reporting thresholds were around $3,500, allowing smaller transfers to avoid disclosure. The new rules remove that gap by requiring identification data for all transfers regardless of transaction size. Non-financial entities involved in activities such as virtual asset exchange and custody must register with the SAT (Tax Administration Service) and comply with AML obligations. The March 2027 deadline gives market participants roughly seven months to update policies and operational systems.