Mexico mandates full KYC for Bitcoin and crypto transfers by March 2027

Mexico’s Ministry of Finance and Public Credit (SHCP) has published amended anti-money laundering rules that will require full identity verification for every Bitcoin and crypto transfer in the country starting March 1, 2027. The updated General Rules to the Federal Anti-Money Laundering Law, released in early August 2026, represent the most significant expansion of crypto compliance requirements in Mexico since the country passed its landmark Fintech Law in 2018.

The regulations classify virtual asset transactions as “vulnerable activities,” a legal designation that triggers a cascade of compliance obligations for anyone facilitating them.

What the new rules actually require

The framework is built around a risk-based approach, which means entities handling digital assets won’t just collect passports and call it a day. They’ll need to classify every customer by risk level, conduct enhanced due diligence on higher-risk accounts, and identify the ultimate beneficial owners (UBOs) of any entity that holds 25% or more ownership in a transacting party.

That UBO threshold matters. It’s designed to prevent the classic shell-company workaround where someone sets up a legal entity to move crypto without attaching their name to it. If you own a quarter or more of the entity making the transfer, your identity goes on file.

Digital asset service providers will also need to update and submit their internal policy manuals by the March 2027 deadline. These aren’t optional guidelines. They’re enforceable compliance documents that regulators can audit.

Automated monitoring systems for flagging suspicious transactions must be operational by June 1, 2027, giving providers a three-month grace period after the initial rules kick in. Full regulatory audits are expected to begin in 2028.

The regulations also impose requirements around registration, traceability, and custody of digital assets. Every transaction will need a clear paper trail, and custodial arrangements will face new scrutiny.

Building on the 2018 Fintech Law

Mexico passed its Fintech Law in 2018, creating a regulatory framework for digital assets that established licensing requirements for crypto exchanges, reporting obligations, and a general framework for oversight. That law acknowledged digital currencies as electronic payment means but stopped short of classifying them as legal tender.

The 2018 rules had significant gaps. Prior reporting thresholds sat around $3,500, meaning smaller transactions could fly under the radar. The new framework effectively eliminates that cushion by requiring identification data for all transfers, regardless of size.

Non-financial entities engaged in activities like virtual asset exchange and custody are required to register with the SAT (Tax Administration Service) and comply with AML responsibilities. The March 2027 compliance deadline allows market players approximately seven months to adjust their policies and operational systems.