Tier 1: the lender as a vulnerable activity
Anyone who grants credit habitually or professionally without being a financial entity falls under section IV of art. 17 of the LFPIORPI (text amended in the DOF / Federal Official Gazette, July 16, 2025). Their four operational duties:
- Registration in the vulnerable-activities registry (SAT portal) before operating.
- Identification on every transaction — no threshold —: official ID, address, occupation, and the mandatory question about the beneficial owner (are you acting on behalf of someone else?) (art. 18).
- Monthly report for transactions ≥ 1,605 UMA — $188,282.55 with the 2026 UMA ($117.31) —, by the 17th of the following month at the latest, including the aggregation of transactions split up within the same six-month period.
- Custody of the file for 10 years and cooperation with the UIF (Mexico's Financial Intelligence Unit) / SAT in inspections.
The cost of ignoring it is counted per transaction and in UMA — and worse than the fine is the reading: a portfolio of loans without identification is, in the eyes of any authority, indistinguishable from a laundering machine.
Tier 2: a SOFOM's PLD
If it operates under a SOFOM registration, the lender exits the vulnerable-activities regime and enters the financial-entity regime (LGOAAC art. 95 Bis and its general-provisions rules): a compliance manual, a certifiable compliance officer, a customer risk matrix, reports of relevant/unusual transactions to the UIF through the CNBV, annual training and an audit. Since the recent reform, even registration with CONDUSEF (Mexico's financial consumer protection agency) requires a favorable technical opinion on the matter — PLD is no longer a follow-up formality: it is the front door.
The golden rules common to both tiers
- Cash, the bare minimum: art. 32 LFPIORPI prohibits settling in cash real estate (≥ 8,025 UMA), vehicles, jewelry or shares (≥ 3,210 UMA); loans are not on that list, but disbursing and collecting by transfer is the practice that turns your compliance into evidence.
- Documented source and use of funds: ask where the payment comes from and what the credit is for; keep the answer. The transaction you don't understand is the transaction you don't do.
- Consistency: amounts in line with the customer's profile. The borrower who pays $2M in one go "from a deal that came through" is a 24-hour report (unusual transactions), not good news.
- Collateral counts too: taking as pledge jewelry or a property of murky origin contaminates the transaction — KYC reaches the asset and whoever provides it.
Compliance as a competitive advantage
Looked at closely, the PLD file is the same file as good credit analysis: identity, income, source, use, a contract with certain date (fecha cierta). The firm that does it well not only avoids fines: it builds a sellable and fundable portfolio — banks, funds and portfolio buyers audit PLD before returns. At Tunton that standard is part of the method, not an appendix.