What a Sherlock report is for.

Tax substance file for Mexican suppliers

Mexican companies, including subsidiaries of US groups, that deduct expenses and credit VAT on invoices (CFDI) from Mexican suppliers, and the accountants and auditors who support them.

In Mexico a valid invoice is not enough: the buyer must prove the goods or services were actually delivered. Mexicans call this "materialidad"; it has nothing to do with accounting materiality. If SAT finds a supplier lacks assets, staff or capacity, it presumes its invoices cover nonexistent transactions and, once the supplier is on the final list, the buyer has 30 business days to prove the transaction or amend its returns (CFF art. 69-B). Since 2026, invoices must cover real transactions or are deemed false (CFF art. 29-A, fr. IX), and giving tax effect to false invoices carries 2 to 9 years in prison (CFF art. 113 Bis).

Sherlock documents the supplier due diligence layer of the file: SAT identity and tax status, the art. 69, 69-B and 69-B Bis lists, revoked digital seal certificates, REPSE registration and web mentions, for the company and its legal representative before the SAT. The certificate shows the date and time of each search, which helps prove you checked before contracting, not after an audit began.

• The CFDI in XML format and the bank transfer records for each payment
• A written contract with a provable date (fecha cierta), when the transaction calls for one
• Evidence of delivery: delivery receipts, deliverables, reports, photos, minutes
• Prior purchase orders, quotes and the internal approval of the expense
• A short memo on the business reason and why the expense is necessary
• The supplier's positive tax compliance opinion (SAT, IMSS and INFONAVIT)
• Evidence of the supplier's operating capacity: address, staff, assets, permits

Client identification file under Mexico's AML law

Businesses that carry out "vulnerable activities" in Mexico, such as real estate development and sales, vehicle and jewelry dealers, non-bank lenders, property leasing above the legal threshold, armoring, customs brokers, notaries and certain professional services. Also any company whose own KYC policy covers Mexican customers or suppliers.

Mexico's anti-money laundering law (LFPIORPI) lists the activities that are "vulnerable" (art. 17). Anyone who carries them out must identify each client, verify identity with official documents and keep copies, ask for the client's activity based on its SAT registration and identify the beneficial owner (art. 18, frs. I to III). The client file must be built before or during the first transaction (AML Rules art. 12), reviewed at least once a year for ongoing relationships (Rules art. 21) and kept for at least ten years (art. 18, fr. IV). If the client refuses to provide information, you must not proceed (art. 21).

Sherlock gives you the registered name, RFC, tax regime and activity, and the legal representative before the SAT, plus screening against the US and UN sanctions lists and the SAT lists. These are the data points you record and cross-check against what the client hands you. The corporate registry add-on shows incorporation data and the attorneys-in-fact on record.

• Certified copy of the incorporation deed with its registry data
• Proof of address no older than three months
• Power of attorney deed and a valid official photo ID for each representative
• The client's signed statement on its beneficial owner, and that person's ID data
• A politically exposed person (PEP) check, which Sherlock does not run
• Your own risk rating of the client and its expected transaction profile

Beneficial owner identification

Mexican companies that must keep records of their own beneficial owners, businesses with vulnerable activities that must identify their clients' beneficial owners, and US companies that need to know who ultimately owns or controls a Mexican counterparty.

Mexico has two beneficial owner regimes. Tax law requires every Mexican company to obtain, keep as part of its accounting and give SAT accurate, up-to-date information on its beneficial owners (CFF arts. 32-B Ter to 32-B Quinquies). The AML law defines the beneficial owner as the individual who ultimately benefits from or controls the entity, including anyone with more than 25% of the votes (LFPIORPI art. 3, fr. III). Under the amended AML Rules, you look first for owners of 25% or more, then for control by other means, then for the most senior manager (Rules art. 23 Quinquies, applicable to transactions from March 1, 2027).

Sherlock identifies the entity and its legal representative before the SAT and screens both. The corporate registry add-on reads the Public Registry of Commerce for shareholders, directors and attorneys-in-fact recorded in registered acts, and flags corporate shareholders or foreign investment that require going up the ownership chain. The RNIE check shows whether the company is registered as having foreign investment.

• A current copy of the share registry book, because transfers of shares in an S.A. are recorded there, not in the Public Registry
• A signed beneficial owner statement with an ownership chart up to the individuals
• Official ID and tax ID (RFC or foreign equivalent) of each beneficial owner
• Documents for each corporate shareholder in the chain, including foreign ones

Third-party due diligence for US companies

US companies about to sign with a Mexican supplier, distributor, agent, customs broker or contract manufacturer, including nearshoring and USMCA supply chain projects, and the compliance, legal and procurement teams that approve them.

US persons may not deal with sanctioned parties, and OFAC penalties apply even without intent. An entity owned 50% or more by blocked persons is blocked even if it is not listed (31 CFR 594.412). Since 2025 several Mexican cartels are designated terrorist organizations, which raises the stakes of dealing with their fronts (31 CFR 594.201 and 594.204). The FCPA covers bribes paid through intermediaries, and US enforcement guidance expects risk-based due diligence on third parties. OFAC weighs whether you had a risk-based compliance program when it decides how to respond to a violation (31 CFR Part 501, App. A).

Sherlock screens the entity and its legal representative against the US Consolidated Screening List, which includes OFAC's SDN list and Commerce export control lists, and against the UN list. It adds the Mexican tax view a US team rarely sees: SAT status and blacklists. Litigation and corporate registry add-ons show court cases and the owners and directors on record, which you need for the 50% rule.

• An ownership certification and chart up to the individual owners
• A questionnaire on government officials, state ownership and PEP links
• Anti-corruption and sanctions representations and audit rights in the contract
• Business references and a clear explanation of the services and the fee
• Export control classification and end-use information, if you ship controlled items

Specialized services and outsourcing checks (REPSE)

Companies in Mexico, including subsidiaries of US groups, that hire a provider whose own employees perform services or works for them: maintenance, security, cleaning, IT, construction, staffing of specialized projects.

Since 2021 Mexico prohibits subcontracting personnel. Only specialized services or works that are not part of your corporate purpose or main activity are allowed, and only if the provider is registered in the REPSE registry with the Labor Ministry (LFT arts. 12, 13 and 15). Without a valid registration, payments are not deductible and VAT is not creditable (CFF art. 15-D). You are jointly liable for the provider's obligations to its workers (LFT art. 14) and for taxes related to those workers (CFF art. 26, fr. XVI). Registration lasts three years and must be renewed (REPSE Agreement, arts. DÉCIMO TERCERO and DÉCIMO SEXTO).

Sherlock checks whether the provider appears in the public REPSE registry and adds its SAT status and list screening, so you see in one report whether it is registered and in good standing. The certificate records the date of the check, which matters because registrations expire and can be cancelled.

• The REPSE registration notice showing the registration number and the folio of each registered service
• A written contract stating the service, the approximate number of workers and the REPSE number and folio
• Each month: payroll CFDI, proof of payroll tax withholding payment, and IMSS and INFONAVIT payment receipts
• The provider's VAT return and payment receipt for each period you pay

Credit and collateral checks

Companies that sell on credit to Mexican customers, lenders, lessors and factoring firms, and buyers of equipment, inventory or a business from a Mexican seller.

Security interests over movable property are recorded in the RUG registry and take effect against third parties from the time of registration, with priority over unregistered acts (CCo arts. 21, fr. XX, and 29; RRPC arts. 30 and 30 Bis 1). If the asset you buy is already pledged, someone else may have priority. Whoever acquires a business can be liable for its taxes up to the value of the business (CFF art. 26, fr. IV). If the seller later enters insolvency proceedings, transactions in the prior 270 days at prices clearly off market can be set aside (Ley de Concursos Mercantiles, arts. 112 to 115).

Sherlock lists security interests the entity granted that are recorded in the RUG and shows whether SAT lists it for unpaid, firm tax debts (CFF art. 69). The litigation add-on finds commercial collection suits, labor and tax cases. The corporate registry add-on shows liens, court-ordered annotations and insolvency or dissolution entries in the Public Registry of Commerce.

• Recent financial statements and tax returns
• A credit bureau report, with the counterparty's written authorization
• A real property registry search for any real estate involved, which Sherlock does not cover
• Invoices and title documents for the assets, and serial numbers to match RUG entries
• Guarantees, promissory notes or a security agreement, registered in the RUG

Periodic monitoring of counterparties

Anyone with ongoing Mexican suppliers, customers or partners: tax and accounting teams, AML compliance officers and US compliance teams that re-screen third parties.

A clean result today can change tomorrow. SAT publishes the art. 69-B lists in stages, and once a supplier is on the final list you have 30 business days to prove your transactions or correct your returns (CFF art. 69-B, eighth paragraph). Some advisers recommend checking each new list against all suppliers of the last five years. Final 69-B listing can also lead to inclusion in Mexico's blocked persons list, which freezes bank operations (DCG 115 LIC, 71st provision, fr. VII). REPSE registrations expire every three years, AML client files must be reviewed yearly (AML Rules art. 21) and sanctions lists change constantly.

Run a new Sherlock search on each active counterparty at a set frequency and before key events such as renewals, large payments or VAT refund requests. Each new report is dated and sealed, so the series of certificates shows continuous diligence. Compare the new risk level and findings with the previous report and act on any change.

• An updated tax compliance opinion from each key supplier, since a positive opinion is valid for 30 days
• Updated client documents when they expire or change, such as proof of address or powers of attorney
• Notice from the counterparty of changes in ownership, management or address