Why a Due Diligence Checklist Written Abroad Fails in Mexico
Most due diligence on a Mexican counterparty is run from a checklist written somewhere else. The checklist is not wrong. It asks the right questions. It just assumes a set of records that Mexico does not keep in the form the checklist expects, and it treats silence in a database as an answer.
The result is a file that looks complete and establishes almost nothing. Every box is ticked, the counterparty passes, and the risk that mattered was never in scope.
This article sets out where a standard checklist breaks in Mexico, what to replace each item with, and what a checklist adapted to the country actually contains. It applies whether you instruct our firm or another. It is general information and not legal advice.
The Checklist Assumes Records That Mexico Does Not Keep
A checklist built in the United States or the United Kingdom assumes a national companies register that lists directors and shareholders, a credit file that shows exposure, a court system searchable from one place, and an address that can be confirmed from a desk.
Mexico has a national commercial register. It does not list shareholders. It has courts, but coverage is uneven across thirty-two states and the federal circuits. It has credit bureaus, but they are not open to a third party without consent. It has addresses, and a large number of them are correct on paper and empty in fact.
None of that makes verification impossible. It makes it a different exercise, done with different records, and it is why work that can be finished from a desk abroad is usually work that has not established very much.
Ownership Is Not on the Public Record
This is the single largest gap, and it is where most foreign checklists fail without noticing.
Companies are recorded in the Registro Público de Comercio, which now runs as one national database on the Ministry of Economy's SIGER 2.0 platform, with each company holding an electronic commercial folio. The entry shows incorporation, capital, corporate purpose, the powers granted to officers and registered changes to any of those. It is genuinely useful and it is the right starting point.
It does not show who owns the shares.
Shareholding in a Mexican company lives in three places. The incorporation deed, which names the founding shareholders. Later shareholder assemblies, which record changes and are registered only when the law requires it. And the company's own share register, the libro de registro de acciones, which is a private book kept by the company itself.
Since 2022 companies have been required to identify and keep records on their beneficial controller for the tax authority, and the 2025 anti-money laundering reform tightened that duty. None of it is published. A third party cannot look it up.
So a checklist item reading "confirm ultimate beneficial ownership" cannot be answered by a search. It is answered by obtaining the deed and the subsequent assemblies, reading the capital structure and the powers, mapping the people who appear across the group, and asking the counterparty for the ownership chart and the share book extract as a condition of the deal. Requesting those is ordinary commercial practice in Mexico. Refusal is itself a finding.
The Name Problem Breaks Database Matching
Mexican names carry two surnames, the father's followed by the mother's. They are recorded inconsistently, abbreviated differently across systems, and married women may appear under a maiden name in one record and a married form in another. Accents are dropped. Compound given names are split.
Set that against a country of about 130 million people and a set of very common surname combinations, and a name-only search returns either nothing or far too much. Both look like an answer and neither is one.
What fixes it is an identifier. The CURP is an eighteen-character personal identity code that encodes name, date of birth, sex and state of birth. The RFC is the tax identification. Neither can be looked up by the public from a name, which is the point that surprises people, but either one turns a search from guesswork into a search. A date of birth, a former address, a passport copy or a company connection does much of the same work.
The practical consequence is that the intake stage matters more in Mexico than anywhere else. A checklist that begins with a name and a city is a checklist that will produce a report full of qualifications.
Records Sit State by State, and Much of It Is Paper
Property is recorded in the Registro Público de la Propiedad, which is administered by each of the thirty-two states rather than federally. Litigation runs through state judiciaries and the federal circuits separately. Notarial deeds sit with the notary who drew them and with the state registry where they were recorded.
Digitization varies enormously between states, and completeness varies within them. A company incorporated in 2004 in a state that digitized from 2015 has an electronic folio that begins in the middle of its own history. The earlier record exists, on paper, in a specific office.
A checklist item reading "search litigation" therefore needs a scope: which states, which courts, and over what period. Searching everywhere is not affordable and searching nowhere in particular is not a search. The states that matter are the ones where the subject has actually traded, held office, owned property or lived.
The Tax Lists Almost No Foreign Checklist Reads
The Servicio de Administración Tributaria publishes lists of taxpayers with irregularities under Articles 69 and 69-B of the Federal Tax Code. The 69-B lists are the important ones. They name taxpayers the authority presumes to have issued invoices covering operations that never took place, because the issuer had no assets, personnel or capacity to perform the work invoiced.
In Mexican practice the companies that issue those invoices are called EFOS and the companies that used them are EDOS. The lists move through stages, from presumed to definitive, and a company can appear at one stage and be cleared at another, so the stage matters as much as the appearance.
This is free, public, updated and directly relevant to whether a counterparty is real. It is also almost never on a checklist written abroad, because the equivalent does not exist elsewhere. It is the highest-yield ten minutes in Mexican due diligence. The records and the order worth working through them in are set out in our guide to how to verify a Mexican company.
The related check is simply whether the taxpayer registration exists and is active, and whether the name, the tax identification and the registered address agree with what the counterparty has told you. That comparison costs nothing and catches a surprising amount.
Social Security Is the Fastest Test of Whether a Company Is Real
A Mexican company that employs people registers them with the Instituto Mexicano del Seguro Social and pays contributions. Its compliance position is confirmed by an opinion the company requests about itself, rather than something a third party searches, so it is asked for rather than looked up.
That distinction matters, because it changes the checklist item from a search to a request, and a request made as a condition of the deal.
What it establishes is worth the trouble. A company presenting as an operating business with fifty staff, that has no meaningful registered workforce, is not what it says it is. It may be using a labor intermediary, which is lawful and registrable, or it may have no operation at all. Either way the gap is a question, not a conclusion, and it is a question a data room will not raise on its own.
Litigation Coverage Is Uneven and a Docket Entry Is Not a Judgment
Where court records are searchable, the results need reading rather than counting. A docket entry is a filing. An allegation is not an adjudicated fact. Several proceedings frequently arise from one underlying dispute, so a raw count overstates. An amparo, which is a constitutional challenge, appears as litigation and is often procedural. And labor claims are common enough in Mexico that their presence tells you very little on its own, while their pattern can tell you a great deal.
A checklist that reports "eleven matters found" without resolving each one against the identifiers and reading what it actually is has produced a number, not a finding.
The Data Room Is What the Seller Chose to Show You
This applies everywhere and it applies harder in Mexico, because the external record against which you would test the data room is thinner.
The documents in the room are real. The question a checklist rarely asks is what is not in the room: the contract that was terminated, the subsidiary that was sold last year, the labor matter settled quietly, the supplier that is also owned by the seller's brother-in-law. Those are found by comparing the room against the public record and by asking people, not by reading the room more carefully.
Consent and Data Protection Change What You Can Ask For
Mexico's federal data protection law for private parties governs how personal data is collected and used. The current statute took effect in March 2025 and was reformed in November 2025. In practice it means that checks touching a person's private information run on a lawful basis, usually consent for employment and screening work, and that the scope has to be proportionate to the purpose.
Certain steps are simply outside what any investigator can lawfully do. Bank records are confidential under Article 142 of the Ley de Instituciones de Crédito and reach a private party through no lawful route. Private communications are inviolable under Article 16 of the Constitution and only a federal judicial authority can authorize interception.
A checklist that includes "obtain banking information" as an item is a checklist that will either go unanswered or be answered by someone who should not have answered it. Evidence obtained that way is worthless to you and exposes the party that commissioned it. The equivalent rules for checking an individual are covered in our guide to running a background check in Mexico.
What Screening Platforms Do Well, and Where They Stop
Screening platforms are good at what they are built for. They catch named individuals and named entities on sanctions and watch lists, they surface politically exposed persons, and they run adverse media at scale. Those are necessary controls and they should be run.
What they do not do, by design, is reveal a nominee shareholder, a recent change of ownership, a layered structure, informal control, subcontracted performance or a payment flow that ultimately benefits someone who appears on no list by name. A clean screen is a clean screen. It is not a clean counterparty, and treating it as one is the specific failure that enforcement authorities have been unimpressed by. The sanctions and cartel dimension of it is covered separately in our analysis of cartel and FTO risk in Mexico.
A Checklist That Works in Mexico
Before you start
Get identifiers, not names. For a company: the full legal name including the corporate form, the RFC, the state of incorporation, trading names, known addresses and the names of the people who will sign. For an individual: full name with both surnames, date of birth, CURP or RFC if available, and a former address or a company connection. Decide which states matter and why. Decide what standard the output has to meet, because a board paper and a court exhibit are built differently.
Corporate and tax
Confirm the entry in the commercial registry and read the deed for capital, purpose, officers and powers. Obtain later assemblies where ownership or powers changed. Confirm the taxpayer registration is active and that name, RFC and address agree. Check the Article 69 and 69-B lists, and note the stage. Ask for the ownership chart and the share register extract.
People
Confirm the identity of the individuals behind the entity using identifiers. Confirm that whoever will sign has the power to bind the company for this act, and that the power has not been revoked. Screen for sanctions, watch lists and adverse media in Spanish as well as English, including regional press.
Reality checks
Ask for the social security compliance opinion. Compare the registered address against the operating address. Send someone to look at the premises. Confirm that the activity, the staffing and the equipment match what the company says it does.
Risk and exposure
Search litigation in the states that matter, and read what is found rather than counting it. Check insolvency. Check registered security interests over movable property, which are on a free national registry. Where the question becomes what a counterparty owns and whether a claim could be enforced against it, that is asset tracing in Mexico. Map the subcontractors and intermediaries beneath the counterparty where the sector makes that the real exposure.
The report
Separate verified fact from reported information from inference. Name the sources and the dates. State what could not be established, and what it would take to establish it. A report that answers only the questions it happened to be able to answer, without naming the ones it could not, is not a finished report.
How Long This Takes and What It Costs
Electronic records return in days. Certified copies, older paper records held at a state registry, and anything requiring travel take longer. A focused check on a named company in one state is a small piece of work. A full review with ownership analysis, litigation across several states and site verification is not.
Cost is driven by the number of states searched, whether court and registry files must be examined in person, and whether field work is required. We scope and price the matter before we start, and we say when a further step is worth taking and when it is not.
Where We Come In
Warden Consulting conducts due diligence in Mexico for law firms, investors, lenders, compliance teams and corporations. We are investigating lawyers based at the World Trade Center in Mexico City and we work across all thirty-two states, obtaining records in the states that hold them and sending people to look where looking is the only way to know. That field work is ordinary private investigation work in Mexico.
Our files are supervised by investigating lawyers, and the report separates what is proved from what is reported and what we infer.
Frequently Asked Questions
Can I do due diligence on a Mexican company from abroad?
Partly. The tax record, the commercial registry entry and the 69-B lists can be checked remotely, and they answer a great deal. What cannot be done remotely is the part that most often matters: reading the deeds, obtaining state records that are not digitized, and confirming that premises and activity exist as described.
Is there a public register of company owners in Mexico?
No. The commercial registry shows incorporation, capital, purpose and powers, but not shareholders. Ownership sits in notarial deeds, in later assemblies and in the company's own private share book. Companies must keep beneficial controller information for the tax authority, but it is not published.
What is the SAT 69-B list and why does it matter?
It names taxpayers the tax authority presumes to have issued invoices for operations that never took place. It is free, public and updated, and it is one of the fastest ways to establish that a counterparty is not what it appears to be. Almost no checklist written outside Mexico includes it.
Can you check someone's bank accounts as part of due diligence?
No, and nobody can lawfully sell you that. Bank records are confidential under Article 142 of the Ley de Instituciones de Crédito and are released only to the account holder, to a judicial authority in proceedings where the holder is a party, and to a defined list of authorities.
Do I need consent to run a check on an individual in Mexico?
It depends on the check and the purpose. Employment and screening work on individuals normally runs on a consent basis under the federal data protection law, and the scope has to be proportionate. Corporate and public record work on a company does not require the company's consent.
How is this different from a sanctions screen?
A screen tests a name against lists. Due diligence establishes who the counterparty actually is, who controls it, whether its operations match its representations and what its history should change about the price or the decision. A screen is a necessary control. It is not a sufficient one.
Note
This article describes how due diligence in Mexico works in practice and how we approach it. It is general information and not legal advice. Take advice on your own matter from a qualified lawyer.