The World Trade Center tower in Mexico City at dusk.

Reviewed 24 September 2026.

For companies investing in Mexico, appointing local partners, vetting suppliers, or moving goods through the country, due diligence is no longer a box-ticking exercise. It is a core risk-control function. A counterparty can look clean in every ordinary database while the real risk sits behind it: an undisclosed beneficial owner, an undeclared subcontractor, an unexplained payment intermediary, or a “security” or “route access” fee that masks criminal control.

The U.S. designation landscape changed in 2025, and it has kept changing

In January 2025, Executive Order 14157 established a process for designating certain international cartels as Foreign Terrorist Organizations and Specially Designated Global Terrorists. The designations followed: on 20 February 2025, the State Department designated eight Latin American criminal groups, six of them Mexican cartels. The list has since grown. On 16 July 2026, the Juárez Cartel (La Línea) and Los Viagras were added as FTOs and SDGTs.

The two labels do different work. An FTO designation makes it a federal crime under 18 U.S.C. § 2339B to knowingly provide material support to the group, where the statute’s knowledge and jurisdictional elements are met, and the statutory definition of material support is broad enough to include currency, financial services, lodging, personnel, and transportation. An SDGT designation blocks the group’s property within U.S. jurisdiction and restricts dealings with it.

Support need not be direct. Indirect payments or services may create exposure where those statutory elements are satisfied. Non-U.S. companies may also face U.S. exposure: U.S. dollar clearing, U.S. banks, U.S. persons, insurers or financing may each create a significant U.S. nexus, though jurisdiction remains specific to the authority relied on and to the facts.

Enforcement is no longer theoretical

Eighteen months on, this is not a prediction about how the framework might be used. In May 2025, the Department of Justice unsealed its first indictments containing material-support charges tied to the cartel designations. Those remain allegations unless and until proved.

In 2025, FinCEN issued orders under the FEND Off Fentanyl Act identifying CIBanco, Intercam and Vector as being of primary money laundering concern and prohibiting covered financial institutions from certain transmittals of funds involving them. The orders took effect on 20 October 2025 and carry no stated expiration. In April 2026, FinCEN amended the CIBanco order to authorize transmittals ordinarily incident and necessary for the Government of Mexico to liquidate that institution.

The most instructive matter for commercial readers came in July 2026. Scoular, a U.S. agricultural supply-chain company, entered into a deferred prosecution agreement resolving a charged FCPA conspiracy and agreed to pay more than USD 10 million. Third-party customs brokers had paid over USD 400,000 in bribes to Mexican officials, invoiced back to the company as “reinspection fees”. The Department stated that a portion of those payments benefited individuals associated with a Mexican cartel’s criminal operations, and that the company’s employees were unaware of that connection. The lesson is not about sanctions screening. The risk was not visible in the name of any counterparty. It sat in the payment chain, one layer beyond the brokers the company knew.

Civil exposure runs on a separate track. Under 18 U.S.C. § 2333, U.S. nationals injured by an act of international terrorism may sue for treble damages, and § 2333(d)(2) extends liability to those who knowingly provide substantial assistance to the person who committed the act, where that act was committed, planned or authorized by a designated FTO. Two matters show what corporate support for armed groups has cost, though neither is an award under that provision. Lafarge pleaded guilty in 2022 to conspiring to provide material support to designated terrorist organizations and paid more than USD 777 million in a criminal resolution. Chiquita paid a USD 25 million criminal fine in 2007 in connection with payments to a designated Colombian paramilitary group. Separately, a Florida jury returned a USD 38.3 million verdict against it in June 2024 on Colombian-law negligence claims brought by victims’ families, the federal statutory claims having been dismissed before trial. That verdict is on appeal.

The operating environment

Extortion remains the most frequently recorded offense against businesses in Mexico, and the trend is upward. INEGI’s business victimization survey put the share of businesses that were victims of crime at 27.2 percent in 2023, against 24.6 percent in 2021, and nationally recorded extortion rose 2.3 percent between 2024 and 2025. The cartels have also diversified well beyond narcotics. In May 2025, the U.S. Treasury described fuel theft and crude oil smuggling, known in Mexico as huachicol, as currently the most significant non-drug revenue source for Mexican cartels and other illicit actors. For any operation buying fuel in volume, that raises a question few procurement files answer: where does the product actually come from?

The extractive sector illustrates the wider point. A mining company may know its principal contractor without knowing every haulage provider, labor subcontractor, security provider, fuel supplier or local intermediary beneath it. In January 2026, ten workers were abducted from a mining operation in Concordia, Sinaloa. Nine were confirmed dead over the months that followed. In February, miners demonstrated in Durango, Chihuahua, Sonora, Hidalgo and San Luis Potosí, demanding justice and improved security.

Most Mexican supply chains conceal nothing. But complexity creates opacity, and opacity is where integrity risk survives. A contractor that is infiltrated, taxed, or controlled by a designated group may create material-support or sanctions exposure for the contracting entity and, depending on the conduct, knowledge and control of the parent and the applicable law, potentially for other entities in the group.

What screening does not answer

Standard screening catches the easy cases: named individuals, named entities, obvious list matches. It very often misses the harder ones. OFAC’s 50 Percent Rule treats any entity owned 50 percent or more, directly or indirectly and in the aggregate, by one or more blocked persons as itself blocked, even where it appears on no list by name, and OFAC encourages diligence to establish the ownership behind a counterparty. A clean name search is therefore not the same as a clean counterparty.

A name-screen does not, by design, reveal nominee shareholders, recent or repeated changes of ownership, layered structures, informal control, subcontracted performance, or a payment flow that ultimately benefits a designated group. Screening is a necessary control. It is not a sufficient one, and it does not by itself establish compliance.

Chart of Mexico business crime figures for 2023, with extortion the most frequently recorded crime against businesses.

What enhanced due diligence should establish

A properly scoped review answers the questions that determine real exposure. Who ultimately owns and controls the counterparty, and are legal ownership and practical control the same thing? Is its commercial profile consistent with its stated role, assets, and history? Who will actually perform the work, on which routes, and with which subcontractors and intermediaries? Do local records and media indicate litigation, fraud, corruption, regulatory or criminal exposure? Do the payment flows, unexplained fees, or local access arrangements create indirect sanctions or material-support risk? And if a concern is found, can the company show it was escalated, investigated, assessed, and documented?

In practice that means beneficial-ownership analysis, corporate and public-records review, litigation and adverse-media checks, supplier and subcontractor mapping, site verification, payment-flow analysis, and discreet local inquiries where databases stop short. Much of this work cannot be done from a desk in another country.

Proportionate to the consequence of getting it wrong

Not every counterparty warrants the same depth of investigation. A low-value office supplier is not a multimillion-dollar contractor, a fuel supplier, a security provider, or an intermediary dealing with government on the company’s behalf. The governing question is which relationships could materially harm the company if what it has been told about them turns out to be incomplete. The deeper work belongs to those: significant value, opaque or shifting ownership, unusual intermediaries, government touchpoints, higher-risk geography, or simply an inability to establish who ultimately owns, controls, and benefits.

Four questions before signing

Investigative work in Mexico returns repeatedly to the same point: the difference between the entity on paper and the reality behind it. That difference may lie in a historical shareholder, an undisclosed relationship, a subcontractor, an intermediary, or increasingly the ultimate beneficiary of a payment.

The companies that manage this risk well establish, before a transaction closes or a relationship deepens, who owns the counterparty, who controls it, who performs the work, and who benefits from the money, and can document the basis on which they proceeded. Those questions cannot always be answered by screening a name against a database. Sometimes they require investigation.

Warden Consulting conducts enhanced due diligence in Mexico for companies, investors, compliance teams, and law firms, with a particular focus on cartel, sanctions, and FTO-related exposure.
The record work behind those answers is set out in our guides to how to verify a Mexican company and running a background check in Mexico, and the questions to ask before instructing anyone are in how to hire a private investigator in Mexico.

The firm is led by Mark van Leewarden, a barrister and former detective with three decades of international investigative experience. Inquiries are handled in confidence. This article is general risk commentary and does not constitute legal advice.

Sources

Executive Order 14157, 20 January 2025

U.S. Department of State, Designation of International Cartels

Federal Register notice, 16 July 2026; OFAC Recent Actions, 15 July 2026

18 U.S.C. § 2339B

OFAC FAQ 812

U.S. Department of Justice, 13 May 2025

FinCEN, FEND Off Fentanyl Act orders and FAQs

U.S. Department of Justice, Scoular resolution

18 U.S.C. § 2333

U.S. Department of Justice, Lafarge guilty plea

U.S. Department of Justice, Chiquita resolution, March 2007