Due Diligence in Mexico: Managing FTO and Cartel-Related Risk

For companies investing in Mexico, appointing local partners, vetting suppliers, or moving goods through the country, due diligence is no longer a box-ticking exercise; it is a core risk-control function. A counterparty can look clean in every ordinary database while the real risk sits behind it: an undisclosed beneficial owner, an undeclared subcontractor, an unexplained payment intermediary, or a “security” or “route access” fee that masks criminal control.

The law changed in 2025 — and has kept changing

In January 2025, Executive Order 14157 brought Mexico-based cartels within the United States' counter-terrorism framework. On 20 February 2025, the State Department designated eight Latin American criminal groups — six of them Mexican cartels — as Foreign Terrorist Organizations and Specially Designated Global Terrorists. The list has since grown: on 16 July 2026 the designations were extended to the Juárez cartel (La Línea) and Los Viagras, carrying the framework further into Chihuahua and Michoacán.

The two labels do different work. An FTO designation makes it a federal crime under 18 U.S.C. § 2339B to knowingly provide material support to the group — and “material support” is defined broadly enough to include currency, financial services, lodging, personnel, and transportation. An SDGT designation freezes the group's U.S. assets and bars U.S. persons from dealing with it. Support need not be direct: paying, supplying, or servicing a designated group through an intermediary can create exposure where a company knew, or was willfully blind to, the relevant facts. Nor must a company be American to be caught. U.S. dollar payments, banks, insurers, customers, or financing can each bring a transaction within U.S. reach.

Enforcement is no longer theoretical

Eighteen months on, this is not a prediction about how the framework might be used. The Department of Justice filed its first material-support prosecutions tied to the cartel designations within months of making them. In 2025, FinCEN identified three Mexico-based financial institutions — CIBanco, Intercam, and Vector — as being of primary money laundering concern and cut them off from U.S. fund transfers; those orders are now in effect.

The most instructive case came in July 2026, when the DOJ announced its first FCPA resolution tied to bribes that benefited a Mexican cartel. Scoular, a U.S. agricultural supply-chain company, agreed to pay more than US$10 million after third-party customs brokers paid over US$400,000 in bribes to Mexican officials — invoiced back to the company as "reinspection fees." The Department later determined that a portion of those payments ultimately benefited individuals associated with a cartel's criminal operations. Two points matter here. Scoular was prosecuted for FCPA conduct, not material support: on the DOJ's own account, the company and its employees did not know where part of the money was going. And that is precisely the lesson. The risk was not visible in the name of any counterparty; it was buried in the payment chain, one layer beyond the brokers the company knew.

The civil side is equally serious. Under 18 U.S.C. § 2333, U.S. nationals injured by acts of international terrorism may sue for treble damages, and liability can extend to parties that knowingly provide substantial assistance. Chiquita — a US$25 million criminal fine and a later US$38.3 million civil verdict — and Lafarge, the first corporation prosecuted for material support of terrorism at a cost of more than US$777 million, remain the reference points for what legacy relationships can cost long after the commercial activity has ended.

The operating environment

Extortion of legitimate business in Mexico is widespread and has been rising, and the cartels have diversified well beyond narcotics. In December 2025, the U.S. Treasury described fuel theft and smuggling — huachicol — as currently the most significant non-drug revenue source for Mexican cartels, moved through complicit brokers and importers. The extractive sector has felt the pressure directly. Mines and their contractors operate in territory where designated groups are active — the July 2026 designations alone extended the list into two significant mining states — and the sector's exposure runs through its supply chain: haulage, fuel, security, labour contractors, site services, and the routes that connect them. In March 2026, the abduction and killing of mine workers in Sinaloa brought that reality into public view and prompted protests across the industry.

For a listed operator, the point is not only the risk to people and production, serious as that is. A contractor that is infiltrated, taxed, or controlled by a designated group is, in legal terms, a potential conduit of material support — and the exposure sits with the parent that engaged it.

What screening does not answer

Standard screening catches the easy cases: named individuals, named entities, obvious list matches. It very often misses the harder ones. OFAC's 50 Percent Rule treats any entity owned 50 percent or more, directly or indirectly and in the aggregate, by blocked persons as itself blocked — even though it appears on no list by name. A name-screen will not detect nominee shareholders, layered ownership, informal control, subcontracted performance, or a payment flow that ultimately benefits a designated group. Screening is a first step. It is not a defence.

Four questions before signing

Investigative work in Mexico returns repeatedly to the same point: the difference between the entity on paper and the reality behind it. A historical shareholder, an undisclosed relationship, a subcontractor, an intermediary, and increasingly, the ultimate beneficiary of a payment.

The companies that manage this risk well establish, before a transaction closes or a relationship deepens, who owns the counterparty, who controls it, who performs the work, and who benefits from the money, and can document the basis on which they proceeded. Those questions cannot always be answered by screening a name against a database. Sometimes they require investigation.

Warden Consulting conducts enhanced due diligence in Mexico for companies, investors, compliance teams, and law firms, with particular focus on cartel, sanctions, and FTO-related exposure. The firm is led by Mark van Leewarden, a barrister and former detective with three decades of international investigative experience. Enquiries are handled in confidence.


This article is general risk commentary and does not constitute legal advice.