Missed Flags, Costly Fines: What Mexico’s AML Program Failures Reveal About Compliance Gaps

Where AML controls broke down

How the fines could have been avoided

A compliance wake-up call for institutions everywhere

In July 2025, Mexico’s top banking regulator, the CNBV, issued over 185 million pesos (about US $9.8 million) in fines to three banks for failing to prevent transactions involving US-sanctioned entities. The penalties stemmed from deficiencies in anti-money laundering (AML) controls and screening processes, largely tied to payments allegedly linked to Mexican cartels and fentanyl supply chains. 

These enforcement action followed US Treasury designations alleging that the banks had facilitated cartel-related transactions, placing them in regulators’ crosshairs for compliance breakdowns. The result? Loss of trust, reputational damage, financial penalties, and in some cases, operational disruption. 

What went wrong, and what should Mexican banks do to prevent enforcement actions in the future? 

Where AML controls broke down 

The CNBV’s fines were not based on sanctions screening failures per se, but rather on broader deficiencies in anti-money laundering programs and disclosure obligations.  

Specifically, two banks were cited for failures in their money laundering prevention systems, which typically includes transaction monitoring, internal controls, and suspicious activity detection. In addition, a third bank was fined for omitting required information in its disclosures, a regulatory reporting lapse that can signal weak compliance oversight. 

While the CNBV did not release detailed public findings, these actions suggest systemic issues in how transactions were monitored, escalated, and documented, especially when counterparties may have been linked to illicit networks. 

These are not uncommon weaknesses in financial crime programs. Failure to adequately detect and report suspicious activity, limited internal audit visibility, and reactive rather than proactive monitoring are all risk factors that can lead to enforcement actions.  

How the fines could have been avoided 

Though US Treasury designations brought international attention to the banks’ exposure to cartel-linked entities, the CNBV’s fines mainly focused on ineffective transaction monitoring and a failure to meet regulatory reporting standards. 

To avoid similar enforcement outcomes, institutions must ensure they have robust transaction monitoring frameworks that can detect patterns indicative of illicit activity, including entity structures, high-risk geographies, and unusual counterparties. In addition, clear escalation and reporting processes are helpful for flagging suspicious activity as well as investigating and reporting on them when required. And finally, strong governance and documentation can ensure that audit trails, required filings, and public disclosures are completed in a timely and accurate fashion. 

While advanced technologies like machine learning and real-time analytics can enhance these functions, even the best tools are ineffective without well-designed workflows, good data quality, trained personnel, and a compliance culture that prioritizes early detection and transparency. 

A compliance wake-up call for institutions everywhere 

The penalties issued by Mexico’s CNBV serve as a cautionary tale for any financial institution operating in high-risk or cross-border environments. Even without formal charges or proven intent, lapses in AML controls and reporting processes can trigger significant regulatory consequences. 

While these fines followed US Treasury designations that elevated scrutiny, the enforcement itself stemmed from local failures in transaction monitoring, disclosure practices, and oversight. The message is clear: institutions must ensure internal controls are in place and functioning as intended. 

A modern compliance program must go beyond box-checking to consistently apply risk-based monitoring for customer and transaction activity and provide reliable, well-governed reporting and escalation procedures. It must also instill a culture of compliance that supports early detection, transparent decision-making, and full regulatory alignment. 

In an era of fast-moving sanctions, global regulatory coordination, and reputational risk, getting these basics right is more critical than ever.