What is a Vulnerable Activity?
A Vulnerable Activity is an economic activity that — by its nature — can be used to move resources of illicit origin. That's why the LFPIORPI (Anti-Money Laundering Law) lists them in its article 17 and subjects them to specific obligations.
Whoever carries out one of these activities is an obligated party: not out of suspicion, but because the law establishes it for that activity.
Examples of Vulnerable Activities
Article 17 includes, among others, activities such as:
- Real estate transactions (purchase and sale) and real estate development.
- Trading in precious metals and stones, jewelry and watches.
- Auction or trading of works of art.
- Trading in new or used vehicles.
- Armoring of vehicles and property.
- Loan or credit services by non-financial entities.
- Certain professional services and public attestation (notaries and public brokers).
- Receipt of donations, real estate leasing, transport of valuables, among others.
This is a general reference. The exact scope, scenarios and thresholds for each activity are defined by the current text of article 17 and its rules. Verify it in the official source before concluding whether it applies to you.
Source: LFPIORPI, art. 17 · DOF, Jul 16 2025.
What does being an obligated party involve?
Each Vulnerable Activity has two distinct thresholds: an identification threshold and a reporting threshold. In practice, being an obligated party means:
- Identifying the client and building their identification file.
- Identifying your client's Beneficial Owner.
- Assessing risk, including whether they are a Politically Exposed Person.
- Filing Reports when an operation exceeds the threshold, in the official formats (via SAT/FIU).
- Keeping the information and supporting documents for the periods set by law.
Read also
Notice: informational content based on official sources (DOF). Not legal advice. To determine whether you are an obligated party, consult the current text of article 17 and a specialist.
PLD Central, by CoreWorks, centralizes files, identification, risk matrix, reports, audit log and reporting — so you comply and prove it.