Two Mexican business owners were sanctioned this summer by US authorities who say they helped a drug cartel smuggle fuel across the border. Combined with last year’s designation of cartels as terrorist groups, traditional due diligence may not cut it anymore in Mexico, write Alejandro Ortega, Miguel Salcedo and David Williams of FTI Consulting.
In June, the Office of Foreign Assets Control (OFAC) targeted and sanctioned two individuals and seven companies in Mexico for facilitating the Cartel Jalisco Nueva Generación (CJNG), a cross-border fuel smuggling network. The designated companies included a financial services company, freight and transportation firms and a real estate company, all owned or controlled by the same individual. None of the sanctioned individuals or companies had previously appeared on OFAC’s specially designated nationals and blocked persons list prior to the June 30 action.
This highlights a broader challenge for companies conducting business in high-risk environments: Criminal networks increasingly rely on legitimate commercial structures and supply chains to facilitate illicit activity. In today’s Mexican regulatory environment, the question is no longer, “Is this company sanctioned?” but rather, “Should this company be doing the business it claims to perform and who ultimately benefits from it?”
Why traditional Know Your Client checks falls short
Conventional due diligence practices are built primarily around sanctions and watchlist screening procedures conducted during an onboarding procedure. Historically, these methods were designed to identify counterparties that have been named by a regulator or law enforcement agency. However, they were not designed to detect facilitators before that designation occurred, or to identify relationships between counterparties that appear unrelated.
One of the two individuals designated controlled six Mexican companies in three sectors, including one based in the UK. Viewed individually, none of the designated companies would have appeared to be connected. It was only by examining the ultimate beneficial ownership of these companies that the individual emerged as the common link connecting the network.
The man was designated by OFAC for providing services, material and financial assistance to CJNG. Through his role, he facilitated fiscal fuel theft schemes by using a network of companies. In a traditional Know Your Client (KYC) review, none of these characteristics would have been identified through standard sanctions and watchlist screening because, in part, before the June 30 designation, neither he nor his companies appeared on the OFAC’s sanctions list, and their operations were dispersed across different industries and jurisdictions, giving little indication that they formed part of the same network. The common link appeared only when the companies were viewed collectively through their ownership structure rather than as independent legal entities.
This illustrates the fundamental limitation of traditional due diligence: Screening can identify counterparties that have already been designated, but it is far less effective at revealing commercial networks, ownership structures and facilitators that remain hidden. The need for a more comprehensive approach is reinforced by the evolving US enforcement landscape.
The June designations came just over a year after six Mexican cartels, including CJNG and Sinaloa, were designated as foreign terrorist organizations (FTOs), which means that companies with Mexico-related business activities operating in or with exposure to high-risk sectors face legal, regulatory and reputational risks associated with commercial relationships that may directly or indirectly benefit designated organizations.
Reliance on basic sanctions screening alone may no longer provide a sufficient understanding of counterparty risk, and organizations operating in Mexico should instead adopt a risk-based approach that considers the nature of the industry, the jurisdictions in which a counterparty operates, the complexity of its ownership structure, its regulatory authorizations and the broader supply chain. Depending on the level of exposure, companies should also evaluate whether enhanced due diligence measures are needed to identify hidden risks before they become regulatory, financial or reputational liabilities.
FCPA Changes & Terrorist Designations for Cartels Create Dangerous New Math in Latin America
As the Trump Administration takes aim at Latin American cartels with foreign terrorist organization designations, the legal landscape for businesses has dramatically shifted.
Read moreDetailsWhy beneficial ownership matters more than ever
This case underscores why the beneficial ownership analysis is no longer a secondary step in Mexican due diligence. Screening a company’s registered name, listed directors or filing address may not reveal whether the same individual ultimately owns or controls multiple entities operating across different sectors or jurisdictions.
Mexico provides a significant amount of publicly available corporate information, but accessing that information is not the same as retrieving a complete ownership structure from a centralized commercial database. Corporate records are maintained through the Public Registry of Commerce, whose offices operate locally across Mexico’s states and jurisdictions. The availability and format of historical filings can vary, and reconstructing ownership may require reviewing multiple corporate acts over time rather than relying on a single current record. Where shareholders, affiliates or related entities extend beyond Mexico, the analysis may also require consulting foreign corporate registries and tracing ownership across different disclosure regimes.
For companies conducting due diligence, the implication is significant: Identifying beneficial ownership is not simply a matter of confirming the names disclosed by a counterparty. It may require piecing together corporate records across jurisdictions, identifying common shareholders or controllers and assessing those relationships collectively. This type of analysis can reveal connections that conventional KYC screening may overlook and, in higher-risk environments, help companies understand not only who their immediate counterparty is, but the broader network behind it.
But a company’s name and ownership are a part of the picture. Even where beneficial ownership is fully mapped, a due diligence review can still miss a company that is operating outside the bounds of its own regulatory authorization, simply because that information sits in a different place entirely; not a corporate registry but a sector-specific regulator.
Every regulated industry in Mexico has its own authority, and its own disclosure requirements. For example, non-bank financial companies (SOFOMes) are supervised by the National Banking and Securities Commission (Comisión Nacional Bancaria de Valores or CNBV), and publicly listed companies are subject to disclosure requirements through both the CNBV and the Mexican Stock Exchange (Bolsa Mexicana de Valores or BMV). In each case of these industry examples, the relevant information exists and is often publicly accessible but only if the reviewer knows which regulator governs that specific industry.
Knowing where to look in a high-risk jurisdiction
The cases of the sanctioned individuals illustrate that due diligence can no longer be limited to confirming that a counterparty does not appear on a sanctions list. Regulatory information in Mexico is frequently fragmented across multiple government repositories and published in formats that are not easily searchable or structured for commercial databases. Therefore, identifying the relevant permits, registrations or enforcement actions often requires more than a simple database search. It requires an understanding of Mexico’s regulatory framework, familiarity with the authorities overseeing each industry and the ability to interpret the significance of the information in the context of a due diligence review.
Effective due diligence in high-risk jurisdictions like Mexico requires organizations to understand who ultimately owns a business, whether it operates within its regulatory authorizations and how it fits into a broader commercial network. As criminal organizations increasingly use legitimate business structures, this broader perspective helps organizations identify potential legal, financial and reputational risks before they become enforcement issues.
Alejandro Ortega
Miguel Salcedo
David Williams
