U.S. Heightens Scrutiny for Companies with Mexico Ties

The U.S. has significantly expanded its enforcement focus on commercial relationships involving criminal organizations linked to Mexico. For companies with operations, payments, customers, suppliers, financing or other connections between Mexico and the U.S., this shift carries important legal consequences because a relationship that appears routine may trigger exposure under multiple U.S. legal frameworks.

The risk does not arise merely from operating in a particular industry or conducting business in Mexico. Rather, it stems from insufficient knowledge of counterparties, unclear beneficial ownership structures, unverified payment sources and inadequate protocols for addressing indicators of concern when they emerge.

A New Enforcement Landscape

On his first day in office, President Donald Trump signed Executive Order 14157, directing his administration to designate certain criminal entities as Foreign Terrorist Organizations (FTOs). Following that directive, the U.S. Department of State formalized the relevant designations and the U.S. Department of Treasury's Office of Foreign Assets Control (OFAC) proceeded to sanction individuals and entities connected to the designated organizations.

The action announced by the Treasury Department on July 23, 2026, illustrates the breadth of this new approach – the measures reached more than 50 individuals and entities connected to commercial activities such as tequila production, agriculture, gas stations, private security and logistics services. In prior actions, U.S. authorities had also identified companies in sectors such as construction, real estate, mining, retail, entertainment, restaurants and manufacturing, among others. The central point is not that those sectors are illicit or that risk is confined to particular industries but rather that risk may arise from relationships with sanctioned customers or suppliers, opaque beneficial ownership, unusual financial flows or unaddressed warning indicators.

For companies with operations, payments, financing, suppliers, customers or supply chains connected to the U.S., this shift requires a review of compliance programs beyond the traditional focus on anti-money laundering or tax compliance. The analysis should include U.S. sanctions, due diligence on customers, suppliers, business partners, intermediaries, beneficial ownership and escalation protocols when relevant concerns arise.

Key Implications for Companies, Institutions and Entities

Designation as an FTO is among the most severe sanctions available to the U.S. government. For companies, the risk is that payments, services, financing or commercial relationships that directly or indirectly benefit a designated FTO may result in significant criminal, civil, immigration and economic consequences.

On the criminal side, 18 U.S.C. § 2339B prohibits knowingly providing "material support or resources" to an FTO. Although this statute has historically been applied to terrorist groups such as ISIS or Hezbollah, its recent application to criminal organizations linked to Mexico means that ordinary commercial transactions may come under scrutiny where there is evidence of knowledge, connection or material assistance to a designated organization.

On the sanctions side, OFAC rules may prohibit U.S. persons – and foreign persons using the U.S. financial system – from engaging in transactions with designated individuals or entities. Companies that process payments, finance operations or maintain commercial relationships with sanctioned customers, suppliers, business partners or intermediaries may face civil liability, blocked assets, loss of access to U.S. dollar transactions and restrictions in their banking relationships.

Importantly, individuals or entities need not be directly involved in criminal activity to face scrutiny, sanctions or other adverse consequences under U.S. law. Exposure may arise from the failure to implement reasonable compliance controls, the disregard of indicators of concern or inadequate documentation of due diligence with respect to customers, suppliers, distributors, logistics providers, financial intermediaries or other business partners.

In this context, willful blindness or deliberate ignorance of reasonably detectable indicators of concern may be treated as equivalent to actual knowledge. As a practical matter, a company should not assume that "not knowing" provides an adequate defense if the relevant information was available, the risk was evident or inconsistencies warranted further inquiry.

On the civil side, 18 U.S.C. § 2333 allows U.S. nationals injured by acts of terrorism committed by a designated FTO to file civil suits against persons or companies that "knowingly provid[ed] substantial assistance" to those acts. The statute provides for treble damages. This may expand exposure beyond government enforcement actions and turn certain commercial relationships into a potential source of private civil litigation in the U.S.

On the immigration side, U.S. law provides that any person who provides "material support" to an FTO – or a member of an FTO – is inadmissible to the U.S. This ground of inadmissibility may affect executives, employees or other individuals associated with companies that have provided support to designated organizations.

Beyond legal exposure, the commercial consequences may be equally significant. These include loss of banking relationships, investor exits, exclusion from supply chains, delays in international payments, heightened contractual scrutiny and reputational harm.

The practical implication is that companies with Mexico-U.S. ties should be prepared to demonstrate reasonable compliance controls and adequate documentation. In addition, they should establish a clear internal process to pause an operation, conduct an appropriate review and determine – with legal support when necessary – whether it may proceed, should be modified or must be rejected, even where local law does not expressly require such measures.

Why Compliance with the Mexican Legal Framework May Not Be Enough

Mexico already has significant anti-money laundering obligations, particularly under the Federal Law for the Prevention and Identification of Transactions with Illicit Proceeds (Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita), as well as tax rules applicable to invoicing, economic substance and transactions with third parties.

Mexico's Tax Administration Service (Servicio de Administración Tributaria or SAT) has also intensified its audit powers with respect to taxpayers who engage in simulated transactions, participate in improper invoicing schemes or carry out transactions lacking economic substance.

Article 69-B of the Federal Tax Code provides a procedure to identify taxpayers presumed to issue tax invoices without having the assets, personnel, infrastructure or material capacity required to provide the services or produce, market or deliver the corresponding goods. Inclusion of a taxpayer on that list does not automatically make its customers or suppliers part of a fraudulent scheme, but it may shift to them the burden of proving the materiality of the transactions and the validity of their tax effects. In practice, these lists are useful tools, although they may not always operate quickly enough to prevent or timely detect this type of conduct.

Mexico and the U.S. share many of these concerns. The July 2026 action was coordinated with Mexico's Financial Intelligence Unit (Unidad de Inteligencia Financiera de México), confirming that authorities in both countries are sharing information and observing certain risks from complementary angles.

However, important legal differences remain. The U.S. has raised the level of scrutiny and expanded the range of potential consequences. As a result, compliance with Mexican law alone may not be sufficient for persons and entities with touchpoints in the U.S. Those who conduct business with U.S. persons, access U.S. financing or capital markets, use the U.S. financial system or participate in supply chains of U.S. companies should evaluate their potential exposure to sanctions and anti-terrorism rules under U.S. law.

In those cases, the relevant question is not only whether the company complied with Mexican law. It is also whether it can explain the substance of the transaction, who stands behind it, why the commercial relationship made sense and what reasonable steps were taken to verify its legitimacy.

Areas of Potential Risk

Recent enforcement actions by the Treasury Department and OFAC demonstrate that scrutiny may reach legitimate commercial activities when a business relationship involves sanctioned persons or entities, has opaque beneficial ownership structures, relies on intermediaries without a clear commercial function, includes payments that are difficult to justify or lacks sufficient transaction documentation. The relevant inquiry is not whether an industry is inherently risky but whether certain operating models warrant closer examination based on how commercial relationships are structured, services or goods are documented, beneficial owners are identified and payments are processed.

Sectors that may require heightened attention include agribusiness and agricultural exports, alcoholic beverages, fuels, construction and real estate, logistics and transportation, mining, private security, retail, entertainment and manufacturing. The financial sector merits particular consideration, as it may be exposed not only as a regulated industry, but also as a channel through which payments, financing, investments or transfers connected to other commercial activities are processed. In all cases, analyses should focus less on the label of the sector and more on the substance of the relationship, such as who the customer or supplier is, who the beneficial owner is, how payment is made, what service or goods are delivered, and whether indicators of concern justify further examination.

Exposure may also arise in indirect relationships among distributors, agents, carriers, subcontractors, landlords, local service providers or intermediaries that participate in the operation without appearing as the principal counterparty. For that reason, due diligence should extend not only to the formal contract, but also to those who in practice receive payments, provide services, control assets or influence the execution of the transaction.

None of this means that operating in a particular sector, region or supply chain is itself an irregularity. The analysis depends on the facts, substance of the relationship, controls implemented and response to indicators of concern.

Recommended Measures

Considering this new enforcement landscape, persons and entities with operations or commercial relationships between Mexico and the U.S. – including companies, investors, directors, financial institutions, intermediaries and supply-chain participants – should review their compliance controls with a practical and disciplined approach. This approach should include the following:

• Map Where U.S. Law May Come into Play. This may occur through U.S. dollar payments, correspondent banks, U.S. customers or suppliers, financing, investors, contracts governed by U.S. law, exports, technology, services or participation in the supply chains of U.S. companies. Companies should map these touchpoints and document where an operation intersects with U.S. jurisdiction, persons, money, technology, services or infrastructure so they can distinguish ordinary transactions from those requiring enhanced review.
• Review Customers, Suppliers, Business Partners and Intermediaries. The review should not be limited to sanctions lists. It should also address beneficial ownership, business rationale, supporting documentation, payment mechanics and warning indicators. Not every counterparty requires the same level of diligence – the depth of review should increase when there are unusual payments, opaque structures, intermediaries, cross-border operations or resistance to providing information.
• Assess Sanctions Exposure, Beneficial Ownership and Economic Substance Prior to Contracting or Remitting Payment. Reviews should not be reduced to a stand-alone sanctions screening exercise or delegated solely to the compliance function. Prior to onboarding a supplier, accepting a customer, approving a payment, engaging an intermediary, renewing a commercial relationship or modifying a payment route, the company should understand who the true counterparty is, who controls it, the commercial rationale for the transaction, how payment will be made, what documentation supports it and whether any fact warrants enhanced scrutiny. These controls should be embedded across procurement, finance, logistics, tax, legal and compliance functions so they become part of ordinary business operations rather than an exceptional process.
• Update Contracts and Internal Processes. Companies may need to include sanctions representations, information undertakings, suspension or termination rights, cooperation obligations in due diligence processes and notice obligations for relevant changes. They should also review whether their contracts allow them to suspend payments, request beneficial ownership information, retain supporting documentation, terminate the relationship following a designation or material concern, and require cooperation during enhanced review.
• Identify Indicators of Concern and Respond Decisively. Indicators such as frequent changes in corporate name or beneficial ownership, intermediaries without a discernible function, third-party payments, cash activity inconsistent with the stated business, refusal to provide corporate or tax information, unusual logistics routes or pressure to circumvent review processes may require enhanced scrutiny by compliance, legal and finance teams, individually or jointly, and, where the risk warrants, escalation to senior decision-making levels. The objective is to recognize when an apparently ordinary transaction requires closer analysis. An indicator of concern does not necessarily signify that a transaction is unlawful; what matters is that the company responds in a reasonable, documented and risk-proportionate manner.
• Establish a Clear Response Protocol for Concerns. When a match or relevant indicator of concern arises, the company should be able to pause the transaction, conduct an internal review, request additional information, document the decision and seek specialized counsel when the risk warrants it. The protocol should identify who receives the notification, who reviews it, when the transaction must be paused, what additional information should be requested, who may authorize continuation, what interim measures should be adopted, and when the issue must be escalated to management, an internal committee, the board or external counsel.
• Treat Pressure, Extortion or Coercion as a Crisis Scenario Requiring a Defined Protocol. If a company faces payment demands, threats or pressure from third parties connected to illicit activity, the response should not be improvised or treated as an ordinary operating expense. These situations require immediate escalation, specialized advice, careful documentation and an assessment of alternatives before making a payment, continuing the relationship or modifying the operation.
• Document the Process. If a transaction or relationship is later reviewed, the company should be able to show what it reviewed, what warning indicators it identified, who made the decision, and why the relationship was continued, modified, paused or terminated. The record should include searches performed, information received, issues identified, internal analysis, decision-makers involved, steps taken and the rationale for continuing, modifying, pausing or ending the relationship.
• Ensure Appropriate Internal Oversight. In companies with substantial U.S. exposure, significant findings should not remain confined to operational or compliance teams. The company should define escalation thresholds so that material risks reach legal, finance, audit, senior management, the compliance committee or board of directors rather than being addressed solely at the operating level.
• Coordinate the Company's Key Functions. The response should not reside solely with compliance or be managed in silos. Accounting and finance should identify payment flows, supporting documentation, accounts, beneficiaries and funding routes; legal should assess contractual, regulatory and sanctions exposure; compliance should lead diligence, notifications and escalation; and corporate governance should ensure that material risks reach the appropriate decision-making bodies. Accounting and legal advisors should also assist the company in understanding the economic substance of the transaction, payment traceability, beneficial ownership, sufficiency of documentation, and exposure under U.S. sanctions, anti-terrorism and civil liability rules. The objective is for the company to respond as an integrated institution, not as a collection of disconnected departments.
• Turn Heightened Scrutiny into Stronger Cross-Border Partnerships. U.S. companies, investors, lenders, customers and suppliers working with Mexican counterparties should not treat this environment simply as a reason to withdraw, overcorrect or de-risk indiscriminately. They should use it to set clearer expectations, strengthen diligence and documentation, align escalation protocols and support counterparties that demonstrate a serious commitment to transparency, traceability and ethical business conduct. Over time, the most durable commercial relationships will be those that can withstand scrutiny because they are built on substance, evidence and trust.
• Evaluate Voluntary Disclosure and Cooperation Options When There Is Actual Exposure. In certain cases, voluntary disclosure to or cooperation with U.S. authorities, together with timely remediation, may be relevant to mitigate consequences under U.S. Department of Justice enforcement policies. The objective is to evaluate an informed and timely response when the situation has moved beyond prevention.

Beyond Compliance: Trust, Standards and Communication

In this environment, compliance should not be viewed solely as a defense against a potential investigation or sanction. For Mexico, and for companies operating from Mexico with an international presence, the response should not be limited to meeting standards imposed by other jurisdictions. It should also be understood as an opportunity to strengthen domestic transactions, institutions and processes under a broader premise: Commercial trust depends both on robust corporate controls and an environment characterized by the rule of law, legal certainty and effective enforcement of obligations. Raising these standards does more than reduce risk – it helps expand the economic prosperity of our nations and societies on more transparent, productive and sustainable foundations.

The trust of investors, lenders, banks, customers, suppliers and U.S. partners is not preserved merely by avoiding a violation. It is preserved when a company can explain, with evidence, how it knows its counterparties, understands the economic substance of its operations, reviews beneficial ownership, documents decisions and escalates material risks in a timely manner. In many cases, the difference will not be between having risk and having none – it will be between being able to demonstrate that the risk was identified, analyzed, managed and communicated responsibly. That capacity to explain and stand behind decisions is part of a broader agenda of trust, investment and shared development.

Holland & Knight's multidisciplinary team is available to help companies assess cross-border enforcement risks, strengthen compliance programs and navigate evolving U.S. sanctions and anti-terrorism frameworks. For more information, please contact the authors.

Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem, and it should not be substituted for legal advice, which relies on a specific factual analysis. Moreover, the laws of each jurisdiction are different and are constantly changing. This information is not intended to create, and receipt of it does not constitute, an attorney-client relationship. If you have specific questions regarding a particular fact situation, we urge you to consult the authors of this publication, your Holland & Knight representative or other competent legal counsel.