I’m not sure my risk matrix would survive an exam.
An agent that assembles the KYC file, rates risk with your methodology, screens lists and prepares every alert with its evidence. Your compliance officer decides and files.
This is how we would do it, not what we’ve already done: today we don’t run AML for any client. What does run, at a Mexican lender, is tax validation of every applicant from the moment they enter their tax ID.
What it looks like from compliance.
-
The risk matrix lives in a spreadsheet nobody recalibrates.
It was built for one exam, and since then the portfolio, the products and the channels have changed.
-
Alerts pile up.
Nobody knows which ones were reviewed, why they were cleared or who decided.
-
The beneficial owner isn’t documented.
You know who signs, but not always who controls, and the file doesn’t show it.
-
A request from the authorities arrives with a short deadline.
And the file is scattered across folders, emails and the system.
What would the agent do?
The repetitive, documentable part. It would assemble the KYC file, check expiration dates and cross-check data between documents; screen lists every time they change; rate customer risk with the methodology your team already approved; and prepare every alert with its rationale and evidence, plus a folder ready for an audit or a regulator’s request.
What wouldn’t it do?
It doesn’t decide whether a transaction is unusual or reportable, doesn’t sign or file reports and doesn’t change the methodology. All of that belongs to your compliance officer, who gets the case fully assembled and makes the call. The agent proposes and documents; the person decides and answers for it.
- The agent
- An agent connected to your origination system, your customer files and whichever list sources you use. It works on every new customer and on the live portfolio, and records in each case what it checked, against which source and with what result.
- The accountable person
- Your compliance officer owns the agent, by name. For the first 4 weeks, the agent checks with a person on every decision and action. After that, anything high-stakes —every alert, every high-risk customer, every report— always goes through a person; simple things, like requesting an expired document, it handles with what it learned, and every action is logged.
- The evidence
- Every list screening, every risk rating and every cleared alert is stored with its date, its source and who resolved it. It’s evidence for the regulator: in an exam you hand over the file with its history, not an explanation from memory.
- The stop button
- Your compliance officer pauses the agent whenever they want, no sign-off needed. If a list source doesn’t respond, the agent doesn’t clear the customer: it holds the case and raises a flag.
The rules changed, and the bar went up.
A SOFOM’s AML regime has its own law.
A SOFOM’s anti-money-laundering obligations, regulated or not, live in Article 95 Bis of the LGOAAC and the general provisions that implement it: identify the customer, rate their risk, monitor their transactions and report to the authorities. On AML, the CNBV’s supervision reaches unregulated SOFOMs too.
Source: Article 95 Bis of Mexico’s General Law of Auxiliary Credit Organizations and Activities (LGOAAC) and its general provisions.
The anti-money-laundering law reform shows where the whole system is headed.
The July 2025 reform to Mexico’s anti-money-laundering law (LFPIORPI) and the March 2026 reform to its regulations adopted a risk-based approach, called for monitoring systems and broadened the definition of beneficial owner. For financial institutions the law defers to their own regime, but the direction is the same: files that show who controls the customer, and monitoring that leaves a record.
Source: LFPIORPI amendment decree, Official Gazette (DOF), July 16, 2025; amendment to its regulations, DOF, March 27, 2026.
What already runs is the start of the file.
We don’t have an AML case to share: we don’t run list screening or risk matrices for any client today, and we won’t say otherwise. What does run, at a Mexican lender, is the part of the file where knowing your customer begins. The live proof is Luz, right below.
- Tax validation of every applicant through a link, the moment they enter their tax ID.
- Bureau report, SAT tax compliance opinion and tax file built into the credit memo, with a record of each source and when it was pulled.
Talk to Luz. Right now.
Luz runs InnovaBlack's sales conversations — not a recorded demo, the same one that answers our clients. Write to her the way you'd write to anyone.
Prefer WhatsApp? +52 33 3246 1111
Luz
Head of Sales · InnovaBlack
Tell me what your operation needs and I’ll point you to where to start.
If we’re not the right fit, she’ll tell you.
What a lender asks before starting.
- Can an AI agent file suspicious activity reports?
- No, and it shouldn’t. The agent can prepare the case: the transaction, the customer, why the alert fired, what was reviewed and with what evidence. Deciding whether a transaction is unusual or reportable, signing the report and filing it is the compliance officer’s job. What your team gains is a case that arrives assembled and documented, not someone deciding for them.
- Which parts of KYC can a Mexican lender automate?
- The repetitive parts you can verify: requesting documents, checking expiration dates, cross-checking data between documents, validating the tax ID, screening lists and logging every step. Risk rating gets automated with the methodology your team already approved, not one the agent makes up. High-risk customers and exceptions always get a human review.
- Does the LFPIORPI reform apply to SOFOMs?
- The LFPIORPI mainly governs so-called vulnerable activities; financial institutions, SOFOMs included, have their AML regime in Article 95 Bis of the LGOAAC and its provisions. The 2025 reform still matters because it sets the direction: a risk-based approach, monitoring with a record, and documented beneficial owners. Your compliance officer confirms what changes in your case.
- What does it cost, and how do we start?
- You start with a free diagnostic: we review your customer files, your risk matrix, how you handle alerts and your latest audit findings, and tell you which parts an agent can document and which stay with your compliance officer. Pricing comes in a formal proposal. There is a one-time activation fee and a monthly operations fee.
Tell Luz where your files stand.
Luz, InnovaBlack’s Head of Sales, asks what she needs and sets up the free diagnostic. If what you need is a compliance firm and not an agent, she’ll tell you.