Current Landscape: Recent Changes in the International Regulatory Approach
In an environment where legal, financial, and reputational risks are constantly evolving, adopting a prevention strategy is no longer just a best practice, but a business necessity. The U.S. government’s recent Foreign Terrorist Organization (FTOs) designations and associated regulatory actions are evidence of a shift in key regulations globally, especially for companies with a direct or indirect presence in Mexico and Latin America.
Similarly, a thorough understanding of who you do business with has become a strategic necessity to avoid penalties, operational losses, and reputational risks. In this article, we explore how these measures can impact organizations and why having a proactive due diligence strategy in place is key to protecting reputation and operational continuity.
Legal and Operational Implications for Companies with Ties in Mexico
This recent designation represents an important expansion within the existing legal framework. Among the designated groups are the Sinaloa Cartel and the Jalisco New Generation Cartel (CJNG), groups with a strong presence in Mexican territory.
While many of these organizations had previously been classified as Transnational Criminal Organizations (TCOs) or were subject to sanctions by the Office of Foreign Assets Control (OFAC), this new FTO category opens the door to additional or complementary mechanisms for law enforcement and international cooperation.
For companies with operations or links in Mexico, this designation increases the risk of legal exposure, particularly if in any link in their value chain—suppliers, intermediaries, or partners—maintains direct or indirect relationships with these organizations. The measure, backed by U.S. Executive Order 14157[1], enables the Department of Justice (DOJ) under its Anti-Terrorism Act (ATA)[2] to exercise extraterritorial jurisdiction and pursue cases of “material support,” even when there is no malicious intent.
While OFAC’s sanctions regime already provided for financial penalties, as well as potential criminal and civil consequences for individuals or entities with ties to criminal organizations, the designation as an FTO introduces an additional legal basis under the ATA that gives the DOJ broader powers to pursue legal action, including the ability to enforce its jurisdiction extraterritorially, even when the link is indirect or unintentional. In addition, if there is a commercial or financial nexus with the U.S., systems such as the Terrorist Finance Tracing Program (TFTO) strengthen the ability to track and sanction financial movements associated with these entities.
In this context, companies must update their due diligence processes, strengthen their continuous monitoring, and ensure comprehensive visibility of those with whom they do business. It is not a matter of complying with regulations but of anticipating risks that increasingly transcend borders and are hidden in gray areas of daily operations.
These legal implications do not occur in a vacuum. To measure the scope of these criminal organizations, it is key to understand how and where they operate, as well as how companies can be exposed to them.
According to InSight Crime’s profile of Mexico,[3] states such as Baja California, Coahuila, Jalisco, Michoacán, Nuevo León, Sinaloa, Tamaulipas, and Zacatecas have a significant concentration of criminal groups. This presence is not new, but the recent designation as FTOs puts the spotlight on a key aspect; in certain regions, these groups operate as parallel structures to the state, controlling economic, social, and even institutional aspects of local life.
For companies, this reinforces the need to evaluate not only their deals with actors of obvious risk but also possible indirect links, such as contracts with public or private entities operating in co-opted or vulnerable contexts. While these risks already existed, the current environment makes them more visible and potentially punishable. In this context, a lack of visibility can represent a real legal risk, even if the company is acting in good faith.
Importantly, these types of risks are not hypothetical. In a March 31, 2025 press release, OFAC announced sanctions on six individuals and seven entities linked to the Sinaloa Cartel for their participation in an international money laundering network. The entities, registered as legal companies in Mexico and Ecuador, operated as fronts that facilitated illicit operations in legitimate sectors.[4] These types of structures can be integrated into formal supply chains without raising obvious red flags, underscoring the need for reputational analysis beyond traditional compliance.
Industries Vulnerable to New Routes and Methods of Organized Crime
A recently published report by the U.S. Office of the Director of National Intelligence (ODNI), which highlights the use of passenger vehicles and trailer transport by organized crime in Mexico,[5] confirms that organized crime in certain regions of the country has reached a level of penetration similar to that of a parallel power structure. This report, which is part of ODNI’s annual threat assessment for 2025, reveals how cartels have managed to diversify their methods of transportation for drug trafficking and other illicit activities.
The report notes that these groups now control not only crime routes but also key logistic infrastructures in various regions, exponentially increasing the associated risks for companies operating in areas where these organizations have a high influence.
It is therefore essential that certain industries strengthen their strategies for the prevention and third-party assessment of the risk involved in establishing business relationships with actors directly or indirectly linked to sanctioned or designated organizations. The most exposed sectors include the following:
- Logistics and cargo transport, especially companies that operate fleets or last-mile services that cross in both directions between Mexico and the United States, making them vulnerable to the movement of drugs and people.
- Parcel and courier services, exposed to the risk of inadvertently transporting illicit goods.
- The automotive sector, including workshops, distributors, and rental services, where vehicles can be used as a front.
- Cross-border trade, customs and companies with operations on the northern border, with threats such as forged documents and contaminated trailers.
- Agribusiness and food transportation, for the frequent use of refrigerated units on long routes.
- Land tourism, such as bus lines and private transportation that cross states or borders.
Organized crime has demonstrated the ability to infiltrate or take advantage of any weak link within these chains. Therefore, it is key to implement due diligence mechanisms that are not limited to the initial evaluation of a third party[6] but include geographic monitoring, reputational alerts, and updated knowledge of the evolution of organized crime routes.
In addition to the operational risks on the ground, there is a growing financial exposure for companies that use banking services connected to the U.S. system. The designation of these groups as FTOs strengthens the U.S. government’s ability to apply secondary sanctions to foreign entities that facilitate, even unintentionally, transactions with terrorist organizations. This risk affects both Mexican and international companies with operations or commercial ties in the country. Having visibility into beneficial owners, banking connections, and strategic partners is key to avoiding legal and reputational consequences.
Strategic Perspective: Key Recommendations from Our Expertise in Risk, Compliance, and Investigations
Faced with this new scenario, having a robust and localized due diligence strategy becomes more relevant than ever. This involves strengthening existing compliance programs, including anti-corruption policies, anti-money laundering (AML) policies, and third-party assessment processes, and adapting these programs, policies, and processes to the new risks associated with FTOs.
Against this backdrop, companies must go beyond avoiding acts of corruption to take a deeper look at their business relationships, ownership structures, and geographic, and reputational exposure. Risk assessment becomes more complex and requires specialized tools, continuous monitoring, and increased sensitivity to local risk.
From our experience, these are some of the key actions that we recommend implementing to face this environment with greater safety:
- Assess geographic and sectoral risks in areas with a high presence of organized crime through environmental analysis and risk maps.
- Identify indirect links of third parties with sanctioned persons or entities through reputational background investigations.
- Continuously monitor suppliers, partners, and supply chains.
- Proactively comply with international regulations by designing customized compliance programs.
These actions allow companies to anticipate potential regulatory investigations, avoid risky relationships, and protect their corporate reputation, especially in an international regulatory environment that places greater focus on operations in high-risk areas.
Prevention as the Cornerstone of a Sustainable Business Strategy
Having a comprehensive view of risk that combines local knowledge, deep reputational analysis, and strategic monitoring allows organizations to anticipate problems before they become a crisis.
Bibliographic References:
[1] Department of State – Bureau of Counterterrorism. (February 20, 2025). Foreign terrorist organizations. Retrieved April 2025 from: Designations and State Sponsors of Terrorism: https://www.state.gov/foreign-terrorist-organizations/
[2] U.S. Department of Justice. (May 4, 2005). Justice File: Fact Sheet: Patriot Act Provisions Ready for Reauthorization. Retrieved April 2025 from: Justice.gov: https://www.justice.gov/archive/doj-espanol/pr/2005/April/05_opa_163_spanish.htm
[3] InSight Crime. (2024). Mexico Profile. Retrieved April 2025 from: InSight Crime: https://insightcrime.org/mexico-organized-crime-news/mexico/#crim
[4] U.S. Department of The Treasury. (March 31, 2025). Press Releases. Retrieved April 2025 from: Home Treasury Gov: https://home.treasury.gov/news/press-releases/sb0064
[5] Office of the Director of National Intelligence. (March 18, 2025). ATA-2025-Unclassified-Report (1). Retrieved April 2025 from: https://www.dni.gov/files/ODNI/documents/assessments/ATA-2025-Unclassified-Report.pdf.
[6] Association of Certified Fraud Examiners. (2025). Conducting effective third-party risk management. https://www.acfe.com
By: Carolina Felix l Senior Manager l Investigations, Diligence and Compliance | Mexico City | carolina.felix@kroll.com
By: Emanuel Batista l Managing Director l Investigations, Diligence and Compliance | Washington DC | ebatista@kroll.com
Picture: Canva
