⏱ 10 min read
Most companies in Mexico validate their suppliers when they onboard them. They check official lists, confirm the tax ID doesn’t appear in 69-B, download the compliance certificate. Then they sign the contract and archive the verification.
That initial validation moment is increasingly insufficient.
The reason is simple: official lists are not static photographs. They are living processes that change every week. A company that validated a supplier in January and didn’t review again until December was operating on eleven-month-old information. During that time, the counterparty may have fallen into firm credit status with INFONAVIT, lost its digital seal with SAT, or entered the registry of simulated operations. The contracting company finds out when it appears in an audit, in an authority requirement, or when a deduction is rejected.
This article describes how continuous third-party monitoring works, why it’s becoming the de facto standard in serious companies, and what it takes to implement it correctly.
What changes between one Monday and the next
To understand why one-time validation is insufficient, it’s worth dimensioning the actual rate of change of the official lists universe.
In any given week of normal operation, movements are published in:
- SAT 69: companies with firm tax credits, enforceable credits, cancellations, digital seals without effect, unlocated taxpayers, judgments.
- SAT 69-B: presumed issuers of receipts covering non-existent operations, definitive, disproved, favorable judgments.
- IMSS ICSOE: specialized services contracts declared by providers to the Mexican Social Security Institute.
- INFONAVIT: employers with firm credit accumulating by annual cohort.
- International sanctions: OFAC (United States), UN, European Union, OFSI (United Kingdom), World Bank.
At consultas.referencecheck.mx we track twenty-four official Mexican and international lists that together contain more than 1.8 million records. The figure grows and changes every week. A company that performs due diligence annually is observing a photograph with fifty-two weeks of lag.
The INFONAVIT case illustrates the rate of change well. We recently analyzed the six annual cohorts of the employer registry with firm credit. In the most recent registry update, 28,675 new employers entered firm credit status over a 22-day interval.
If your procurement or HR team validated a supplier three weeks ago and found their employer registration number clean in INFONAVIT, today there’s a real probability that it no longer is. Not because your validation failed, but because the registry changed beneath the consultation.
The cost of outdated information
One of the less-discussed features of the Mexican tax framework is that the consequences of non-compliance by counterparty can be retroactive.
If your supplier is classified as Definitive in the EFOS list (companies that issue simulated operation invoices), all CFDIs your company received from them lose tax effects, even those issued before the publication. The authority can deny deductions, require reimbursement of credited tax, and impose fines and surcharges. The bill for the oversight is retroactive, not prospective.
The same occurs in other domains. If you subcontract specialized services with a REPSE-obligated supplier that loses their registration during the relationship, you inherit the consequences regarding social security with IMSS and INFONAVIT. If your client, supplier, or commercial partner falls into an international sanctions list and you continue operating with them, the consequences include international regulatory exposure for your organization.
The pattern is clear: in tax and sanctions compliance, the risk doesn’t end when you sign the contract. It ends when the relationship ends.
What continuous monitoring means
Continuous monitoring is the process by which the complete portfolio of suppliers, clients, and counterparties is periodically compared against the current set of official lists. The organization learns of a new finding within the period it occurs, not when it appears in an audit or in an authority requirement.
Three attributes define a serious continuous monitoring process:
1. Complete portfolio, not sampling. Every active supplier and client enters the process, not only those relevant by amount. The reason is simple: a company with five hundred active suppliers cannot assume only the twenty largest represent risk. Tax contingencies by counterparty are binary, not proportional to ticket size. A smaller supplier with INFONAVIT firm credit generates the same type of joint employer liability exposure as a larger one.
2. Regular and documented frequency. Ideally weekly, aligned with the actual update cadence of official sources. Documentation of each run is part of the compliance file. When an authority asks how the portfolio is being validated, the answer cannot be “we review it when we can.” The answer must be “we review it every Monday and here’s the log of the last fifty-two runs.”
3. Change reporting, not status reporting. The organization doesn’t need a weekly report repeating that five thousand counterparties are clean. It needs to be notified only when something changes: a new finding appears, or a previous finding is no longer current. Exception reporting is what makes monitoring operational in companies with large portfolios.
A process that meets these three attributes changes the nature of internal compliance conversations. It stops being an ad-hoc review activity and becomes a permanent layer of early detection, comparable to how a company monitors the health of its technology infrastructure or its accounts receivable.
Beyond SAT
An additional observation is worth making, because it defines where the most common blind spot in the Mexican market lies.
Most commercial monitoring tools in Mexico focus exclusively on SAT lists, particularly 69-B. That covers the risk of simulated operations and firm tax credits, but leaves several equally relevant domains uncovered:
| Domain | Relevant lists | Risk covered |
|---|---|---|
| Tax | SAT 69, 69-B, ICSOE | Deductions, voided CFDI, EFOS |
| Labor-employer | IMSS ICSOE, INFONAVIT, SFP | Joint liability, firm credits |
| International sanctions | OFAC, UN, EU, OFSI, World Bank | International regulatory exposure |
| Public sector | SFP disqualified | Government contracting |
| Reputational | Internal media and background lists | Brand exposure |
For a company whose only monitoring is SAT 69-B, employer and international sanctions risks are blind spots. An exporting company may be perfectly current with SAT and still be operating with a counterparty on the OFAC list, which generates serious regulatory consequences when doing business with international banks.
Serious monitoring covers all five layers, not only tax.
When it stops being optional
There are two categories of company in Mexico for which continuous monitoring stopped being a recommended best practice and became a regulatory expectation.
Vulnerable activities under LFPIORPI. The Federal Law for the Prevention and Identification of Operations with Resources from Illicit Sources identifies fourteen activities as vulnerable: lenders, notaries public, real estate agents, jewelry traders, vehicle armoring, gambling, among others. These operations have explicit obligations to identify and follow up on their client portfolio, which implies a recurring process, not an initial validation.
Companies with large supplier portfolios. Although there is no direct regulatory obligation, companies with more than one hundred active suppliers and any operation under REPSE subcontracting should consider continuous monitoring as part of their internal control. The reason is arithmetic: with one hundred active suppliers and a national registry that changes with documented speed, the probability that at least one changes status each month is high. Without monitoring, that information arrives late.
A third category adds to this: companies with international presence or international banking operations. Correspondent banks increasingly require rigorous evidence of continuous monitoring processes against sanctions lists, not just initial validation. A company without that documented process can be challenged in its international banking relationships.
How it operates in practice
A well-designed continuous monitoring process is composed of three elements.
First, a consolidated database of the portfolio to be monitored. This sounds obvious, but in many companies it’s the bottleneck. Suppliers live in the procurement ERP, clients in the CRM, business partners in the general manager’s Excel. Without a single, consolidated, and maintained list, monitoring never really covers one hundred percent.
Second, a recurring connection with up-to-date official sources. Monitoring cannot depend on manually downloading files every week. Official sources change their URLs, their formats, their access conditions. The operational process must have a layer that ingests, normalizes, and maintains the list database current without constant manual intervention.
Third, change detection logic. The value of monitoring lies in knowing what changed, not in repeating what’s already known. If the company’s portfolio has fifteen hundred counterparties and two weeks ago three appeared in 69-B Presumed, this week we need to detect specifically whether those three remained, exited, or whether new ones appeared.
On these three elements operates the reporting layer: exception notifications to responsible persons, documented file of each run, and escalation mechanism when something critical appears.
Implementation: build or buy
A company that decides to formalize its continuous monitoring has two paths. It can build the infrastructure internally, which requires sustained engineering capability and a constant conversation with the particularities of each official source. Or it can contract monitoring as a service, transferring operational complexity to a specialized third party.
In most cases, the decision depends on volume, frequency, and required depth. An operation with one hundred counterparties needing monthly monitoring against SAT 69-B can be resolved with a relatively simple internal process. An operation with three thousand counterparties needing weekly monitoring against twenty sources, with documented file and exception notifications, generally justifies external service.
At ReferenceCheck MX we design the monitoring process tailored to each portfolio. We receive the client’s supplier and customer base, define the relevant lists by sector and exposure, establish the frequency and format of the report, and operate the detection cycle weekly. The client receives only what changed, with the context needed to take action.
If your team spends time on one-off manual validations and still suspects something is slipping through between verifications, let’s talk. The first step is usually a thirty-minute conversation to understand the size and composition of your portfolio, and propose a process that makes sense for your operation.
The information on official lists referenced in this article is based on the public aggregate available at consultas.referencecheck.mx, where we maintain integrated twenty-four official Mexican and international sources updated weekly.
🇲🇽 Versión en español: Monitoreo continuo de proveedores y contrapartes: el nuevo estándar de compliance en México