Mexico - Legal Framework and Norms

Mexico - legal framework and norms

Quick Reference

The Mexican gambling industry is regulated by a federal link: the historic Ley Federal de Juegos y Sorteos (LFJS, 1947) + Reglamento (full. Regulation to LFJS, 2004; significant amendments - November 2023). Supervision and permitting activities are concentrated in SEGOB (Secretaría de Gobernación), the operational circuit in Dirección General de Juegos y Sorteos (DGJS). Permits are issued in the form of permisos (not "licenses"), with a detailed matrix of conditions.

1) Regulatory framework and regulatory architecture

LFJS (1947): a general presumption against the prohibition of "games of chance and wager," except in forms specifically permitted and controlled by the state; SEGOB is authorized to permit and supervise.
Reglamento LFJS (2004; rev. 2023): procedural rules for permits (permisos), supervision, advertising, control of halls and remote services; articles on prohibition for minors and mandatory RG messages in advertising.
SEGOB/DGJS: issues/extends permisos, approves operating rules, inspects, applies sanctions, maintains standard "linementos" for applications and activities.

Amendments 2023: "slots" and clarifications

In November 2023, a decree was published changing Reglamento: the definition of máquinas tragamonedas was expanded and the conditions for new permisionarios were tightened (including bans for new permits for "slots"). In 2024, in a number of cases, the courts issued amparos/decisions temporarily protecting existing operators and interpreting the boundaries of the concept of "sortreos "/" slots." The practice remains evolutionary.

2) Categories of permits and perimeter of activities

• Salas de sorteos de números (halls of "drawing numbers," electronic devices of drawing/video lottery in a legal configuration different from the "slot" according to the Regulations).
• Centros de apuestas (including remotas): sports betting/events, sweepstakes, racetracks and off-track, remote channels as part of the permit.
• Lotteries, bingo, promotions (including promotions subject to public notice and reporting requirements).
• Vendors and service providers (hardware, software, payment and verification services) - depending on access to critical systems may require separate DGJS approval.

3) Taxes and fees

IEPS (federal excise)

Base: services for games with bets and draws, covers offline and Internet formats.
Historically, the rate is 30% (Article 2, fr. II, inc. b LIEPS; SAT practice and criteria); in October 2025, the Chamber of Deputies approved an increase to 50% and extension to services provided via the Internet, incl. non-residents; The Senate announced support for the package. The expected application horizon is from 2026 (after completion of the process and publication in the DOF).

Other fiscal elements

ISR/IVA - general tax regimes; special deduction rules apply for prizes.
Local fees/payments - at the place of operation (rent, rights to signs, etc.).
Public reporting: SAT criteria based on IEPS (handle/contraprestaciones), reductions in prizes paid, etc. - according to norms/criteria.

4) AML/PLD (LFPIORPI)

• Customer identification: with amounts from 325 UMA per operation/day.
• Notification (advice) in UIF: from 645 UMA.
• Cash restrictions/prohibitions and requirements for KYC dossier storage, reporting and PLD officer. (UMA values are updated annually; for 2025 see table equivalents.)

5) Advertising, age and RG

Advertising: no misrepresentation, specifying permiso, mandatory messages about inadmissibility for minors and about "responsible play"; approved by SEGOB/DGJS procedures.
Age: adult access only (at least 18 +); operators are required to use CCM/age verification and refuse service to minors.
Responsible Gaming: self-disable and limit policies - in permiso and internal rules, with a focus on warnings and access to help.

6) Technical standards and internal controls

Hardware/Software: Draw/Content Device Certification; Version/hash control immutable logs.
Observation and accounting: video supervisor of halls, control of cash desks/jackpots/redemptions, DGJS and SAT reports, storage of records.
Cyber/online: geolocation/fraud circuit, identity protection, IAM/MFA, vulnerability management, DR/BCP, software supply control (signatures, SBOM).
Sports integrity (if applicable): data/alert providers, insider barring, trading and settlement logs.

7) Forensic regulatory events 2023-2025 (affecting model)

November 2023: Decree to Reglamento - tightening the regime of "máquinas tragamonedas" and new permisos.
2024: a series of amparos and court decisions - on individual cases, they limit the application of the ban, clarify the qualification of roulette/cards/bones in the context of "sortreos" and chance.
Autumn 2025: fiscal package - IEPS increase to 50% (including online and non-residents), rate for 2026.

8) Entry roadmap (permis-oriented approach)

1. Pre-filing (0-2 months)

Establish a Mexican legal entity; Disclose the structure and sources of funds.
Select format (sorteos/centro de apuestas/hybrid), prepare volume/procedures (KYC/AML, RG, advertising).
Drafts: technical architecture, logging, Dev→Prod schemes, DR/BCP plans, data protection.

2. Application to DGJS (2-6 months)

Packages of suitability (beneficiaries/officers), technical package (hardware/software/wallet/geo, hashes/signatures).
Draft hall/online regulations, contracts with providers (payments/geo/CCM/data).
Advertising and user information layouts (house rules, RG messages).

3. Tests and conditional approval (6-9 months)

Fields and laboratory tests, pilots, reporting integrations (SAT/IEPS; UIF/payment advice note).
Correction based on DGJS inspections.

4. Go-Live and Supervision (9 + mo)

Post-installation audits, regular IEPS/ISR/IVA reports, LFPIORPI memos.
RG-KPI/incidents, vulnerability management, supply control, advertising review.

9) Risks and red flags

Opaque beneficiaries/debt schemes → denial of permiso.
Device qualification (border "sorting" vs "slot") → high regulatory risk after decree-2023.
Incomplete logs/unauthorized software versions, weak Dev→Prod - contour.
PLD mismatch: UMA thresholds, memo dates, cash limits.
Tax errors on IEPS/prizes; accounting for Internet services and non-residents from 2026 (upon final publication).

10) Economy & P&L: Highlights 2025-2026

IEPS 30% → 50% (from 2026, expected): unit margin recalculation, decrease in promo share, focus on ARPPU and retention; payout/holding impact calculation.
Offlayn→onlayn: distribution channel through permisos of Mexican operators; access agreements/white-label/payment providers are important.
AML transaction costs: KYC, UIF reporting, dossier storage, SIEM/logging - put in OPEX.

11) Trends 2025

Codification of the "digital" sector: government agenda to modernize LFJS (including online gaming, advertising and consumer protection).
Tightening tax model through IEPS and expanding coverage to non-residents/platforms.
Supply-chain security and signed software assemblies; RG metrics and transparency of promo/payments.

What's important to remember

Mexico works according to the "old law + modern Regulation" with centralization in SEGOB/DGJS and permiso model.
Amendments 2023 tightened the attitude towards "slots"; judicial practice 2024 partially corrects application.
Taxes: IEPS historically 30%; in 2025, an increase to 50% is promoted from 2026 (Internet formats and non-residents in coverage). Plan P&L ahead.
AML/PLD: thresholds 325/645 UMA, mandatory CCM/memo and accounting for cash restrictions.