The report that states where the company is exposed, and how much each exposure weighs.
LARA — Legal Audit and Risk Assessment. A review of the file, not of opinion: it walks the company's actual operation, tests it against the obligations that are in fact enforceable against it, and returns a measurement built on a risk-based approach. Inherent risk, control effectiveness, residual risk. Item by item.
Risk does not appear in the claim: it was already in the file.
When the authority makes a request, when the bank asks or when the counterparty demands, a company is not defended by arguments: it is defended by documents. LARA audits that layer — file, evidence, traceability — and turns it into a measurement that can be compared across areas and across financial years.
It is not a legal opinion on an isolated contract, nor a compliance checklist run through a questionnaire. It is an audit of exposure: which obligations are enforceable against the company, which are supported by evidence, which are supported only in appearance, and what happens if the demand arrives tomorrow.
Four phases. Each one closes with a deliverable, not with a promise.
Scoping
The auditable universe is defined: entities, processes, counterparties and obligations that are genuinely enforceable. Not everything is audited; what is audited is where risk actually materialises and where the authority looks first.
Evidence
Verification against source: inventory of the file, chain of evidence, and screening of counterparties against formal lists. Whatever leaves no verifiable trace is recorded as an absence, never as compliance.
Measurement
Every finding is weighted under a risk-based approach: inherent risk, effectiveness of the control that contains it, and residual risk. The output is a comparable index, not a list of observations.
Report and route
A findings matrix by severity, with owner and deadline, inside a 30, 60 and 90-day remediation calendar that the board can supervise without technical translation.
Two layers that are almost never reviewed together, and that the authority reviews separately.
Risk-based approach
A company's risk is not a single number: it is the product of factors that must be weighted and documented.
- CounterpartyWho it is, who stands behind it, and whether the beneficial owner is identified with supporting evidence.
- Product or serviceWhat is being contracted, and how far it obscures the origin or destination of funds.
- GeographyWhere the operation takes place and what that jurisdiction demands.
- ChannelHow the relationship was onboarded: in person, digital, intermediated or referred.
- Transactional behaviourWhether observed behaviour matches the declared profile.
Controlling beneficiary
Since 2022 a Mexican company must obtain, keep and update reliable, complete and verifiable information on whoever exercises control in fact, and must evidence the procedure by which it reached that conclusion.
- Substantive obligationArticles 32-B Ter, 32-B Quáter and 32-B Quinquies of the Federal Tax Code.
- Reasonable proceduresThe file must show how effective control was identified, not merely who appears in the corporate minutes.
- Ownership chainInterposed structures, trusts and foreign vehicles require reconstruction, not declaration.
- Penalty exposureInfringements are counted for each controlling beneficiary not identified or not updated (articles 84-M and 84-N of the same Code).
- ConsistencyWhat is filed with the tax registry must match the file and the corporate minutes.
A report that can be supervised, not one that gets filed away.
Deliverables
- Executive reportWritten in board language, with the conclusion before the reasoning.
- Findings matrixSeverity, owner, deadline and the evidence that closes each point.
- Restricted-list screening recordWith proof of the direct query made to each source.
- Controlling beneficiary and beneficial owner fileBuilt to withstand both tax and anti-money-laundering review.
- Exposure indexComparable across areas and years: it shows whether the company actually improved.
- Remediation calendar 30 · 60 · 90With a named owner and a closing criterion per finding.
When it is triggered
- Acquisition, sale or corporate restructuring
- Onboarding of a correspondent, distributor or critical supplier
- A request, invitation or letter from the authority
- A counterparty appearing on the article 69-B list
- Admission of a partner, fund or investor
- Bank review of the file or of source of funds
- Annual update of the risk matrix
Risk-based scheme for companies: eight questions.
A preliminary reading of exposure, in two minutes. Answer on the basis of what you could prove today with documents, not what is assumed to exist. The calculation runs in your browser: we neither receive nor store your answers.
01Does the company carry out any Vulnerable Activity under article 17 of the anti-money-laundering statute, or provide services to someone who does?
02Is there a single identification file for clients and suppliers, with the beneficial owner documented?
03Is counterparty screening done against formal lists — articles 69 and 69-B of the Federal Tax Code, the financial intelligence unit, international lists — with proof of the query?
04Is the controlling beneficiary identified under the Federal Tax Code, with the reasonable procedure documented?
05Are there partners, counterparties or flows in higher-risk jurisdictions, or through interposed structures, trusts or foreign vehicles?
06Are material payments and collections traceable across contract, tax invoice and bank flow?
07Is there a risk matrix approved by management, with an assigned owner and periodic review?
08Has the company received requests, invitations or letters from the authority in the past twenty-four months?
Do you have a matter to review?
Describe your situation in three lines. We will tell you frankly whether it is a matter we can take on.
International Firm of the Year 2022 — Tops México ranking, Los Mejores Abogados de México
Fundación Teletón — recognition on national television for pro bono counsel, 2025
Av. Insurgentes Sur 1425, floor 7
Colonia Insurgentes Mixcoac
Alcaldía Benito Juárez
Mexico City, C.P. 03920
10 years providing professional services · 2016 — 2026
The content of this site is for information purposes and does not constitute legal, tax or accounting advice on any specific case. Consulting it does not create an attorney-client relationship.