This is an Insight article, written by a selected partner as part of GIR's co-published content. Read more on Insight

General context, key principles and hot topics

1Identify the highest-profile corporate investigation under way in your country, describing and commenting on its most noteworthy aspects.

Odebrecht is a wide-reaching corruption scandal involving payments in bribes within Brazil, Venezuela, the Dominican Republic, Panama, Angola, Argentina, Ecuador, Peru, Guatemala, Colombia, Mexico, Mozambique and, presumptively, El Salvador and Portugal, totalling US$800 million.

In relation to Mexico, Odebrecht has acknowledged paying US$10.5 million in bribes to officials of the state-owned oil company, Pemex. Mexico has now banned federal institutions and state governments from doing business with Odebrecht SA, a Brazilian construction firm, for the next two years and fined the company close to US$60 million. In addition, the Ministry of Public Function dismissed public official Marco Antonio Sierra Martínez from his position at Pemex, disqualified him from holding any public office for 10 years and fined him US$6.2 million for authorising excess payments for the construction of a Pemex refinery in Tula, Hidalgo.

2Outline the legal framework for corporate liability in your country.

Corporations can be held liable under administrative, criminal and civil laws.

  • Administrative liability of corporations is provided under the General Law of Administrative Responsibilities (GLAR).
  • Criminal liability of corporations is provided under the National Code for Criminal Proceedings, the Federal Criminal Code and local criminal codes (depending on the applicable jurisdiction).
  • Civil liability of corporations is provided under the Federal Civil Code and local civil codes (depending on the applicable jurisdiction).

3Which law enforcement authorities regulate corporations? How is jurisdiction between the authorities allocated? Do the authorities have policies or protocols relating to the prosecution of corporations?

In terms of administrative liability concerning potentially corrupt conduct, two principal authorities are in charge of imposing administrative liability on corporations: the Ministry of Public Function (which is in charge of investigating improper conducts) and the Federal Court of Administrative Justice (which is in charge of imposing sanctions on corporations). As regards corporate criminal liability, two authorities are involved in imposing liability on corporations, namely prosecutors and courts. Jurisdiction is shared between federal and state authorities for both administrative and criminal liability.

There are no general rules or policies relating to the prosecution of corporations. The guidelines for determining principles of corporate prosecution, the duties of the prosecutors and the factors to be considered for the sanctions imposed would depend entirely on the law enforcement authority applicable to the case.

Jurisdiction between authorities is allocated in federal and state matters, depending on (1) where the conduct took place, (2) the nature of the conduct being investigated, (3) whether there are federal interests involved, and (4) for criminal matters, whether the crime in question is expressly included within the purview of federal jurisdiction as provided under the Organisational Law of the Federal Judicial Power.

4What grounds must the authorities have to initiate an investigation? Is a certain threshold of suspicion necessary to trigger an investigation?

Mexican authorities have ample discretion to initiate investigations. However, in practice, authorities will typically start an investigation having been made privy to information suggesting that there are violations to the legal provisions to which the company is subject.

5How can the lawfulness or scope of a notice or subpoena from an authority be challenged in your country?

It would depend on the law enforcement authority involved, and on the remedies provided under the applicable laws. Examples of legal remedies against the lawfulness of a notice are ancillary claims, appeals and amparo constitutional review actions.

6Does your country make use of co-operative agreements giving immunity or leniency to individuals who assist or co-operate with authorities?

Yes. Examples of this are as follows:

  • An immunity programme, as provided under Article 103 of the Federal Economic Competence Law: any competitor involved in absolute monopolistic practices may file a request with the Federal Economic Competition Commission for an administrative fine reduction, which can be 20 per cent, 30 per cent, 50 per cent or even 100 per cent, depending on the timing of the request as compared with other competitors.
  • Opportunity criteria, as provided under Article 256 of the Criminal Proceedings National Code: once an investigation begins, the offender may request that the prosecution authorities refrain from instigating a criminal prosecution (1) when the crime does not have a jail penalty, or has an alternative penalty, or when the jail penalty does not exceed five years, as long as the crime was not committed with violence, (2) in the case of white-collar crimes committed without violence, (3) when the penalty that could be imposed would lack relevance considering another judgment that has already been imposed or could be imposed, and (4) when the accused party provides essential and effective information for the prosecution of a more severe crime than the one attributed to the accused party.
  • Criminal liability reduction, as provided under Article 11 of the Federal Criminal Code: a reduction of up to 25 per cent may be granted if a corporation proves that, before the commission of the acts considered as offences under Article 422 of the Criminal Proceedings National Code, it had a compliance department in charge of preventing potential criminal conduct and that it had sought to mitigate the damage caused by the offences.
  • Self-reporting, as provided under Articles 88 and 89 of the General Law of Administrative Responsibilities: if a party commits an offence provided therein and self-reports it, the company could request a sanction reduction benefit of between 50 and 70 per cent of the corresponding sanctions provided for the offences committed.

7What are the top priorities for your country’s law enforcement authorities?

The most relevant priorities of the Mexican law enforcement agencies are antitrust, intellectual property, money laundering, fraud, trafficking of minors, environmental matters, corruption and influence peddling.

Cyber-related issues

8Does your country regulate cybersecurity? Describe the approach of local law enforcement authorities to cybersecurity-related failings.

There is no specific statute in Mexico regulating cybersecurity. Nevertheless, in June 2018, the Mexican government issued the Official Standards NMX-I-27032-NYCE-2018, NMX-I-27033-1-NYCE-2018 and NMX-I-27032-2-NYCE-2018, providing preventive guidelines to improve cybersecurity controls in Mexico, specifically concerning information security, social media security, internet security and the protection of critical information.

In addition, in late 2017, the Mexican government issued a cybersecurity national strategy to develop a legal regime for cybersecurity, specifically relating to Mexico’s economy, national security and public institutions. The aim of the cybersecurity national strategy was to guide all actions incurred by Mexican authorities to prevent, identify, neutralise and mitigate any risks relating to the information contained in data-processing systems.

Since there is no specific statute in Mexico regulating cybersecurity, local law enforcement has been focused mainly on cybercrime.

9Does your country regulate cybercrime? What is the approach of law enforcement authorities in your country to cybercrime?

Cybercrime in Mexico is regulated under Articles 211 bis 1 et seq. of the Federal Criminal Code. The person who ‘illegally and without authorization modifies, destroys or causes a loss of information contained in private systems or data-processing equipment protected by any security mechanism’ has committed a cybercrime. Such conduct may be sanctioned with a prison sentence of between three months and eight years, depending on whether the offender took the information from a private party’s equipment, government equipment or a financial institution’s equipment, and whether the offender had the authorisation to access the protected data.

Furthermore, as to the approach of law enforcement authorities, the Mexican Federal Police has a special cybercrime unit (cybercrime police) that is responsible for preventing and investigating cybercrimes, and focuses mainly on (1) cyberattacks, (2) the vulnerability of data-processing equipment, (3) data fraud and theft derived from e-commerce, electronic banking services, phishing, pharming, malware and spam, and (4) failure of critical infrastructure. The cybercrime police co-operate directly with private corporations and with authorities from all levels of government, including international agencies such as the Forum of Incident Response and Security Teams, and the Organization of American States.

Cross-border issues and foreign authorities

10Does local criminal law have general extraterritorial effect? To the extent that extraterritorial effect is limited to specific offences, give details.

Criminal law has extraterritorial effects for the purposes of prosecuting foreign bribery in international business transactions. (Mexico will exercise extraterritorial jurisdiction in this context for bribery against both an individual and a corporation.) Article 222 bis of the Federal Criminal Code sanctions bribery of a foreign official to obtain an improper advantage.

11Describe the principal challenges that arise in your country in cross-border investigations, and explain whether and how such challenges depend on the other countries involved.

The principal challenges that arise in cross-border investigations are:

  • identifying all laws and policies that may be relevant;
  • maintaining confidentiality of what comes to light during interviews with employees. This is often an issue as there is a weak confidentiality culture in Mexico;
  • interviewing employees who, in some cases, may have the right to refuse to co-operate and report incriminatory information about themselves and their co-workers;
  • implementing controls and efficient processes that take into consideration the cultural differences between countries;
  • ensuring effective communication throughout the course of the investigation;
  • complying with data privacy and confidentiality laws;
  • determining which findings are relevant and which should be reported; and
  • determining appropriate remedial actions.

These challenges are compounded when other countries involved have different laws that are applicable to the investigation. Further, remedial action is often determined by both the domestic and the foreign regulators, who have to decide such matters as whether to sanction a company for the violation of a law or to adjust the severity of a criminal penalty that might be assessed against the culprits.

12Does double jeopardy, or a similar concept, apply to prevent a corporation from facing criminal exposure in your country after it resolves charges on the same core set of facts in another? Is there anything analogous in your jurisdiction to the ‘anti-piling on’ policy as exists in the United States (the Policy on Coordination of Corporate Resolution Penalties) to prevent multiple authorities seeking to penalise companies for the same conduct?

Double jeopardy, or non bis in idem defence, is provided under Article 23 of the Mexican Constitution and is understood to mean that no person may be sanctioned twice for the same crime. Hence, if a corporation has faced criminal prosecution and conviction in a country other than Mexico for a certain crime and, thereafter, a Mexican prosecuting authority brings a case against that corporation for the same crime, the corporation could raise this defence. The Mexican Constitution does not limit the defence to crimes relating to the same core set of facts. Moreover, there have been no cases so far that test whether the double jeopardy defence will hold when a corporation has faced prosecution for both administrative and corporate criminal liability relating to the same criminal conduct. However, there have been several cases in the past two years relating to the prosecution of individuals in which the double jeopardy defence is implicated. However, they offer contradictory positions, at times allowing for the imposition of sanctions from both administrative agencies and criminal prosecutors and, at other times, prohibiting parallel sanctions from administrative and criminal authorities. These are non-binding precedent.

There is no ‘anti-piling on’ policy or analogous provision in Mexico.

13Are ‘global’ settlements common in your country? What are the practical considerations?

Global settlements are not common. However, Mexico has signed international treaties and co-operation agreements with certain countries providing for mutual assistance in criminal, civil and tax matters that may lead to a similar kind of settlement.

14What bearing do the decisions of foreign authorities have on an investigation of the same matter in your country?

This a relatively new area of law. Mexican authorities may exercise their right to prosecute conduct that is sanctioned under Mexican statute, regardless of whether a foreign authority is investigating the same conduct. Moreover, in the event that Mexico has a multilateral co-operation agreement with the country in which a parallel investigation has already started, Mexican authorities appear to be open to sharing evidence.

One of the most notable examples in recent times is Odebrecht, in which Mexican prosecuting authorities have been very vocal in stating that they will not make use of Brazilian agreements to accept evidence collected by Brazilian prosecutors as part of the Operation Car Wash investigation. Mexican criminal enforcement authorities have stated that they are of the opinion that such crimes should be prosecuted under Mexican law to the full extent available. However, they have not made public any details of their investigations. Conversely, on the administrative front, Odebrecht was sanctioned in early September 2018 with a fine of a little over 1 billion pesos (which roughly equates to US$50 million).

Economic sanctions enforcement

15Describe your country’s sanctions programme and any recent sanctions imposed by your jurisdiction.

There is no specific or unified sanctions programme. Instead, Mexico has a fragmented sanctions programme, which is enforced by different law enforcement authorities depending on the type of conduct.

Sanction enforcement in Mexico can be perceived mainly in administrative and criminal instances. In terms of enforcing sanctions for administrative offences:

  • the Secretary of Public Function is in charge of investigating the types of corruption regulated under the GLAR; and
  • the Federal Court of Administrative Justice is the authority in charge of imposing the corresponding sanctions.

As regards criminal offences, the two main authorities that participate in enforcing sanctions are prosecutors and criminal courts.

The most frequently applied sanctions in Mexico are the following:

  • economic fine;
  • order to repair damage and lost profits caused to third parties;
  • imprisonment;
  • debarment from participating in public procurement;
  • dismissal of officials, or suspension of employment, commission or position;
  • suspension of business activities; and
  • dissolution of corporations.

The severity of the sanctions depends strictly on the type of conduct and on the specific circumstances of the case.

A recent enforcement example is the September 2018 sanction imposed by the Ministry of Public Function of almost US$50 million on Odebrecht. The Ministry also debarred Odebrecht and several of its subsidiaries from participating in public procurement processes because of its wide-reaching corruption scandal involving payments in bribes to officials of the state-owned oil company, Pemex.

16What is your country’s approach to sanctions enforcement? Has there been an increase in sanctions enforcement activity in recent years, for example?

In recent months, enforcement on corruption allegations has increased significantly. We can trace this uptick to President Andrés Manuel López Obrador taking office in December 2018 and to the consolidation of certain key enforcement institutions. The Attorney General’s Office (FGR) became independent from the Executive in December 2018. Moreover, the first Anti-corruption Special Prosecutor was appointed in March 2019. López Obrador ran his entire campaign on the promise of eradicating corruption and impunity. It appears his cabinet is taking this seriously.

One example of enforcement recently was the blocking by the Financial Intelligence Unit (which is supported by the Mexican Treasury) of thousands of accounts of people allegedly involved in stealing oil directly from Pemex’s pipelines. Further, in the last week of May 2019, the FGR obtained a court order to imprison former Pemex chief executive officer Emilio Lozoya on charges of corruption. There had been news reports since late 2017 linking him to the Odebrecht scandal and illegal financing of former President Peña Nieto’s 2012 campaign, albeit no action has been brought against him until now.

In August 2019, the former Secretary of Agrarian, Territorial and Urban Development and former Secretary of Social Development in the Peña Nieto administration, Rosario Robles, was sent to prison by a federal judge following accusations of corruption filed against her by the FGR. She is accused of diverting public monies without preventing the squandering of those resources and of failing to report this situation to her direct boss, former President Peña Nieto. The case arose out of a 2018 news report issued by Mexicanos Contra la Corrupción y la Impunidad (a non-governmental organisation) and independent news agency Animal Político, known as the ‘Estafa Maestra’ (the grand theft), which claimed, in theory, that close to US$350 million of public funds had been corruptly diverted.

17Do the authorities responsible for sanctions compliance and enforcement in your country co-operate with their counterparts in other countries for the purposes of enforcement?

Yes, as general rule, Mexican enforcement agencies tend to grant comity to their counterparts in other countries for the purposes of enforcement. Mexico is a party to several mutual legal assistance treaties and thus co-operation tends to be based on those treaties. Moreover, it is typically required that foreign enforcers’ petitions comply with at least the following:

  • that the foreign authority had the legal competence to impose the sanction pursuant to competence rules analogous to those recognised within Mexican legislation;
  • that the offender had been duly notified or served, to assure him or her a fair trial;
  • that the object of the procedure from which the judgment derives is not subject to other pending procedures before Mexican courts; and
  • that the request to enforce the award is not contrary to public policy.

18Has your country enacted any blocking legislation in relation to the sanctions measures of third countries? Describe how such legislation operates.

Mexico has not enacted any specific blocking legislation regarding sanctions measures ordered by third countries.

19To the extent that your country has enacted any sanctions blocking legislation, how is compliance enforced by local authorities in practice?

There has been no blocking legislation in Mexico.

Before an internal investigation

20How do allegations of misconduct most often come to light in companies in your country?

It depends on the case, but allegations of misconduct most often come to light by means of:

  • due diligence processes (in the context of merger and acquisition transactions);
  • internal and external audits;
  • whistleblower programmes;
  • private complaints or litigation (when filed against a company or its employees); or
  • activity reports to a company’s appointed directors and officers.

Information gathering

21Does your country have a data protection regime?

Yes. Articles 6 and 16 of the Mexican Constitution provide for a data protection regime in Mexico. The regulatory laws of this regime are the Federal Law for the Protection of Personal Data Held by Private Parties and the General Law for the Protection of Personal Data Held by Regulated Institutions.

22To the extent not dealt with above at question 8, how is the data protection regime enforced?

The National Institute of Transparency, Information Access and Protection of Personal Data enforces the data protection regime outlined in question 21. The main objective of the data protection regime is to ‘protect the personal data of individuals and companies, with the sole purpose of regulating its legitimate, controlled and informed treatment to secure the privacy and the right of informed self-determination of the people involved’.

23Are there any data protection issues that cause particular concern in internal investigations in your country?

The data protection regime involves the protection of ARCO rights (i.e., the right of access, rectification, cancellation and opposition), which afford an individual the right to:

  • access their personal data;
  • be made aware of the origin of the data, and executed or anticipated transfers of their data to third parties;
  • rectify errors within their data;
  • cancel their data when it is held in a manner inconsistent with the law, or when it is no longer needed; and
  • to oppose the use of their data by third parties for any type of processing.

Given the technical nature of the collection of data within internal investigations, companies should protect these ARCO rights and be particularly mindful of sensitive data about employees regarding such information as racial origins, ethnicity, health issues and sexual preferences. Privacy notices and consent forms may be required.

24Does your country regulate or otherwise restrict the interception of employees’ communications? What are its features and how is the regime enforced?

As a general rule, under Article 16 of the Mexican Constitution, all interception of private communications is strictly prohibited. The only exception to this provision applies when a competent authority renders a judicial order providing the legal reasons of its granting, the extent of the intervention, the parties involved and the duration of the intervention. However, this exception shall never apply to electoral, tax, commercial, civil, labour, administrative or attorney–client communications.

In light of the above, to avoid any illegal interception of private communications, companies usually draw up privacy notices and consent forms with their employees, for the purposes of allowing the company to collect, process, transfer and review company documents from the company devices (such as computers, internal and external hard drives, jump or ‘thumb’ drives, metadata, email, archived email, databases, servers, cell phones, and other cellular and email devices). By means of these mechanisms, employees consent to allow the collection of company-owned data, and employers usually commit to protect employees’ personal data. Privacy notices and consent forms are usually prepared in accordance with the requirements set forth in Chapter 1, Articles 3(I), 15, 16, 17 and 18 of the Mexican Federal Law on Protection of Personal Data Held by Private Parties.

Lacking employee consent may expose companies and officials who intercept employees’ private communications to criminal liability as provided under Article 177 of the Federal Criminal Code and analogous regulations in the states.

Dawn raids and search warrants

25Are search warrants or dawn raids on companies a feature of law enforcement in your country? Describe any legal limitations on authorities executing search warrants or dawn raids, and what redress a company has if those limits are exceeded.

Yes, in relation to criminal matters. Under Article 16 of the Mexican Constitution:

  • a judicial authority must order the search warrant;
  • the warrant must be limited to a specific place, date and time;
  • the object of the search must be strictly specified;
  • a probable cause shall be justified; and
  • the search must be executed in the presence of two witnesses.

If the aforementioned conditions are not met, all the evidence obtained by the authority by means of the search warrant is inadmissible at trial. Additionally, although there is no automatic redress, a subject company may be able to seek pecuniary penalties from the state and administrative penalties against the authority that exceeded the limits of the search warrant.

Dawn raids are also used by Mexican law enforcement regulators. In recent years, dawn raids have become a particularly invasive feature of antitrust investigations, because there is no injunction available to corporations to effectively defend against the seizure of information by the authorities. In certain cases, the authorities have entered corporations’ offices to collect all sorts of data, both electronic and hard copy, for the purposes of their investigations.

26How can privileged material be lawfully protected from seizure during a dawn raid or in response to a search warrant in your country?

There is no specific protection a party could enforce against the seizure of privileged material before a dawn raid or search warrant is executed. However, there is precedent in the context of antitrust investigations, whereby if the Antitrust Commission collects privileged material in an antitrust investigation, it is obliged to immediately set it apart and exclude it from the investigation. Future cases will have to define the scope of what is covered under this privilege exclusion.

27Under what circumstances may an individual’s testimony be compelled in your country? What consequences flow from such compelled testimony? Are there any privileges that would prevent an individual or company from providing testimony?

The Mexican Constitution provides that there is a human right against self-incrimination. Under this right, the defendant cannot be compelled in any criminal case to testify against his or her own interests. This right can be extended to administrative investigations. However, testimony may be compelled from witnesses in possession of facts relevant to the subject matter of an investigation. The general rule is that anyone with knowledge of relevant facts to an investigation being conducted by the authorities has an obligation to testify. The primary exception flows from the privilege that covers what Mexican law calls ‘professional secrecy’. This covers professions in which a client has an expectation of privacy from the service provider, such as an attorney, a doctor or a psychologist.

Whistleblowing and employee rights

28Describe the whistleblowing framework in your country. What financial incentive schemes exist for whistleblowers? What legal protections are in place for whistleblowers?

The idea of whistleblower protection programmes is relatively new in Mexico and there are very few legal provisions that incorporate protection programmes. The main example is the ‘immunity programme’ foreseen in Article 103 of the Federal Economic Competition Law, which provides that any competitor involved in absolute monopolistic practices may make a request to the Federal Economic Competition Commission for a reduction in an administrative fine, which could be as much as 100 per cent, or up to 50 per cent, 30 per cent or 20 per cent depending on the timing of the request as compared with other competitors. If applicable, the Federal Economic Competition Commission will keep the identity of the competitor confidential. In our experience, financial incentive schemes will depend on the applicable statue, the type of conduct, and the subsequent co-operation by the whistleblowers with the law enforcement authorities.

There is no provision for a whistleblower protection programme under either criminal or administrative law.

29What rights does local employment law confer on employees whose conduct is within the scope of an investigation? Is there any distinction between officers and directors of the company for these purposes?

Under Mexican employment law, there are no specific rights that enable employees to determine how they should be treated during an investigation. However, while conducting an investigation, best practice for an employer should involve:

  • providing the employee with a fair opportunity to challenge the allegations being brought against him or her;
  • making findings based on objective criteria and evidence; and
  • informing the employee of the right to have his or her own counsel and that the interviewing counsel represents the company, not the employee.

Sensitive personal data uncovered during an internal investigation must also be protected. An employer should check the content of its privacy notices regarding the processing of information about employees and ensure that it is consistent with statutory processing conditions.

The officers and directors of a company have the same rights as any other employee. However, ‘trusted employees’ may be treated differently in that an employer’s loss of confidence in a trusted employee is sufficient ground for dismissal of that employee.

30Do employees’ rights under local employment law differ if a person is deemed to have engaged in misconduct? Are there disciplinary or other steps that a company must take when an employee is implicated or suspected of misconduct, such as suspension or in relation to compensation?

When an employee’s alleged misconduct is found to be grounded, the employer may terminate the employment relationship without liability. However, grounds for dismissal follow strict scrutiny and will be interpreted at all times in favour of the employee. Article 517 of the Federal Labour Law provides that an employer has one month to terminate an employee’s employment contract or to discipline the employee, starting from the moment the employer becomes aware of the misconduct.

31Can an employee be dismissed for refusing to participate in an internal investigation?

If an employee refuses to participate in an internal investigation, and the employment contract obliges him or her do so, the employee could be dismissed with cause. However, if an employment contract does not provide that the employee is obliged to co-operate in internal investigations, the employer is unlikely to be able to dismiss the employee for lack of co-operation.

Commencing an internal investigation

32Is it common practice in your country to prepare a document setting out terms of reference or investigatory scope before commencing an internal investigation? What issues would it cover?

Yes. Such a document would typically include:

  • the nature of the investigation;
  • the people who will conduct the investigation;
  • retention of external support if necessary (external lawyers or external auditors);
  • the applicable law during the investigation (data protection, labour rights, criminal, etc.);
  • an estimated timeline for the investigation;
  • key individuals in the facts under review;
  • identification of the databases in which the relevant information may be stored; and
  • the individuals who will be subject to interviews or a review of documents.

33If an issue comes to light prior to the authorities in your country becoming aware or engaged, what internal steps should a company take? Are there internal steps that a company is legally or ethically required to take?

Pursuant to Article 222 of the Criminal Procedures National Code, ‘any individual who is aware of an act that may constitute a crime is compelled to report it to the Public Ministry, or to any police officer if the matter is urgent . . . if any individual fails in this legal duty, he or she will be liable to the corresponding sanctions’. However, the term ‘corresponding sanctions’ is not defined in the Code. Under the Mexican Constitution, authorities cannot impose penalties if they are not expressly established in law. Article 222 does not provide a specific prison or monetary sanction. Therefore, although companies have a statutory obligation to report facts that may constitute a crime, non-compliance with this obligation will not necessarily carry sanctions.

34What internal steps should a company in your country take if it receives a notice or subpoena from a law enforcement authority seeking the production or preservation of documents or data?

  • Identify the facts that led to the authority’s claim.
  • Find and preserve the corresponding data.
  • Analyse whether the request for production of documents is valid pursuant to the applicable laws.
  • Provide protective measures for sensitive data relating to the company’s operations or employees.
  • Review the requested data to determine any possible legal consequences.
  • Prepare a legal defence regarding any possible legal consequences to which the company might be subject, so as to mitigate risks, when applicable.

35At what point must a company in your country publicly disclose the existence of an internal investigation or contact from a law enforcement authority?

There is no obligation binding a company to publicly disclose the fact that an internal investigation is being carried out, other than Article 105 of the Securities Market Law, which provides that entities registered on the Mexican Stock Exchange must publicly disclose ‘relevant events’ that may affect the price of their registered stocks.

36How are internal investigations viewed by local enforcement bodies in your country?

Internal investigations are a recent trend in Mexico. Mexican enforcement authorities welcome them when they are conducted with a legitimate and serious purpose. Although not required by law, a company can benefit from conducting an internal investigation and co-operating with the enforcement authorities in the prosecution of potential criminal offences or infringements committed by the company’s employees or by the company itself. That is to say, an internal investigation can allow a company to prove to the authorities that it has acted diligently and in good faith to try to understand, contain, mitigate and resolve an issue that could potentially result in criminal conduct or an administrative liability.

Further, using the results of an internal investigation, a company can improve its control processes and compliance functions, and implement preventative measures to prevent future infringements. Some law enforcement authorities may even provide ‘legal benefits’ to a company that has an internal compliance department focusing on the prevention of criminal conduct. For example, Article 11 of the Federal Criminal Code allows for a reduction in criminal liability of up to one-quarter of the penalty provided under Article 422 of the Criminal Procedures National Code (liability of corporations) provided that the corporation can prove that, before the commission of the conduct for which the company is being accused, it had a compliance department in charge of preventing criminal conduct and that, before or after being accused, it sought to mitigate the damage caused by the adduced conduct.

Attorney–client privilege

37Can attorney–client privilege be claimed over any aspects of internal investigations in your country? What steps should a company take in your country to protect the privilege or confidentiality of an internal investigation?

Yes, attorney–client privilege may be claimed over communications exchanged between counsel and his or her client. This criterion has been developed only recently in Mexican law: in an antitrust investigation, the Mexican Supreme Court held that privilege covers communications between a client and its external counsel. In judicial terms, ‘communication’ is understood to refer to all information exchanged and thus refers to both spoken or written communications (e.g., oral conversations, emails) or work-product (such as written notes, memorandums).

The steps needed for this privilege to attach are that there shall be a contractual relationship between the client and its external counsel, and that there is evidence to prove that the work-product arguably protected is related to the contract between the client and its counsel.

38Set out the key principles or elements of the attorney–client privilege in your country as it relates to corporations. Who is the holder of the privilege? Are there any differences when the client is an individual?

Rather than a specific attorney–client privilege, there is a general obligation for all professionals, including attorneys, to maintain professional secrecy. In the legal profession, this involves both a right to refuse to disclose information about a client, and a duty not to testify, produce documents or disclose any information against a client’s interests. Lawyers cannot be compelled to testify against their clients.

The holder of the attorney–client privilege in Mexico is, as a general rule, the client, but sometimes the attorney, depending on the specific case and the interests involved.

39Does the attorney–client privilege apply equally to in-house and external counsel in your country?

As of January 2017, as consequence of a case dealing with this issue in the realm of antitrust law, the Supreme Court held that the privilege attaches only with regard to external counsel. Principles regarding attorney–client privilege in antitrust law are also incorporated in the technical criteria of 11 December 2018 published by COFECE regarding the management of information derived from legal counsel provided to companies subject to antitrust law.

40Does the attorney–client privilege apply equally to advice sought from foreign lawyers in relation to (internal or external) investigations in your country?


41To what extent is waiver of the attorney–client privilege regarded as a co-operative step in your country? Are there any contexts where privilege waiver is mandatory or required?

It is not necessary to waive the attorney–client privilege as part of your co-operation with the authorities. However, counsel has a fiduciary duty towards his or her client to preserve the secrecy behind the privilege.

42Does the concept of limited waiver of privilege exist as a concept in your jurisdiction? What is its scope?

No. However, a client may waive the attorney–client privilege if the waiver satisfies the requirements provided under Articles 6 and 7 of the Federal Civil Code that the waiver:

  • does not affect public policy or the interests of third parties; and
  • is carried out in clear and precise terms, in such a way that leaves no doubt as to the waiving party’s intention to waive.

43If privilege has been waived on a limited basis in another country, can privilege be maintained in your own country?

Generally, if the privilege was waived in another country and the waiver was carried out in a manner that fulfils the Mexican law requirements referred to in question 42, the privilege will be considered waived in Mexico as well.

44Do common interest privileges exist as concepts in your country? What are the requirements and scope?

There is no specific concept of common interest privileges in Mexico. However, there are other recognised privileges under Mexican law, such as banking secrecy and tax secrecy.

45Can privilege be claimed over the assistance given by third parties to lawyers?

Yes. When a third party is providing assistance to a lawyer, there can be an independent privilege of professional secrecy between the lawyer and the third party. If the assistance provided by a third party is connected to the relationship between the lawyer and his or her client, that assistance would also be protected by the attorney–client privilege. Best practice is for external counsel to retain third parties directly and thus secure preservation of this privilege.

Witness interviews

46Does your country permit the interviewing of witnesses as part of an internal investigation?

Yes, as there is no legal provision that prohibits such interviews.

47Can a company claim attorney–client privilege over internal witness interviews or attorney reports?

Yes, attorney–client privilege will cover an attorney’s work-product if the preparation of the work-product was consistent with the attorney’s retention agreement and the discharge of his or her fiduciary duties towards the client.

48When conducting a witness interview of an employee in your country, what legal or ethical requirements or guidance must be adhered to? Are there different requirements when interviewing third parties?

There are no laws setting out particular requirements regarding a witness interview of an employee. However, best practice would include:

  • informing the employee that the attorney represents only the company and not the employee individually;
  • making the employee aware of the right to have one’s own representation;
  • explaining the purpose of the interview and the allegations that are being investigated;
  • warning the employee that lying or omitting information could constitute illicit conduct; and
  • asking the witness if he or she is aware of the company’s integrity policies.

Similar requirements apply when interviewing third parties.

49How is an internal interview typically conducted in your country? Are documents put to the witness? May or must employees in your country have their own legal representation at the interview?

An internal interview will often include the following:

  • discussing the background of the interviewee;
  • explaining of the nature of the investigation;
  • asking the witness about the facts being investigated;
  • putting to the witness relevant documents found during the course of the investigation and requesting an explanation from the witness; and
  • listening to the witness’s clarifications and explanations.

As mentioned in question 48, witnesses have the right to have their own legal representation during the interview. However, no statute or law mandates that the company provides a lawyer for witnesses or employees being interviewed.

Reporting to the authorities

50Are there circumstances under which reporting misconduct to law enforcement authorities is mandatory in your country?

It is mandatory pursuant to Article 222 of the Criminal Procedures National Code. However, as discussed in question 33, there is no sanction for non-compliance with this ‘obligation’.

51In what circumstances might you advise a company to self-report to law enforcement even if it has no legal obligation to do so? In what circumstances would that advice to self-report extend to countries beyond your country?

Voluntary reporting may be advisable if failing to report could result in more severe consequences for the company and self-reporting could be used as a defence measure to make a request to the relevant law enforcement authority (national or international) for a reduction in sanctions.

52What are the practical steps you need to take to self-report to law enforcement in your country?

  • Identify the law enforcement authorities to which the company should self-report.
  • Identify the legal consequences the company may face after self-reporting.
  • Prepare the findings and seek evidence.
  • Willingly co-operate with the law enforcement authorities during the course of their investigation.
  • Seek penalty reductions for co-operating parties.

Responding to the authorities

53In practice, how does a company in your country respond to a notice or subpoena from a law enforcement authority? Is it possible to enter into dialogue with the authorities to address their concerns before or even after charges are brought? How?

Companies may engage in a dialogue with the authorities and opt to co-operate in their investigation to try to seek a reduction of sanctions. Criteria that are taken into account by the authorities are that the co-operating party is the first to co-operate (assuming there are several parties in the investigated scheme), that it provides meaningful evidence to the authorities, that it co-operates continuously with the authorities, and that it suspends its participation in the scheme. Once an authority brings charges against a company, as a general rule, the company may enter into a dialogue to address the authority’s concerns.

54Are ongoing authority investigations subject to challenge before the courts?

Yes. They can be challenged using legal remedies provided by procedural law governing the relevant law enforcement authority (e.g., contentious administrative proceedings or nullity trial) or by constitutional remedies (e.g., constitutional review of amparo claims).

55In the event that authorities in your country and one or more other countries issue separate notices or subpoenas regarding the same facts or allegations, how should the company approach this?

As a general rule, the best practice will be for companies to seek to negotiate a consistent disclosure package between the various countries issuing notices or subpoenas.

56If a notice or subpoena from the authorities in your country seeks production of material relating to a particular matter that crosses borders, must the company search for, and produce material, in other countries to satisfy the request? What are the difficulties in that regard?

Typically, a company will be required to search for and produce all evidence responsive to the subpoena, even when that evidence is outside Mexico. This issue often arises in investigations relating to bribery of foreign officials, as, although the underlying conduct occurs in other jurisdictions, the conduct is prosecutable in Mexico. Difficulties may arise when responsive evidence exists in a foreign jurisdiction, but production of the evidence in response to the subpoena would violate that jurisdiction’s confidentiality laws. However, Mexico has multilateral co-operation agreements with several countries that enable authorities to formulate direct requests to obtain evidence that exists abroad.

57Does law enforcement in your country routinely share information or investigative materials with law enforcement in other countries? What framework is in place in your country for co-operation with foreign authorities?

Yes, Mexico has signed bilateral international treaties under which the parties agree to provide mutual assistance to law enforcement authorities from the signatory countries when requested. Several laws in Mexico include provisions relating to international co-operation; however, the most relevant laws are the Federal Procedure Civil Code, the Mexican Commerce Code and the Criminal Procedures National Code (for co-operation in criminal matters).

58Do law enforcement authorities in your country have any confidentiality obligations in relation to information received during an investigation or onward disclosure and use of that information by third parties?

Yes, under Article 113 of section XI of the General Law of Transparency and Access to Public Information, judicial and administrative files are kept confidential until a final ruling on the matter has been made. Personal information contained in such files are confidential and can never be disclosed.

Furthermore, under Article 106 of the National Criminal Procedure Code, authorities cannot disclose confidential information regarding the personal data of the defendant or any related individual, or share information with third parties. Personal information contained in such files is confidential and can never be disclosed, except to a party involved in the proceedings.

59How would you advise a company that has received a request from a law enforcement authority in your country seeking documents from another country, where production would violate the laws of that other country?

The advice would be to:

  • state and demonstrate that the production of such documents would violate the law of the foreign country; or
  • state that by producing the documents, the company might be subject to the penalties provided by the foreign law.

Accordingly, it would be ‘legally impossible’ to perform the object of the request.

60Does your country have secrecy or blocking statutes? What related issues arise from compliance with a notice or subpoena?


61What are the risks in voluntary production versus compelled production of material to authorities in your country? Is this material discoverable by third parties? Is there any confidentiality attached to productions to law enforcement in your country?

When a company produces material voluntarily, it has greater latitude to decide what information to give to the authorities. When compelled, the authorities specify the documents and information that have to be provided, and therefore the company can face sanctions if it fails to comply.

As general rule, material – whether produced voluntarily or compelled – is not discoverable by third parties.

With regard to confidentiality, all types of documents and evidence provided to an authority by an individual are confidential and can only be disclosed to the parties involved in the proceedings. Once the courts enter their corresponding judgments, only the judgment will be published and all private information about the parties (such as their identities) is often redacted. Under Article 70 of the General Law of Transparency and Access to Public Information, all the Mexican law enforcement authorities shall publish ‘all resolutions and judgments rendered in processes followed in a manner of trial’. However, Article 73 provides that the law enforcement authorities shall publish ‘only the public versions of the judgments that are considered to be of public interest’. Thus, at least in Mexican law, the publication of judgments refers only to the courts’ discretion.

Prosecution and penalties

62What types of penalties may companies or their directors, officers or employees face for misconduct in your country?

Pursuant to Article 422 of the National Code of Criminal Proceedings, the penalties that a company can face for engaging in misconduct include:

  • fines;
  • confiscation of the instruments used in committing the misconduct;
  • disgorgement;
  • publication of the judgment;
  • suspension of activities;
  • dissolution of the company;
  • closing down the company’s business establishments;
  • a ban on any future execution of the types of activities the exercise of which resulted in the misconduct;
  • temporary disqualification – for an established period of time – from participating, directly or through a representative, in public contracting procedures such as public bids and government contracts;
  • judicial intervention to safeguard the rights of workers or creditors (i.e., the imposition of a government-controlled trustee to remove the company’s management so as to halt the alleged crime); and
  • public warnings.

Additionally, the directors, officers and employees can be individually responsible for the misconduct and may be punished with a penalty as provided under Article 24 of the Federal Criminal Code, such as:

  • imprisonment;
  • community service;
  • a ban on attending certain places (as determined by the facts of the case);
  • fines and fees;
  • suspension or deprivation of rights;
  • disqualification, dismissal or suspension of functions; or
  • a requirement to wear a tracking or surveillance device.

63Where there is a risk of a corporate’s suspension, debarment or other restrictions on continuing business in your country, what options or restrictions apply to a corporate wanting to settle in another country?

Under Article 81 of the General Law of Administrative Responsibilities, companies that perform unlawful acts (e.g., bribe, influence peddling, use of false information, collusion, misuse of public resources) are subject to the following penalties:

  • temporary disqualification from participating in government contracts for a specified period of between three months and 10 years;
  • suspension from continuing with business activities for a specified period of between three months and three years; or
  • dissolution of the legal entity.

If a company wishes to settle in another country, for that settlement to have effect in Mexico it must be agreed with the Mexican authorities. The General Law of Administrative Responsibilities offers benefits for self-reporting companies, including being spared debarment. Thus, it may be advisable for companies that rely on government contracts to self-disclose and seek leniency from the administrative authorities.

The same principle applies under criminal law. Self-disclosure may bring benefits to the co-operating culpable party provided that it satisfies certain conditions, among which remediation for the damage caused is paramount.

64What do the authorities in your country take into account when fixing penalties?

Pursuant to Article 410 of the Criminal Procedures National Code, the court shall consider the severity of the crime and the criminal liability of the offender.

The severity of the crime is determined by the value of the legally protected interest, its consequences, the nature of the conduct (wilful or negligent), the means employed, the circumstances of time, mode and place of the event, and the intervention of the defendant.

To determine the criminal liability of the defendant, the court shall consider the circumstances of the event and the wilfulness of the defendant in committing the crime.

Resolution and settlements short of trial

65Are non-prosecution agreements or deferred prosecution agreements available in your jurisdiction for corporations?

Yes, pursuant to Article 256 of the Criminal Procedures National Code, once an investigation begins, the offender can request that the prosecution authorities refrain from instituting a criminal prosecution based on the application of ‘opportunity criteria’, as long as the damage caused to the victims has been repaired or guaranteed.

These opportunity criteria are only applicable in the situations set forth under Article 256
of the Criminal Procedures National Code, and may apply:

  • when the crime is not punishable by imprisonment, when it has an alternative penalty or when the jail penalty does not exceed five years, as long as the crime did not involve the use of violence;
  • in the case of white-collar crimes committed without violence;
  • if the defendant suffered serious damage as a consequence of the crime;
  • if the penalty that could be imposed would lack relevance considering another judgment already imposed or that could be imposed;
  • if the accused party provides essential and effective information for the prosecution of a more severe crime than the one attributed to the accused party, and the accused party agrees to testify; or
  • if criminal prosecution would be disproportionate or unreasonable considering the causes or circumstances surrounding the commission of the crime.

It is common for the prosecution authorities in Mexico to apply one of the opportunity criteria when it is advantageous to the offender, the victim and the authorities. The possible advantages include (1) fast and effective repair of damage to the victim, (2) no prison penalty, (3) co-operation in the prosecution of more severe crimes, and (4) redress of the damage caused by the crime.

66Does your jurisdiction provide for reporting restrictions or anonymity for corporates that have entered into non-prosecution agreements or deferred prosecution agreements until the conclusion of criminal proceedings in relation to connected individuals to ensure fairness in those proceedings?

In Mexican legislation, there are no specific reporting restrictions for corporates that have entered into non-prosecution or deferred prosecution agreements. However, given the nature of non-prosecution and deferred prosecution agreements in Mexico, parties usually agree upon certain conditions for the compliance of the agreement, such as constant co-operation, community service or refraining from certain types of conduct.

67Prior to any settlement with a law enforcement authority in your country, what considerations should companies be aware of?

Before entering into a settlement with a law enforcement authority, companies should consider:

  • the applicable law that would regulate the procedure that allows the application of a settlement agreement;
  • the possible legal consequences that the settlement may bring to the company (regarding civil, commercial, criminal and administrative matters);
  • the possible legal consequences faced by the company’s directors, officers and employees; and
  • the extent to which the settlement agreement would mitigate the most risks and consequences for the company.

68To what extent do law enforcement authorities in your country use external corporate compliance monitors as an enforcement tool?

It is not common for Mexican law enforcement authorities to use external corporate compliance monitors as enforcement tools.

69Are parallel private actions allowed? May private plaintiffs gain access to the authorities’ files?

Yes. Therefore, a defendant may be prosecuted for a criminal act and, at the same time, for a civil claim regarding the same actions.

Private plaintiffs can only gain access to the authorities’ files if they are a party to the specific proceeding to which the plaintiffs are seeking access, or if a court requests the authority to produce its files.

Publicity and reputational issues

70Outline the law in your country surrounding publicity of criminal cases at the investigatory stage and once a case is before a court.

Under section XII of Article 113 of the General Law of Transparency and Access to Public Information, criminal investigations undertaken by the public prosecutor are classified. Thus, this information will not be public unless the court discloses it.

Also, Article 5 of the Criminal Procedures National Code provides that all hearings must be public. However, there are exceptions regarding publicity about criminal hearings, such as if the publicity affects the integrity of any of the parties or public security.

71What steps do you take to manage corporate communications in your country? Is it common for companies to use a public relations firm to manage a corporate crisis in your country?

In complex litigation and in situations involving serious crises that affect a company’s reputation, it is common practice to retain a public relations firm to manage the situation. Public perception will often have an influence on how the authorities view a case and will guide how they interpret public policy in reaching their decision.

72How is publicity managed when there are ongoing related proceedings?

Ongoing proceedings are confidential until the issuance of the final judgment (except for personal data, which is generally not disclosed even after a final judgment). Nevertheless, there is often media attention surrounding high-profile cases, particularly with regard to matters of interest to the general public. Sometimes the parties to the proceedings provide information themselves to the media, and even the extent of the conflict itself is publicised. Moreover, it is not uncommon for information about high-profile cases to be leaked to the press and thus become public. Depending on the nature of the case, a party involved in a complex litigation or investigation may attempt to use the media to generate positive public opinion about the merits of its arguments.

Duty to the market

73Is disclosure to the market in circumstances where a settlement has been agreed but not yet made public mandatory?

As general rule, there is no obligation to disclose settlements to the market. Article 105 of the Securities Market Law provides that companies registered on the Mexican Stock Exchange must disclose ‘relevant events’. A settlement could be interpreted as a relevant event if, for example, if it could affect the share price.

Anticipated developments

74Do you expect to see any key regulatory or legislative changes emerge in the next year or so designed to address corporate misconduct?

On 12 August 2019, the National Law of Asset Forfeiture (NLAF) came into force, replacing all previous laws on the subject. The NLAF regulates asset forfeiture in favour of the Mexican state regarding property with an illicit origin, use or purpose, and the administration and disposal of such property.

Pursuant to the NLAF, property shall only be subject to asset forfeiture if it is related to criminal investigations or criminal proceedings regarding the following:

  • corruption;
  • concealment;
  • crimes perpetrated by public officials;
  • organised crime;
  • vehicle robbery;
  • operations using resources of illicit origin;
  • crimes against public health;
  • kidnapping;
  • extortion;
  • human trafficking; and
  • crimes relating to hydrocarbons, petroleum products and petrochemicals.

The forfeiting of assets is a civil action – independent of any criminal proceeding – and it will occur in cases where the defendant may not prove legitimate ownership of the assets.

Furthermore, the Ministry of Public Function introduced an integrity programme in late August 2019 to prevent corporate misconduct by establishing mandatory integrity standards among companies in Mexico. The main purposes of this programme are:

  • that companies contracting with the Mexican government have principles of probity and integrity certified by competent authorities;
  • support and training for companies moving towards a culture of integrity;
  • the development of integrity materials and compliance training for Mexican companies;
  • the creation of simple materials and content, such as infographics and videos, to ensure that the integrity principles are known and understood at all levels of the company;
  • unification of international standards of integrity; and
  • the creation of direct reporting channels to the Ministry of Public Function.

According to statements made by the Ministry of Public Function, the law regulating the integrity corporate programme shall be presented to Congress at the beginning of 2020, and compliance with the integrity standards by Mexican companies is expected to be mandatory by 2021.


1 Diego Sierra is a partner at Von Wobeser y Sierra, SC

Unlock unlimited access to all Global Investigations Review content