General context, key principles and hot topics

1 Identify the highest-profile corporate investigation under way in your country, describing and commenting on its most noteworthy aspects.

There is no public registry or index of final federal and local judgments to consult about cases in which legal entities have been found guilty of federal and local crimes. However, the media often publicises high-profile cases, most of which involve public officers.

During the past few years, there have been several high-profile investigations in Mexico. One of the most notorious cases involves Elba Esther Gordillo, former president of the National Education Workers’ Union, who in 2013 was formally arrested and accused of embezzling US$200 million from the union and organised crime. She was released in 2018 and the trial was dismissed for lack of evidence.

In 2020, Emilio Lozoya, former chief executive officer of the Mexican state-owned oil company Petróleos Mexicanos (Pemex), was detained in Spain and extradited to Mexico to face bribery charges. He was accused of receiving bribery payments of US$10 million from Odebrecht (a Brazilian construction company) during 2016. The investigation is still open and Lozoya is currently under house arrest.

2 Outline the legal framework for corporate liability in your country.

The Mexican legal framework regarding criminal liability of legal entities is not unified. Although there is a National Code of Criminal Procedures (NCCP), which is a procedural norm that applies throughout Mexico, there is no substantive national law (i.e., a national criminal code). Therefore, the criminal codes of each of the Mexican states face the challenge of adapting to the provisions of the NCCP.

Criminal liability in Mexico is mainly governed by (1) the NCCP, at a federal and local level, (2) the Federal Criminal Code (FCC) and the federal laws that contain a list of crimes, and (3) at a local level, the criminal codes of each of the Mexican states.

The NCCP contains a chapter establishing the criminal procedure with respect to legal entities facing potential criminal liability. Under the NCCP, all legal entities can be held liable for crimes committed in their name, on their behalf or through the means provided by them when, additionally, it has been determined that there was non-observance of due control in the organisation. Under these circumstances, under the NCCP, managers and representatives of the entity are subject to criminal liability as well as the entity itself. Furthermore, the FCC includes a chapter identifying the crimes applicable to legal entities and the criminal codes of certain Mexican states, such as the Criminal Code for the Federal District (Mexico City), also include provisions that refer to the criminal liability of legal entities.

Finally, the General Law on Administrative Responsibilities (GLAR) sets forth the administrative liability of legal entities. Under the GLAR, all legal entities can be held liable for acts committed by their employees, managers, directors or other persons acting to obtain an improper benefit on behalf of the legal entity, if the acts constitute serious administrative offences, such as bribery, among others. The administrative sanctions and administrative procedures provided under the GLAR are independent from the criminal sanctions and criminal procedures applicable under the criminal legislation referred to above.

3 Which law enforcement authorities regulate corporations? How is jurisdiction between the authorities allocated? Do the authorities have policies or protocols relating to the prosecution of corporations?

There are multiple federal and local sanctioning authorities in Mexico, with relevant jurisdiction and competence established by law.

The Attorney General’s Office of the Republic, the Attorney General’s Offices and the Attorney General’s Offices of the federal agencies are the key regulatory or enforcement bodies of criminal justice in Mexico.

Under the NCCP, the control judges (those with jurisdiction to rule if a person is criminally liable) at a federal or local level intervene from the beginning of the proceeding until the formal trial, whether local or federal, is formally initiated. Thereafter, the trial court at a federal or local level, comprised of one or three judges, intervene once the trial is initiated and until the final judgment is issued. If the judgment is appealed, the appellate court, comprised of one or three magistrates, at a federal or local level, will be responsible for resolving the appeal.

4 What grounds must the authorities have to initiate an investigation? Is a certain threshold of suspicion necessary to trigger an investigation?

The Public Prosecutor’s Office must commence or continue a criminal investigation whenever it becomes aware of a crime. The Public Prosecutor’s Office cannot suspend, interrupt or cease the investigation, except as provided by law. The Public Prosecutor’s Office and the police must proceed ex officio with investigating the issues of which they have notice.

The police must verify the veracity of information originating from anonymous sources through the investigative actions they deem appropriate. If the information is confirmed, the corresponding investigation will be initiated at their discretion. Their power to initiate an investigation is very broad, the only requisite being to have an objective cause.

The investigation must be carried out in an immediate, efficient, exhaustive, professional and impartial manner, free of any prejudice or discrimination, and must explore all possible investigation leads to assess whether a crime was committed, and who committed and participated in the crime.

5 How can the lawfulness or scope of a notice or subpoena from an authority be challenged in your country?

Legal entities and individuals may challenge a notice or subpoena by filing a preliminary defence or injunction before the federal or local court.

6 Does your country make use of co-operative agreements giving immunity or leniency to individuals who assist or co-operate with authorities?

Immunity or leniency to individuals who assist or co-operate with authorities could be applied under certain criteria and only if the damage caused by the criminal offence has been made good or rectified. In general, tax crimes and crimes that seriously affect the public interest are not subject to this type of agreement.

7 What are the top priorities for your country’s law enforcement authorities?

The top priority for law enforcement authorities in Mexico has been, and continues to be, the investigation and prosecution of acts of corruption, including bribery, fraud and money laundering.

In 2015, Mexico embarked on sweeping constitutional reforms that created the National Anti-Corruption System, empowering competent authorities at all government levels to prevent and fight corruption. As part of these reforms, several key pieces of legislation were amended, and new laws were enacted, including the GLAR in 2016.

8 To what extent do law enforcement authorities in your jurisdiction place importance on a corporation having an effective compliance programme? What guidance exists (in the form of official guidance, speeches or case law) on what makes an effective compliance programme?

Under the NCCP, a corporate entity may be held liable for the commission of a crime if two elements are met: (1) the crime was committed in the name of, on behalf of, for the benefit of or through the means provided by the legal entity; therefore, even when the crime is not committed in the name or on behalf of the legal entity, if the latter receives any benefit from it or provides the means (e.g., computers or cars) used in the commission of the crime, the legal entity will be equally responsible for the crime committed, and (2) the entity did not observe due control (i.e., there was a lack of adequate internal controls or policies to prevent the commission of the crime or adequate supervision or surveillance of the internal controls or policies). Although the NCCP and the FCC are silent regarding what would be considered non-observance of due control, court precedent illustrates that a company using due control is one that uses its best efforts and best practices with available resources to prevent violations.

The GLAR also factors in a corporate entity’s integrity policy when assessing its administrative liability. The GLAR specifically considers the following elements of a corporate entity’s integrity policy when making this determination:

  • a clear and complete organisation and procedures manual, in which the functions and responsibilities of each of its areas are defined, and that clearly specifies the different chains of command and leadership throughout the structure;
  • a code of conduct duly published and notified to members of the legal entity, which has active systems and mechanisms;
  • adequate and effective control, surveillance and auditing systems, which constantly and periodically examine compliance with integrity standards throughout the legal entity;
  • adequate reporting systems, both within the legal entity and towards the competent authorities, as well as disciplinary processes and specific consequences for those who infringe the internal regulations or the applicable Mexican legislation;
  • adequate training and coaching systems and processes regarding the integrity measures referenced herein;
  • human resources policies aimed at avoiding the incorporation of persons who may generate a risk to the integrity of the legal entity, provided that such polices are not discriminatory; and
  • mechanisms that ensure the transparency and publicity of its interests at all times.

Pursuant to the NCCP and the GLAR, the existence of an adequate compliance programme is a mitigating factor for reducing sanctions.

Cyber-related issues

9 Does your country regulate cybersecurity? Describe the approach of local law enforcement authorities to cybersecurity-related failings.

The Federal Law for the Protection of Personal Data in Possession of Private Parties (Data Privacy Law), published on 6 July 2010, requires data controllers and data processors to adopt the necessary technical, physical and organisational measures to protect personal data against unauthorised loss or destruction, damage, alteration, change, theft, loss, copy, use, access or processing, or any other inappropriate or illicit processing (together, data breaches).

In the event of a personal data breach, the data controller must analyse the causes of the breach and implement the corrective, preventive and improvement actions to adapt the corresponding security measures to prevent future data breaches.

The data controller must immediately inform the affected data subjects of any confirmed security breaches occurring at any stage of the processing of the personal data that significantly affects the property or moral rights of the data subjects. The data controller must also promptly take all actions necessary to initiate an exhaustive review of the magnitude of the security breach to allow the affected data subjects to take adequate measures in response.

Currently, the Data Privacy Law establishes a requirement for legal entities to provide written notice to the National Transparency and Data Protection Agency (INAI) of any data breaches.

Finally, the INAI has issued several guidelines and recommendations in respect of cybersecurity and self-regulation schemes, and compliance with the duties under the Data Privacy Law and its regulations.

10 Does your country regulate cybercrime? What is the approach of law enforcement authorities in your country to cybercrime?

Mexican law includes specific norms against cybercrime, and other norms may apply to illegal activities conducted via the internet, software or hardware. The Federal Penal Code sets out the regulation of cybercrime.

Additionally, Mexico acts as an observer to the Convention on Cybercrime (known as the Budapest Convention) and Mexico’s Senate has exhorted the federal government to adhere to this Convention.

Finally, several states in Mexico, as well as Mexico City, have created a cyber police unit to oversee and provide citizens with preventive security measures for the responsible use of technological tools.

Cross-border issues and foreign authorities

11 Does local criminal law have general extraterritorial effect? To the extent that extraterritorial effect is limited to specific offences, give details.

Under the constitutional framework, there is no extraterritorial effect.

12 Describe the principal challenges that arise in your country in cross-border investigations, and explain whether and how such challenges depend on the other countries involved.

Cross-border investigations face three main challenges in Mexico: (1) the lack of international treaties; (2) the lack of coordination with authorities in other countries; and (3) the high occurrence of litigation that can arise from enforcement.

13 Does double jeopardy, or a similar concept, apply to prevent a corporation from facing criminal exposure in your country after it resolves charges on the same core set of facts in another? Is there anything analogous in your jurisdiction to the ‘anti-piling on’ policy as exists in the United States (the Policy on Coordination of Corporate Resolution Penalties) to prevent multiple authorities seeking to penalise companies for the same conduct?

Double jeopardy (non bis in idem) only applies in local processes. There is no legal basis for double jeopardy with international processes.

14 Are ‘global’ settlements common in your country? What are the practical considerations?

No, there is no legislation in this regard. However, there are opportunities to increase co-operation among agencies in Mexico and with foreign regulators.

15 What bearing do the decisions of foreign authorities have on an investigation of the same matter in your country?

The decisions of authorities in other countries do not have a direct consequence on investigations in Mexico. However, the facts and evidence can be used in an investigation in Mexico as an additional argument for decision-making.

Economic sanctions enforcement

16 Describe your country’s sanctions programme and any recent sanctions imposed by your jurisdiction.

There is no accumulative data about the economic sanctions imposed by different authorities. Despite this, we note several high-profile cases, such as that in respect of the former director of Petróleos Mexicanos (Pemex, the national oil and gas company), who allegedly participated in a fraudulent scheme with a private company.

17 What is your country’s approach to sanctions enforcement? Has there been an increase in sanctions enforcement activity in recent years, for example?

There is a lack of transparency and there is no clarity regarding the number of sanctions enforcement other than in high-profile cases, such as the alleged corruption at Pemex.

18 Do the authorities responsible for sanctions compliance and enforcement in your country co-operate with their counterparts in other countries for the purposes of enforcement?

Yes, there is co-operation for enforcement, which depends on whether there is an inter­national treaty in force. For example, there is strong co-operation with the United States and the European Union, which is better than with other countries.

19 Has your country enacted any blocking legislation in relation to the sanctions measures of third countries? Describe how such legislation operates.

Foreign law and lawful procedures are recognised; the general principle is that procedures must be in accordance with Mexico’s constitutional rights and due process rules.

20 To the extent that your country has enacted any sanctions blocking legislation, how is compliance enforced by local authorities in practice?

This is not applicable.

Before an internal investigation

21 How do allegations of misconduct most often come to light in companies in your country?

Allegations of misconduct most often come to the attention of companies through:

  • whistleblowers;
  • hotlines;
  • standard screening processes (anti-money laundering, anti-bribery, anti-corruption, sanctions and due diligence);
  • external and internal audits;
  • interviews with company executives;
  • internal controls;
  • tax reporting;
  • compliance;
  • media reports;
  • private civil complaints or litigation;
  • enforcement authorities’ investigations (subpoenas, search and seizure, and inquiries); and
  • news published in the media.

Information gathering

22 Does your country have a data protection regime?

The right to the protection of personal data is a constitutional right enshrined in the second paragraph of Article 16 of the Political Constitution of the United Mexican States. The Federal Law for the Protection of Personal Data in Possession of Private Parties (the Data Privacy Law) was published on 6 July 2010 and the Regulation of Mexican Federal Law for the Protection of Personal Data in Possession of Private Parties (Regulation of the Data Privacy Law) was published in December 2011. The regulatory authority, the National Transparency and Data Protection Agency (INAI), has also published several sets of guidelines regarding the processing of personal data, including Guidelines on Privacy Notices, Guidelines on Compliance with the Principles and Duties of the Data Privacy Law and Recommendations on Personal Data Security, which with the Data Privacy Law constitute the Mexican Data Protection Laws. The government authority has issued additional guidelines and recommendations regarding the obligations of legal entities and individuals under the Data Privacy Law. Additionally, Mexico is a party to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (known as Convention 108) and its Protocols.

23 To the extent not dealt with above at question 9, how is the data protection regime enforced?

Data subjects can enforce their rights to access, rectification, cancellation and opposition when no response is obtained from the data controller via INAI and, ultimately, the court system.

If any breach of the law or its regulations is alleged, INAI may perform an on-site inspection at the data controller’s facilities to verify compliance with the law.

Violations of the law may result in monetary penalties or imprisonment, including the following:

  • INAI may impose monetary sanctions in the range of 100 to 320,000 times the UMA (unit of measure and actualisation – the standard unit to levy a fine, which is updated every year). Sanctions may be increased to up to twice these amounts for violations involving sensitive personal data.
  • Three months to three years of imprisonment may be imposed on any person authorised to process personal data who, for profit, causes a security breach affecting the databases under its custody. Penalties will be doubled if sensitive personal data is involved.
  • Six months to five years of imprisonment may be imposed on any person who, with the aim of obtaining unlawful profit, processes personal data deceitfully, taking advantage of an error by the data subject or a person authorised to process the data. Penalties will be doubled if sensitive personal data is involved.

In determining the appropriate sanctions, the INAI will consider:

  • the nature of the data;
  • the refusal of the data controller to carry out the acts requested by the data subject, in accordance with the law;
  • the intentional or unintentional nature of the action or omission constituting the offence;
  • the economic capacity of the data controller; and
  • recidivism.

The sanctions imposed by the INAI are without prejudice to any further civil or criminal liability.

24 Are there any data protection issues that cause particular concern in internal investigations in your country?

The INAI will verify compliance with the Data Privacy Law and its regulations. The verification may be initiated ex officio or at the request of a party. An ex officio verification will proceed when there is non-compliance with resolutions issued on procedures for the protection of rights referred to in the Data Privacy Law or the existence of violations of that Law when founded and motivated.

During the verification procedure, the INAI will have access to the information and documentation that it considers necessary, pursuant to the resolution that motivates it.

Federal public servants are obliged to keep confidential the information they obtain from the corresponding verification.

In particular, it is important for controllers to make the privacy notice available to data subjects prior to processing personal data and to request their consent when required. Furthermore, controllers must establish a procedure to deal with requests regarding the rights of data subjects under the Data Privacy Law.

25 Does your country regulate or otherwise restrict the interception of employees’ communications? What are its features and how is the regime enforced?

The general rule is that employees should not have any expectation of privacy when using resources offered by the employer for employment-related activities. This position is strengthened if the employer establishes clear policies on the monitoring of employees’ activities in the workplace and the use of company-provided resources. However, consent is required prior to processing any personal data of employees and a privacy notice must be made available to employees prior to processing any personal data.

Dawn raids and search warrants

26 Are search warrants or dawn raids on companies a feature of law enforcement in your country? Describe any legal limitations on authorities executing search warrants or dawn raids, and what redress a company has if those limits are exceeded.

Search warrants and dawn raids are a feature of law enforcement in Mexico, but only with respect to specific matters, such as criminal, antitrust and tax investigations, among others. According to the Political Constitution of the United Mexican States, no person shall be disturbed in his or her private affairs, his or her family, papers or properties, or be invaded at home without a written order from a competent authority, duly explaining the legal grounds and the cause of the proceeding. If the relevant authority exceeds its powers, the affected party may challenge the relevant search warrant through an extraordinary constitutional appeal (called amparo) for the violation of its rights, whereby it is possible to obtain an injunction against a raid, and then annul the raid and its effects.

27 How can privileged material be lawfully protected from seizure during a dawn raid or in response to a search warrant in your country?

In criminal proceedings, the right to privacy of any person shall be respected. Any information that refers to a person’s private life and personal data shall be protected, under the terms and with the exceptions established by the applicable legal provisions.

Under recent precedents regarding dawn raids conducted by the Antitrust Commission, the attorney–client privilege must be protected and, therefore, the agencies cannot seize and use documents protected by the attorney–client privilege in their investigations.

28 Under what circumstances may an individual’s testimony be compelled in your country? What consequences flow from such compelled testimony? Are there any privileges that would prevent an individual or company from providing testimony?

As a general rule, every person who is a witness is obliged to testify regarding the facts investigated. However, there are several exceptions, such as in the case of guardians, spouses, blood relatives, lawyers, consultants and journalists, among others, as well as the right against self-incrimination under the protection of Article 20 of the Constitution.

Whistleblowing and employee rights

29 Describe the whistleblowing framework in your country. What financial incentive schemes exist for whistleblowers? What legal protections are in place for whistleblowers?

The General Law on Administrative Responsibilities establishes that the compliance programmes of legal entities should have adequate systems for internal whistleblowing reports and for reporting to competent authorities. Other than this, whistleblowing is not a concept regulated under the Mexican legal framework.

30 What rights does local employment law confer on employees whose conduct is within the scope of an investigation? Is there any distinction between officers and directors of the company for these purposes?

In general, the respect and dignity of employees and non-discriminatory conditions at work must be assured at all times. Discretionary measures should be adopted to prevent disclosure of information that could harm employees and their reputation. For example, internal investigations into an employee’s conduct are kept confidential to the extent possible.

Under the Labour Law, there is no distinction between officers and directors of the company.

31 Do employees’ rights under local employment law differ if a person is deemed to have engaged in misconduct? Are there disciplinary or other steps that a company must take when an employee is implicated or suspected of misconduct, such as suspension or in relation to compensation?

Employees involved in any misconduct during working hours, such as lack of probity or honesty, acts of violence, threats, insults or bad behaviour, or any crime outside work may be dismissed with cause by the employer. Suspension of work is applicable in the case of preventive imprisonment until a trial is conducted or the arrest of an employee.

32 Can an employee be dismissed for refusing to participate in an internal investigation?

The employment relationship can only be terminated without severance in the circumstances provided by law. Refusing to participate in an internal investigation is not a due cause for termination without severance under the law. However, employers may dismiss employees who refuse to participate, as long as mandatory severance is paid to them.

Commencing an internal investigation

33 Is it common practice in your country to prepare a document setting out terms of reference or investigatory scope before commencing an internal investigation? What issues would it cover?

Mexico is part of several conventions and treaties that encourage internal investigations regarding anti-corruption and compliance. In general, it is good practice to prepare a document that sets out the investigatory scope. This document generally covers the questions to be clarified, which mechanisms will be used to achieve those clarifications (e.g., gathering computer storage records and cell phone data, interviews and background checks), identification of the parties potentially involved, any potential violations of the legislation and the authorities with jurisdiction.

34 If an issue comes to light prior to the authorities in your country becoming aware or engaged, what internal steps should a company take? Are there internal steps that a company is legally or ethically required to take?

Despite not having legal provisions in this sense, as soon as an irregularity is reported or identified internally, companies must initiate an internal investigation to collect relevant evidence in accordance with its internal investigation protocols, which should provide the steps to be taken, such as to:

  • check whether there are special circumstances, such as senior management involvement or legal violations;
  • identify whether there is a need to protect and collect data from the people allegedly involved;
  • identify whether there is a need to suspend payments or contracts;
  • select people to interview, if applicable; and
  • conduct corroboration and financial analyses, if applicable.

35 What internal steps should a company in your country take if it receives a notice or subpoena from a law enforcement authority seeking the production or preservation of documents or data?

A company should immediately involve its legal team (in-house, external or both) to identify the extent of the allegations, the potential risks, whether other authorities would also have jurisdiction, and which stakeholders should be informed.

The company must respond to the authority in a timely manner, be co-operative and transparent and provide all the information requested in an accessible format. In the meantime, the company should conduct its own investigation into the allegations.

It is also very important to establish which documents are subject to the attorney–client privilege.

36 At what point must a company in your country publicly disclose the existence of an internal investigation or contact from a law enforcement authority?

Disclosing an internal investigation is not mandatory and not very common in Mexico. The decision to report the existence of an internal investigation to the law enforcement authorities depends on several factors, including whether the company has shares that are traded publicly.

For example, if a company is publicly traded, and the matter under investigation is one that would materially affect shareholders and prospective shareholders and there is public knowledge of a fact that needs to be the subject of an internal investigation, the company should make public the fact that it is conducting an internal investigation.

If a company decides to disclose the findings of an internal investigation, the timing and quality of disclosure should be carefully considered. For example, to fulfil the requirements of a leniency agreement, the company must be the first to contact the authorities and disclose its findings, provide documents that demonstrate a violation and identify the individuals involved in the offence.

37 How are internal investigations viewed by local enforcement bodies in your country?

So long as applicable laws are not contravened, internal investigations are encouraged by local law enforcement agencies. However, the investigations have to be conducted while respecting constitutional rights – such as the right to remain silent in interviews, the right of privacy and the right to be accompanied by a lawyer if requested – otherwise its use in a formal proceeding could be considered null.

Attorney–client privilege

38 Can the attorney–client privilege be claimed over any aspects of internal investigations in your country? What steps should a company take in your country to protect the privilege or confidentiality of an internal investigation?

Yes, it can be claimed over an internal investigation. Although the attorney–client privilege is recognised by the Mexican Federal Constitution, there are very few regulations in this respect. Under Article 36 of the Regulatory Law under Chapter 5 of the Constitution (Federal Law), regarding the practice of professions in Mexico City: ‘All professionals shall be obliged to keep strictly secret the matters entrusted to them by their clients, except for the obligatory reports established by specific laws.’

Also, in accordance with Article 364 of the National Code of Criminal Procedures, the testimony of a person will be inadmissible if the person, in connection with the object of their statement, has a duty to maintain secrecy due to their knowledge of the facts by reason of their office or profession, such as, among others, lawyers and public officials in respect of information that is not subject to disclosure according to the laws of the matter.

Some local (state) criminal codes consider the infringement of professional secrecy as a crime.

Federal law and many of the local civil codes establish indemnifications and other liabilities in respect of unauthorised disclosure of professional or trade secrets.

A company should identify privileged information and keep it separate from all other information to prevent a breach of the attorney–client privilege. Anyone preparing official written corporate communications must take care regarding materials and information that are privileged and confidential and prevent third parties from forwarding or transmitting such publicly undisclosed information. Also, companies can implement measures to maintain confidential information and restrict it to only key participating individuals, keeping counsel copied in.

The company would have to take at least indicative steps to protect the privilege and confidentiality of the investigation.

39 Set out the key principles or elements of the attorney–client privilege in your country as it relates to corporations. Who is the holder of the privilege? Are there any differences when the client is an individual?

Secrecy is a legal duty: attorneys may invoke the attorney–client privilege to avoid disclosing a client’s information unless the client authorises disclosure. The attorney has the right to object to disclosure or refuse to testify. However, it is the client who ultimately controls the privilege, regardless of whether it is a corporation or an individual. This means that the attorney is required to receive the client’s permission and consent to share the information.

Considering a corporation can be the client and the owner of the information, the corporation’s legal representative takes control of the protections on behalf of the corporation and has the duty to act in the corporation’s best interests.

40 Does the attorney–client privilege apply equally to in-house and external counsel in your country?

Yes. In accordance with Article 36 of the Regulatory Law under Chapter 5 of the Constitution, regarding the practice of professions in Mexico City: ‘All professionals shall be obliged to keep strictly secret the matters entrusted to them by their clients, except for the obligatory reports established by specific laws and in specific events.’

41 Does the attorney–client privilege apply equally to advice sought from foreign lawyers in relation to investigations in your country?

Yes. The general rule established in Article 36 of the Regulatory Law under Chapter 5 of the Constitution, regarding the practice of professions in Mexico City: ‘All professionals shall be obliged to keep strictly secret the matters entrusted to them by their clients, except for the obligatory reports established by specific laws.’

42 To what extent is waiver of the attorney–client privilege regarded as a co-operative step in your country? Are there any contexts where privilege waiver is mandatory or required?

It is not necessary to waive the attorney–client privilege to obtain co-operation credit.

43 Does the concept of limited waiver of privilege exist as a concept in your jurisdiction? What is its scope?

Although there is no specific regulation in this regard, if a client or a holder of confidential information shares it with third parties without expressly describing it as confidential and protected by the attorney–client privilege, and without the participation of a professional, there is a risk that the information may become public and may be disclosed without being subject to any kind of liability.

44 If privilege has been waived on a limited basis in another country, can privilege be maintained in your own country?

Yes, the privilege will be subject and treated according to the applicable domestic regulation. However, the limited waiver can be analysed by courts on a case-by-case basis.

45 Do common interest privileges exist as concepts in your country? What are the requirements and scope?

There is no specific regulation in this regard. It is relevant to mention, however, that there are no discovery or pretrial stages where the common interest privilege can be invoked.

46 Can privilege be claimed over the assistance given by third parties to lawyers?

Yes. In accordance with Article 36 of the Regulatory Law under Chapter 5 of the Constitution, regarding the practice of professions in Mexico City: ‘All professionals shall be obliged to keep strictly secret the matters entrusted to them by their clients, except for the obligatory reports established by specific laws.’

Witness interviews

47 Does your country permit the interviewing of witnesses as part of an internal investigation?

Yes, this is allowed under the Mexican legal framework.

48 Can a company claim the attorney–client privilege over internal witness interviews or attorney reports?

Attorney–client privilege can be claimed by companies in respect of both internal witness interviews, when the witness has legal duties of secrecy over the information, and attorney reports, when the privilege was not waived in any form permitted by applicable law, in accordance with the duty of secrecy.

49 When conducting a witness interview of an employee in your country, what legal or ethical requirements or guidance must be adhered to? Are there different requirements when interviewing third parties?

There is no specific regulation in this regard, but corporate best practice would be to inform employees of the right to appoint a lawyer to represent them during the interview, to clearly explain the reasons for the investigation and adhere to other internal company policies that may result and are applicable to the specific case.

50 How is an internal interview typically conducted in your country? Are documents put to the witness? May or must employees in your country have their own legal representation at the interview?

There is no specific regulation in this regard. However, best practice can include, among other things:

  • to advise witnesses or employees to co-operate with the investigation;
  • to advise as to the purpose of the internal investigation;
  • to advise as to the methodology and path that will be used to conduct the investigation;
  • to clearly explain to and inform witnesses or employees of the right to be heard by investigators and the right to be represented; and
  • to inform witnesses or employees that they may keep a record of their responses to the questions asked by the investigators.

Employees may be represented by a lawyer during interviews.

Reporting to the authorities

51 Are there circumstances under which reporting misconduct to law enforcement authorities is mandatory in your country?

As a general rule, Article 222 of the National Code of Criminal Procedures (NCCP) mandates that any individual who witnesses an act that may constitute criminal conduct is obliged to report it to the Public Prosecutor. Article 222 also provides that if an individual does not comply with this obligation, the individual will be liable to the ‘corresponding sanctions’. However, the term ‘corresponding sanctions’ is not specified in the NCCP; therefore, sanctions for non-compliance may never arise.

As regards administrative responsibility, pursuant to Article 81 of the General Law on Administrative Responsibilities, reporting misconduct can be considered a mitigating factor in the imposition of administrative sanctions, and not reporting can be considered an aggravating factor. However, there is no specific obligation to report misconduct.

52 In what circumstances might you advise a company to self-report to law enforcement even if it has no legal obligation to do so? In what circumstances would that advice to self-report extend to countries beyond your country?

Nationally or internationally, depending on the specific circumstances of the case, self-reporting may be advisable when it is considered a mitigating factor in the imposition of sanctions. In these cases, the company should analyse the severity of the sanction that may be imposed by the authority in the event of not self-reporting (especially if not reporting could be considered as an aggravating factor).

53 What are the practical steps needed to self-report to law enforcement in your country?

A company should:

  • analyse the case internally (assess the internal investigative material) and act according to its integrity policies and conduct code, applying the internal mechanisms and enforcing the sanctions thereby established for the misconduct that has taken place;
  • seek the counsel of a law firm to understand the possible consequences that may arise from self-reporting the misconduct;
  • depending on the circumstances, communicate at the proper time to everyone involved in the misconduct that the company has decided to self-report and the possible consequences that may arise from it;
  • train those people involved who may be subpoenaed by the enforcement authority;
  • gather all the relevant information that may be required by the enforcement authority;
  • identify the corresponding enforcement authority to which the company should self-report;
  • file a notification admitting the misconduct before the investigative authority of the corresponding enforcement authority;
  • co-operate with the enforcement authority during the investigation; and
  • seek the highest possible sanction reduction.

Responding to the authorities

54 In practice, how does a company in your country respond to a notice or subpoena from a law enforcement authority? Is it possible to enter into dialogue with the authorities to address their concerns before or even after charges are brought? How?

Companies should file a response to any notice or subpoena issued by an enforcement authority within the legal period specified in the applicable law and provide the specific information required.

Companies may enter into dialogue with the authorities to address their concerns before charges are brought during the investigation stage of the proceeding. During the investigation, the companies may enter into dialogue with the authority, in the spirit of co-operation, seeking the termination of the investigation or a reduction of the sanctions. If charges are brought after the investigation stage, the company may also enter into dialogue with the authority and file evidence to defend its position before the imposition of sanctions.

55 Are ongoing authority investigations subject to challenge before the courts?

As a general rule, a company may challenge an investigation only after it is completed and a sanction is imposed. However, ongoing investigations may be challenged before courts in certain circumstances relating to violations of basic procedural principles that may affect the outcome of the investigation.

56 In the event that authorities in your country and one or more other countries issue separate notices or subpoenas regarding the same facts or allegations, how should the company approach this?

Negotiating a consistent disclosure package between various countries may be the best way to approach separate notices or subpoenas from different countries. However, data protection and confidentiality statutes in each country should be observed before disclosing information.

57 If a notice or subpoena from the authorities in your country seeks production of material relating to a particular matter that crosses borders, must the company search for and produce material in other countries to satisfy the request? What are the difficulties in that regard?

Yes. The company should provide all the information in its possession relating to the investigation even if the information is in another country. Difficulties may arise if the information requested is protected by confidentiality agreements or confidentiality laws of a different country.

58 Does law enforcement in your country routinely share information or investigative materials with law enforcement in other countries? What framework is in place in your country for co-operation with foreign authorities?

Law enforcement authorities in Mexico may share information with enforcement authorities in other countries and request information from them. There are specific provisions in some laws in Mexico regarding international co-operation or assistance (such as the General Law on Administrative Responsibilities, the Federal Criminal Procedures Code and the National Code of Criminal Procedures), which must be applied in accordance with the international treaties that Mexico has signed for the assistance of law enforcement authorities.

59 Do law enforcement authorities in your country have any confidentiality obligations in relation to information received during an investigation or onward disclosure and use of that information by third parties?

Information provided by the parties in an investigation may be sorted as classified or confidential information, and law enforcement authorities are obliged to protect and safeguard such information according to the General Law of Transparency and Access to Public Information. Classified information becomes available after the classification period has concluded. This is usually five years but may be extended for an additional five years if there are grounds for it. Confidential information can never be disclosed.

60 How would you advise a company that has received a request from a law enforcement authority in your country seeking documents from another country, where production would violate the laws of that other country?

We would advise the company to declare that it is legally impossible to comply with the request for information given that the production of those documents would violate the law of the other country.

61 Does your country have secrecy or blocking statutes? What related issues arise from compliance with a notice or subpoena?

Mexico does not have such statutes.

62 What are the risks in voluntary production versus compelled production of material to authorities in your country? Is this material discoverable by third parties? Is there any confidentiality attached to productions to law enforcement in your country?

Voluntary production of material may allow the company flexibility to decide what to produce and under which terms. On the other hand, compelled production of material must comply with the terms and requirements imposed by the authority. All the materials filed by the parties in a trial are not discoverable by third parties that are not part of the trial and sometimes, depending on the type of information, not even the parties have access to the information, but only the judge and the owner of the information.

Prosecution and penalties

63 What types of penalties may companies or their directors, officers or employees face for misconduct in your country?

Pursuant to Article 81 of the General Law on Administrative Responsibilities (GLAR), individuals and companies are liable to the following penalties for unlawful acts such as bribery, use of false information, misuse of public resources and influence peddling:

  • Individuals:
    • financial penalties;
    • temporary debarment from participating in procurement, leases, services or public works; and
    • compensation to the government for damage to public finances.
  • Companies:
    • financial penalties;
    • temporary debarment from participating in procurement, leases, services or public works;
    • suspension of activities for a period of not less than three months and not longer than three years;
    • dissolution of the company; and
    • compensation to the government for damage to public finances.

64 Where there is a risk of a corporate’s suspension, debarment or other restrictions on continuing business in your country, what options or restrictions apply to a corporate wanting to settle in another country?

If a company wishes to settle in another country but is subject to an open investigation, one option may be to co-operate with the Mexican investigation and seek to avoid the most severe sanctions, including suspension of activities, debarment or dissolution, that may prevent it from settling in another country with recognition by the Mexican government.

65 What do the authorities in your country take into account when fixing penalties?

Among the factors considered by the authorities when fixing penalties are:

  • the degree of participation of the company or individual in the misconduct;
  • recidivism;
  • the financial capacity of the individual or company;
  • the damage caused to the state; and
  • the size of the benefit and profit or the damage or harm stemming from the misconduct.

Resolution and settlements short of trial

66 Are non-prosecution agreements or deferred prosecution agreements available in your jurisdiction for corporations?

No. Nevertheless, there are several leniency programmes available, such as the one before the Antitrust Commission, for which an economic agent can apply to reduce sanctions or, in criminal procedures, where the accused can reach an agreement with the prosecution in exchange for co-operating (criterios de oportunidad).

67 Does your jurisdiction provide for reporting restrictions or anonymity for corporates that have entered into non-prosecution agreements or deferred prosecution agreements until the conclusion of criminal proceedings in relation to connected individuals to ensure fairness in those proceedings?

Yes, in respect of leniency programmes (see question 66). For example, in a leniency programme before the Antitrust Commission, if the economic agent in an investigation can co-operate with the authority, the name and the specific details of the co-operation should remain anonymous indefinitely.

68 Prior to any settlement with a law enforcement authority in your country, what considerations should companies be aware of?

One of the main concerns to be aware of prior to reaching a leniency settlement with an authority is the possibility that the settlement could be interpreted in the future as precedent if the conduct recurs. Another concern is the possible reputational damage for entering into a settlement regarding unlawful conduct.

69 To what extent do law enforcement authorities in your country use external corporate compliance monitors as an enforcement tool?

There are several degrees of co-operation with private external compliance monitors or, in other words, the depth of a monitor’s participation is tailored to a specific matter. For example, in investigations concerning the environment and pharmaceutical matters, government agencies rely on third parties that review certain facts or conduct to comply with regulations.

70 Are parallel private actions allowed? May private plaintiffs gain access to the authorities’ files?

Yes, private companies can be sued for damage arising from the unlawful conduct of a third party affected.

During the course of a trial, it is possible to file a motion and ask the judge to order the surrender of and access to the authorities’ files. Further, under the Transparency Law, it is possible to file a request before the National Transparency and Data Protection Agency for an order to make public certain files in the possession of authorities.

Publicity and reputational issues

71 Outline the law in your country surrounding publicity of criminal cases at the investigatory stage and once a case is before a court.

Although in criminal proceedings the right to privacy of any person must be respected and the information that refers to private life and personal data has to be protected, it is also true that publicity about a criminal investigation may affect the due criminal process; thus, in general, investigation processes are not public.

72 What steps do you take to manage corporate communications in your country? Is it common for companies to use a public relations firm to manage a corporate crisis in your country?

It is common for large international companies to use public relations companies or law firms for crisis management.

73 How is publicity managed when there are ongoing related proceedings?

Negative publicity is an important consideration for companies. Therefore, a company’s actions regarding public relations and disclosure of pertinent information depends on the specific case for each company.

Duty to the market

74 Is disclosure to the market in circumstances where a settlement has been agreed but not yet made public mandatory?

This should be assessed case by case, and mainly depends on whether the matter involves a publicly traded company, in which case the company has a duty to disclose material information regarding its business and finances as they relate to the settlement.

Environmental, social and corporate governance (ESG)

75 Does your country regulate ESG matters?

The current Mexican government has not regulated ESG strategies. However, Mexican citizens have mobilised, through private programmes and strategies (including in some instances litigation by non-governmental organisations) to promote ESG. In April 2020, S&P Dow Jones Indices and the Mexican Stock Exchange launched a new ESG index that provides local and international investors with a new indicator based on global principles of sustainability.

76 Do you expect to see any key regulatory or legislative changes emerge in the next year or so designed to address ESG matters?

Mexico’s major trade partners (the United States, Canada and the European Union) can influence legislative change in Mexico through those partners’ actions and expectations. Their ESG initiatives and actions are persuasive as the Mexican government reconsiders current policies and works towards a more resilient environment. One example of this influence is the United States-Mexico-Canada Agreement, which contains provisions encouraging ESG.

77 Has there been an increase in ESG-related litigation, investigations or enforcement activity in recent years in your country?

There has not been any increase in ESG-related litigation or enforcement activity in recent years.

Anticipated developments

78 Do you expect to see any key regulatory or legislative changes emerge in the next year or so designed to address corporate misconduct?

We do not foresee any key regulatory or legislative changes designed to address corporate misconduct in the coming years.


[1] Antonio Cárdenas Arriola, Jonathan D King, Daniel González Estrada are partners and Yesica L Garduño Sandoval is a senior associate at DLA Piper.

Unlock unlimited access to all Global Investigations Review content