First: confirm whether the company conducts a vulnerable activity

Obligations do not apply identically to all companies. Start by identifying whether acts or transactions fall within the regulated activities, in which circumstances and how frequently.

That analysis must consider actual operations. Corporate purpose, industry or a commercial description may be insufficient without reviewing transactions, customers, amounts and channels. Read the current LFPIORPI and Agreement 115/2026 published in the Official Gazette together with the specific activity.

Risk-based compliance asks more than whether a file exists. It asks whether the company understands why a relationship or transaction warrants closer attention.

The transition has different dates

The Agreement was signed July 24, 2026 and sets a general effective date of November 30, 2026. Transitional provisions defer certain obligations, so the entire change should not be presented as immediately mandatory, nor preparation left until the last moment.

DateMilestone under the AgreementBusiness implication
Nov. 30, 2026General entry into force, subject to exceptions.Align governance, owners and the transition plan.
Mar. 1, 2027Risk assessment and methodology manual available; application of chapters on classification, due diligence and controlling beneficial owners.Have documented methodology, data and files ready.
Jun. 1, 2027Scheduled deadline for automated mechanisms.Implement alerts and verifiable evidence.
2027–2028Annual training from 2027 and the first audit period during 2028.Budget training, testing and independent review.

From document control to a management system

Assessment methodology

The organization must identify and measure risks across its acts or operations, customer types, countries or geographic areas, transactions and channels. Methodology needs documentation and reproducible results.

Customer classification and due diligence

Relationships do not all carry the same exposure. Information collected should enable risk ratings, profiles and proportionate measures, including enhanced reviews where appropriate.

Controlling beneficial owner

Review cannot stop at the signatory. Identify and document the individuals who ultimately benefit or exercise control.

Policies, owners and training

A manual without owners or operational practice is insufficient. Policies must translate into decisions, escalation, training and evidence of application.

Monitoring, mechanisms and audit

Management requires observing transactions, detecting deviations, maintaining current information and testing controls. Tools may vary by size and complexity, but results must be verifiable.

Preparation does not require an oversized system

Tools can be proportionate to operational volume and complexity if criteria, alerts, decisions and evidence remain consistent. The Agreement itself contemplates mechanisms ranging from specialist systems to automated processes using spreadsheets or databases, provided they perform the required functions and are verifiable.

Immediate work involves mapping available information, identifying gaps and assigning owners. Buying technology before designing methodology can automate a process that is not yet defined.

Management decision

The model should be proportionate, not improvised

Management must define risk appetite, owners, budget, tools, escalation and evidence. Compliance cannot operate separately from sales, finance, legal and administration.

Implementation roadmap

  • Confirm applicable activities, conditions and obligations.
  • Map customers, transactions, countries, channels and third parties.
  • Design methodology and classification criteria.
  • Update files and controlling beneficial owners.
  • Define controls, alerts and escalation routes.
  • Assign owners and train the teams involved.
  • Implement monitoring and retain evidence.
  • Test the system and address gaps.

The risk of treating this as a forms update

If forms change but decisions do not, files may look complete while risk remains. The difference lies in explaining why a customer received a classification, which control applied, who reviewed an alert and what evidence demonstrates the process.

Conclusion

The new standard shifts compliance from isolated documents to a system that identifies, understands and mitigates risk. For management, this requires governance, information and operational discipline; it also creates an opportunity to better understand customers, transactions and critical exposures.

This analysis is informational. Obligations depend on each entity's activity, transactions, amounts and circumstances.