Criminal liability of legal entities: due control as the starting point

Since the reform published in the Official Gazette of the Federation on June 17, 2016, Mexico’s National Code of Criminal Procedure (Código Nacional de Procedimientos Penales) has provided for the autonomous criminal liability of legal entities, separate from that of their directors or employees. The question boards and legal departments now ask is no longer whether a company can be held criminally liable, but under what conditions, and what can be done in advance to reduce that risk.

The prerequisite: failure to exercise due control

Article 421 of the National Code of Criminal Procedure provides that legal entities are criminally liable for offenses committed in their name, on their behalf, for their benefit or through means they provide, when it is also established that there was a failure to exercise due control within their organization. That liability is independent of the liability of their de facto or de jure representatives or managers, and the Public Prosecutor (Ministerio Público) may bring criminal charges against the company regardless of any charges brought against individuals, except for state institutions.

The same provision closes some common escape routes. Liability is not extinguished when the company is transformed, merged, absorbed or split, nor through an apparent dissolution when it continues its economic activity and keeps substantially the same customers, suppliers or employees. Nor are proceedings against the legal entity affected if an individual involved evades justice.

A closed list of offenses

Legal entities are liable only for the offenses listed in federal or state criminal legislation. At the federal level, Article 11 Bis of the Federal Criminal Code (Código Penal Federal) includes, among others, fraud, concealment, transactions with proceeds of illicit origin, environmental crimes, bribery, smuggling and tax fraud, several offenses under banking, securities and credit legislation and, since the reform published on November 28, 2025, extortion as defined in the general law on that subject.

In Jalisco, Article 21 of the Criminal Code of the State of Jalisco (Código Penal para el Estado Libre y Soberano de Jalisco) adopts the same failure-of-due-control prerequisite and sets out its own list, which includes, among others, fraud, fraudulent management, corruption offenses, crimes against urban development, disclosure of secrets, unlawful obtaining of electronic information, tax fraud, environmental crimes and transactions with proceeds of illicit origin.

What consequences a company may face

Article 422 of the National Code distinguishes two groups. Legal entities with their own legal personality may be subject to fines, forfeiture of the instruments, objects or proceeds of the offense, publication of the judgment, dissolution and any other sanctions provided by criminal law. Legal entities, with or without their own legal personality, that took part in a typical and unlawful act may be subject to suspension of activities, closure of premises or establishments, a ban on carrying out in the future the activity in which the offense was committed, disqualification from public procurement, court-appointed intervention to safeguard the rights of workers or creditors, and public reprimand. Article 11 Bis of the Federal Criminal Code sets limits for several of these consequences, ranging from six months to six years and, for the ban on activities, up to ten years.

Why the compliance program matters

To determine the sanction, Article 422 requires courts to consider, among other factors, the extent of the failure to exercise due control within the organization and the degree of adherence to and compliance with legal and regulatory requirements. In turn, the last paragraph of Article 11 Bis of the Federal Criminal Code allows sanctions to be reduced by up to one quarter when, before the offense, the legal entity had a permanent control body responsible for verifying compliance with applicable provisions and monitoring internal crime prevention policies, and also took steps, before or after the offense, to reduce the harm caused.

The practical consequence is that a compliance program that exists only on paper, or that is adopted once the problem has arisen, contributes little. What carries weight in criminal proceedings is being able to show that controls existed before the offense, that they addressed the real risks of the business and that they worked: designated persons in charge, policies known to staff, reporting channels, documented internal investigations and measures actually taken.

Reviewing a company’s criminal risk map against the federal and state lists is therefore an exercise worth doing before it is needed.

Sources: Articles 421 and 422 of the National Code of Criminal Procedure (last amended by reform published on November 28, 2025), Article 11 Bis of the Federal Criminal Code (last amended by reform published on March 13, 2026) and Article 21 of the Criminal Code of the State of Jalisco (last amended by reform published on September 24, 2026).

This note is for informational purposes only and does not constitute legal advice for any specific case.

Contact

Torre Celtis, Real de Acueducto 240, int. 52
Puerta de Hierro, 45116 Zapopan, Jalisco

33 1699 5871
marufc@maruflores.com
LinkedIn

For an initial consultation, briefly describe your matter and the stage it is at. Please do not include sensitive personal data in the form.

© 2026 María Eugenia Flores Chávez · Criminal Lawyer
Privacy notice

The data you provide in this form (name, telephone, email and the content of your message) is processed by María Eugenia Flores Chávez, with address at Torre Celtis, Real de Acueducto 240, int. 52, Puerta de Hierro, 45116 Zapopan, Jalisco, solely to respond to your request, check for possible conflicts of interest and, where applicable, begin the professional relationship. No sensitive data is collected. You may limit its use or disclosure, or exercise your ARCO rights, by writing to marufc@maruflores.com. See the full privacy notice.