Risk and penalties
Joint-and-several liability in Mexico: a CFO's guide
How a contractor's unpaid taxes and payroll become the client's problem in Mexico: inherited debts, lost deductions, non-creditable VAT, and the evidence an auditor asks for.
There is a class of liability that never appears on your subsidiary's balance sheet until an auditor puts it there: the debts of your contractors. Under Mexico's subcontracting regime, a specialized-services provider that fails to pay its workers, its social-security contributions or its taxes can transfer that failure to the client — as inherited debt, as a lost deduction, and as non-creditable VAT. This guide walks through the mechanics the way a finance leader needs them: what triggers the exposure, what it costs, and what evidence closes it.
The transmission mechanism
Mexico's 2021 subcontracting reform allows companies to outsource only specialized services, from providers registered in REPSE (Registro de Prestadoras de Servicios Especializados u Obras Especializadas), the Ministry of Labor's registry. The regime's enforcement runs through the client's wallet.
If a registered provider stops paying social-security contributions, underreports the workers on your site, or turns out to be simulating invoices, three consequences reach the client. The authorities can collect the provider's debts from you. The tax authority can reject your deduction of the payments. And the VAT you credited on those invoices can be clawed back.
Note what is absent from that list: intent. The client does not need to have known. The exposure arises from the provider's non-compliance plus the client's inability to prove diligence — a combination that default vendor management produces reliably.
Pricing the exposure
Model the cost of one non-compliant provider across one audited year.
The inherited debt. Unpaid social-security and housing-fund contributions for the workers assigned to your contract, with surcharges, collected from you.
The lost deduction. Every payment to the provider in the affected periods, removed from deductible expense. At Mexico's corporate rate, roughly a third of the contract value returns as tax.
The non-creditable VAT. Sixteen percent of the same invoices, no longer offsettable.
The 69-B scenario. If the provider lands on the tax authority's list of presumed invoice simulators — article 69-B of the Federal Tax Code — every invoice it issued to you is presumed to cover a non-existent operation. The burden shifts to you to prove the services were real, invoice by invoice.
A modest MXN 10 million annual contract can therefore generate an exposure several times larger than its margin ever was. Multiply by the number of specialized-services providers in the census, and the portfolio-level number is what belongs in the risk committee's papers.
The exposure also resists late discovery. By the time an audit surfaces a non-compliant provider, the affected periods are closed, the provider may be gone, and the amounts are no longer negotiable. Whatever the balance sheet says that day, the economic loss was booked years earlier — silently, one compliant-looking invoice at a time.
What the auditor actually asks for
Mexican audits of this regime are document-driven, and they examine the past. The request list is stable enough to prepare for. Per provider, per payment period, expect to produce the REPSE registration covering the service, positive compliance opinions from the tax authority (SAT), the social-security institute (IMSS) and the housing fund (INFONAVIT), stamped payroll receipts (CFDI de nómina) for the workers on the contract, the provider's SISUB and ICSOE filing receipts, and the contract itself, scoped as a specialized service.
The failure mode is rarely a missing document type. It is a date mismatch. The file holds a compliance opinion from onboarding, two years before the payment under review; the auditor needs the one from the payment month. Compliance in this regime is a time series, and most vendor files are snapshots.
Retroactivity is the trap
Audits routinely reach back several fiscal years. Evidence must exist for the period each invoice was paid — it cannot be reconstructed later, because compliance opinions and registry statuses cannot be re-issued for the past. A control that starts today protects the periods from today forward. Start the clock.
Controlling it: three moves
Gate the payment. The decisive control runs before money moves. A provider whose compliance has lapsed should fail the check at the purchase order or the payment release — inside the AP workflow, not in a quarterly review. Vigía Legal operates this as a pay / do-not-pay verdict at the moment of decision, integrated with Coupa, Oracle and SAP Ariba.
Automate the time series. Registrations, opinions, filings and payroll receipts renew on different clocks. Continuous, scheduled validation against the official sources — including SAT's 69-B list — is what keeps the evidence file matching the payment calendar. Assembled by hand, the file decays; assembled as a by-product of the control, it stays audit-ready.
Extend the control to the work itself. Deductions also fail when the service cannot be shown to have happened as invoiced. Approval controls on contractor work — service entries with segregation of duties — connect each payment to verified, received work, which is precisely the connection a 69-B defense needs.
The uncomfortable property of this liability is that it is retroactive; the convenient property is that it is mechanical. Every element of the defense is a document with a date, obtainable on a schedule, from official sources. That makes the exposure controllable — for the periods where the control was running. A vendor census with a compliance verdict against it is the natural first step.
Free diagnostic
See where your vendor list stands today.
Upload your vendor list — the cross-check against SAT's 69-B list arrives in your inbox, Excel included. At no cost.
It takes two minutes. We call you to review the result together.
Frequently asked questions
- How does joint-and-several liability work under Mexico's subcontracting regime?
- When a specialized-services provider fails its obligations to workers, to the social-security institutions or to the tax authority, the client company that received the services can be pursued for those debts. The liability attaches to the Mexican entity that contracted the service; a foreign parent feels it through its subsidiary's results.
- What does non-compliance cost, concretely?
- Three lines: the provider's inherited labor and social-security debts; the income-tax deduction lost on payments to the non-compliant provider; and the VAT on those invoices, which becomes non-creditable. On top sit fines and the internal cost of the audit itself. The loss lands in the period under audit, which may be several years back.
- What evidence does an auditor ask for?
- Per provider and per period: the REPSE registration covering the service, positive compliance opinions from SAT, IMSS and INFONAVIT, stamped payroll receipts for the workers assigned to the contract, receipts of the provider's SISUB and ICSOE filings, and proof that the provider was not on SAT's 69-B list of presumed invoice simulators. The dates must match the payment period — current documents do not cure past gaps.
- Can the risk be eliminated by contract clauses or indemnities?
- No. Indemnity clauses shift money between private parties; they do not bind the authorities, who can still collect from the client. Clauses are worth having, but the defense that works in an audit is evidence of validation at the time of each payment. The risk is controlled through process, not drafting.
Keep reading