Mexico's 2021 subcontracting reform: what global procurement needs to know

In April 2021, Mexico rewrote the rules of outsourcing. A reform to the Federal Labor Law banned subcontracted personnel outright, created a mandatory registry for the specialized services that remain legal, and rewired the tax code so that non-compliance costs the client the deduction. If your procurement organization buys services in Mexico, this reform defines what you may buy, from whom, and what evidence you need to keep.

What the reform actually banned

Before 2021, it was common for companies in Mexico to operate with little or no direct headcount. Workers were employed by a staffing entity — often a related party — and leased back to the operating company. The scheme eroded profit-sharing, social-security contributions and job stability, and the reform ended it.

The rule since then is direct: a company may not run its business on personnel supplied by someone else. What survives is the specialized service — work that is not part of the client's corporate purpose or predominant economic activity, delivered by a provider with its own employees, its own assets and a registration in REPSE (Registro de Prestadoras de Servicios Especializados u Obras Especializadas), the registry kept by the Ministry of Labor (STPS).

The line is drawn against the client's registered corporate purpose. A car-parts plant can legally contract specialized welding maintenance, industrial cleaning or plant security. It cannot legally contract "operators for line 3". For a fuller picture of the regime from the owner's side, see our REPSE guide for foreign companies.

Related parties get no exemption. A foreign group whose Mexican entities provide services to one another — a shared-services company billing the plant, for instance — falls under the same rules. If the service qualifies as specialized, the providing entity needs its own REPSE registration, and the receiving entity needs the same evidence file it would keep for any external contractor.

What it did to the tax treatment

The reform's teeth are fiscal. Alongside the labor-law changes, Mexico amended its tax provisions so that payments for prohibited subcontracting cannot be deducted for income tax, and the VAT paid on them cannot be credited. To deduct even legitimate specialized services, the client must collect evidence from the provider — proof of REPSE registration and of tax and social-security compliance for the period of the service.

Read that twice, because it inverts the usual burden. The client's own tax position depends on the provider's compliance. A contractor who stops paying social-security contributions in March puts the client's March deduction at risk, whether or not anyone at the client noticed. The financial anatomy of this exposure — inherited debts, write-offs, what an auditor requests — is covered in our CFO's guide to joint liability.

SISUB and ICSOE: the reporting calendar

The reform also gave the social-security institutions visibility into every specialized-services contract. Two recurring reports exist, filed by the provider, not the client.

ICSOE (Informativa de Contratos de Servicios u Obras Especializadas) is filed with IMSS, the social-security institute. It reports the specialized-services contracts, the workers assigned to them, and their social-security contributions.

SISUB (Sistema de Información de Subcontratación) is filed with INFONAVIT, the national housing fund. It reports the same contracts from the housing-contribution side.

Both follow the same calendar: one filing per four-month period, submitted from the 1st through the 17th of January, May and September. January covers September–December, May covers January–April, September covers May–August. A provider in good standing files both, three times a year, every year.

What this means for procurement policy

Four practices translate the reform into an operating standard for a global procurement team.

Scope contracts as specialized services. The contract should state the specialized service, and the service should sit outside the client's corporate purpose. Ambiguity here is where reclassification risk lives.

Qualify the registration, not the promise. Verify the provider's REPSE registration — that it exists, that it is current, and that it covers the service being contracted. Registrations renew every three years and can lapse.

Collect evidence on the regime's clock. Compliance opinions expire. Filings recur every four months. Payroll receipts are monthly. Vendor files that were assembled once, at onboarding, prove nothing about the period an invoice was paid.

Gate the spend. The cheapest moment to catch a non-compliant provider is before the purchase order or the payment, not in a tax audit years later. This is the control Vigía Legal operates: continuous validation of each provider against the official sources, a verdict before the PO and the payment, and the audit file assembled per provider, per period, as the control runs.

The reform is five years old, enforcement is routine, and audits reach backward. The companies that handle it well have stopped treating it as a legal topic and started treating it as an operations control — recurring, evidenced, and wired into the payment flow.