REPSE compliance in Mexico: a guide for foreign companies

Your Mexican subsidiary hires contractors. Maintenance crews, security, cleaning, logistics, IT support — in Mexico, most of that work falls under a regime called REPSE, and the liability it creates does not stay with the contractor. It reaches the company that pays the invoice. If you sit at headquarters and Mexico reports to you, this regime belongs on your risk map.

What REPSE is, in one page

In 2021, Mexico reformed its Federal Labor Law and banned the outsourcing of personnel. Companies may no longer staff their operations through third-party payrolls. What remains legal is contracting specialized services: work that is not part of the client's corporate purpose or core economic activity, performed by a provider registered in REPSE.

The registry is public and searchable. Every legitimate specialized-services provider in Mexico holds a REPSE registration, renews it every three years, and files recurring reports to the social-security institutions. We cover the reform itself — what changed, why, and the tax provisions that came with it — in our guide to the 2021 subcontracting reform.

For a foreign parent, the essential point is scope. REPSE applies to the Mexican entity that signs the contract, whoever owns it. A plant in Monterrey owned from Detroit or Stuttgart carries the same obligations as its Mexican-owned neighbor.

The liability that travels upstream

The reform's enforcement mechanism is joint-and-several liability (responsabilidad solidaria). When a specialized-services provider fails to pay wages, social-security contributions or payroll taxes, the authorities can pursue the client company for those debts — as if they were its own.

The exposure has a second edge. Payments to a non-compliant provider can lose their income-tax deduction, and the VAT on those invoices can become non-creditable. A contractor problem becomes a tax problem, on the client's return. The financial mechanics — what an auditor asks for, what the write-off looks like — are the subject of our CFO's guide to joint liability.

Two features make this regime harsher than most foreign compliance teams expect.

Compliance expires. A provider that was compliant in January can be non-compliant in June. Registrations lapse, compliance opinions turn negative, filings are missed. A one-time vendor onboarding check proves nothing about the month a given invoice was paid.

The registry is not the whole story. A provider can appear in the public registry and still owe social-security contributions, or still be flagged by the tax authority as an invoice simulator. Real validation crosses several sources, on a schedule.

What "compliant" actually means

For each specialized-services provider, per payment period, a defensible file contains:

• REPSE registration, current and covering the service actually provided.
• Compliance opinions from the tax authority (SAT), the social-security institute (IMSS) and the housing fund (INFONAVIT) — positive and recent.
• Stamped payroll receipts (CFDI de nómina) for the workers assigned to your contract, consistent in period and employer.
• SISUB and ICSOE filings — the recurring reports providers file with INFONAVIT and IMSS every four months, due the 1st through the 17th of January, May and September.
• A check against SAT's 69-B list of presumed invoice simulators.

None of these documents is exotic. The difficulty is volume and recurrence: fifty providers, several documents each, three or more renewal clocks per provider, every period. Spreadsheets absorb this for a quarter or two, then quietly fall behind.

What headquarters should require

You do not need to administer Mexican labor law from headquarters. You need to require that your subsidiary can answer four questions, on demand, with evidence.

Who are our specialized-services providers? A complete census, not a best-effort list. Shadow contractors hired at plant level are where this regime bites.

Is each one compliant right now? A current status per provider — compliant, at risk, non-compliant — refreshed on a schedule, not on request.

Do we check before we pay? The control that matters runs at the moment of decision. A payment blocked before release costs a conversation; a payment discovered in an audit three years later costs the deduction plus the inherited debt. Vigía Legal runs this check as a gate inside the payment flow, integrated with Coupa, Oracle and SAP Ariba.

Can we prove it? An audit file per provider, per period, that a reviewer can walk without reconstructing history from inboxes. Mexican tax audits routinely reach back several years; the evidence has to exist for the period under review, not the period of the audit.

Site-level controls — who physically enters your plant, and how contractor work is approved for payment — extend the same logic to operations. We cover both in contractor controls in Mexico.

The questions to ask on your next call with Mexico

If you want a fast read on your exposure, ask your subsidiary these five questions. How many specialized-services providers do we have under contract? When did we last verify each one's REPSE registration and compliance opinions? Has any provider appeared on SAT's 69-B list? Can we show, for a payment made eighteen months ago, that the provider was compliant that month? Who, by name, owns this control?

Silence on any of them is a finding. The regime is demanding, but it is also mechanical — which means it can be systematized. That is the work Vigía Legal does: continuous validation of every provider against the official sources, a compliance verdict before each purchase order and payment, and the evidence file built as a by-product of the control itself.