The risk methodology, ready before March 2027.
PLDUnity turns the risk-based approach into a living process: a documented methodology, risk matrix, mitigants, a risk grade per client recalculated automatically and 10 years of history for the audit.
EBR RISK ENGINE · AGREEMENT 115/2026
Live 5×5 Risk Matrix & Residual Scoring Engine.
Experience how PLDUnity automatically evaluates inherent exposure across the 4 statutory factors, discounts proven mitigation controls up to the 60% legal cap, and computes verifiable residual risk.
Impact × Probability Grid
Evaluation Breakdown per Regulatory Agreement
1. Clients & Users
Legal entities, foreign beneficial ownership (25%+), PEPs and fiscal residency.
2. Products & Services
Article 17 activities, notice thresholds in UMA, complexity and high values.
3. Channels & Cash Handling
Cash cap compliance, SPEI transfers, face-to-face cashier vs. remote sales.
4. Geographic Location
National Risk Assessment (ENR), Mexican border, ports and FATF grey lists.
What the law requires
Why you need it
- Legal mandateLegal Mandate
The LFPIORPI reform (DOF July 2025) and General Rules require an approved risk methodology, client scoring classification, and mandatory annual review with audit trails.
- Statutory deadlinesDeadline: Mar 2027
March 1, 2027 to implement the methodology, updated manual, and classified portfolio; first annual external audit with independent opinion takes effect in 2028.
- Non-compliance riskSAT · Art. 69-B CFF
Without EBR your compliance manual is invalid before the SAT, differentiated due diligence lacks legal basis, and regulatory fines reach up to 100,000 UMA.
Platform Architecture
Features
Four-factor methodology
Clients, products and services, channels and geography, on a 1 to 5 scale.
Mitigants
With a capped reduction (up to 60%) and calculated residual risk.
Official inputs
The National Risk Assessment and FATF lists preloaded, updated after each plenary.
Grade per client
Low, medium or high, recalculated on the 2nd of every month from transactions, list screening and profile.
Justified adjustments
They can raise the grade, never lower it below the model.
10 years of history
Of every grade change, with date and reason.
Signed annual review
Approval by the compliance officer and versions of the methodology.
Connected to the manual
With the compliance manual and the self-assessment of obligations.
Reports
Client base by grade, clients whose grade changed and pending reviews.
Platform Architecture
Advantages
The 2027 deadline covered
With a methodology you can defend before the SAT and the auditor.
A living classification
Not done once a year in a spreadsheet: it recalculates itself every month.
Risk guides the rest
How much due diligence to apply, what to watch and what to report.
Evidence ready
Who approved what, and when.
- risk factors
- 4
- On a 1 to 5 scale.
- maximum reduction from mitigants
- 60%
- automatic recalculation every month
- Day 2
- of history per client
- 10 years
How it works
- ETAPA 01
Answer
You complete the guided methodology for your activity and region.
- ETAPA 02
Calculate
The platform calculates inherent risk, applies mitigants and gets the residual risk.
- ETAPA 03
Classify
Each client gets a grade; it is recalculated every month.
- ETAPA 04
Sign
The compliance officer reviews, adjusts with justification and signs the annual review.
FREQUENTLY ASKED QUESTIONS
Frequently asked questions about Risk-Based Assessment (EBR)
When does the Risk-Based Assessment (EBR) methodology become mandatory in Mexico?
Under the LFPIORPI reform and Agreement 115/2026 published in the Official Gazette (DOF), having a documented Risk-Based Assessment methodology, client risk classification, and due diligence policies becomes mandatory by March 1, 2027 for all Article 17 vulnerable activities.
Do I need to hire an external consultant to build our EBR matrix?
Not to get started. PLDUnity ships with pre-configured risk factors, indicators, weights, and mitigating controls designed by BDUnity® specialists for each of the 17 vulnerable activities. You can activate your industry's template immediately or customize weights to match your existing methodology.
Which risk dimensions does the EBR engine evaluate at the entity and client levels?
It evaluates the four core pillars required by Mexican regulations and FATF standards: (1) Clients & Beneficial Owners (entity type, PEP status, economic activity), (2) Vulnerable Products & Services, (3) Delivery Channels & Payment Methods (cash intensity, wire transfers, remote onboarding), and (4) Geographic Risk.
How are inherent risk, control mitigants, and residual risk calculated?
The engine first computes Inherent Risk from the weighted exposure across all four risk pillars. It then scores your active internal controls (governance, KYC completeness, daily watchlist screening, training, and audits) to calculate your entity's auditable Residual Risk.
What happens automatically when a client is classified as High Risk?
Whenever a client's score crosses into High Risk—or when a Foreign PEP is identified—PLDUnity automatically enforces Enhanced Due Diligence (EDD): requiring source-of-funds documentation, compliance officer sign-off, and shorter periodic review cycles.
How often are client risk scores recalculated?
Scores update immediately upon onboarding, profile changes, or watchlist hits, and recalculate monthly based on actual transactional behavior (6-month rolling accumulation, cash usage, and unusual activity alerts).
Can I export the methodology report and version history for external audits or SAT inspections?
Yes. Every adjustment to risk weights or controls creates an immutable, timestamped version. You can export the complete EBR calculation report and client risk matrix at any time for your external auditor or the SAT.
Have your EBR ready before March 1, 2027.
Book 30 minutes with the BDUnity team · info@pldunity.com