Certification of Compliance Programs in Mexico: Lessons from the Americas

By: Amílcar Peredo & Gustavo González Del Castillo^[1]

I. Introduction

The 2025 reform of Mexico’s Federal Economic Competition Law (“LFCE”), in addition to abolishing the Federal Economic Competition Commission (“COFECE”) and creating in its place the National Antitrust Commission (“CNA”) as a decentralized agency of the Ministry of Economy, introduced various changes to Mexico’s competition regime, including the official certification of compliance programs in the area of economic competition. Public debate has understandably focused on the institutional aspects of the transition from COFECE to CNA. However, the certification mechanism deserves its own analysis.

Under the new framework, the CNA is expected to issue guidelines establishing the criteria and requirements for certifying corporate compliance programs.^[2] The CNA may certify, upon payment of fees, companies’ compliance programs regarding economic competition; the certification will be valid for three years and may be considered a mitigating factor in the imposition of sanctions for violations of the LFCE. For the purpose of this article, one question is essential: What elements must a compliance program contain to be genuinely effective and deserve official certification?

To answer this question, this article employs the method of functional comparative law, examining the models adopted by Brazil, Colombia, and the United States, and draws from that analysis concrete proposals for the guidelines that the CNA has yet to publish.

II. The Emergence of Antitrust Compliance Certification in Mexico

Historically, Mexican competition law has relied predominantly on punitive enforcement mechanisms centered on investigation, deterrence, and sanctions. However, competition authorities around the world increasingly recognize that effective compliance programs can contribute to cartel prevention, early risk detection, internal reporting, and overall corporate accountability.^[3]

During its existence as an autonomous constitutional body, COFECE was no stranger to a culture of compliance. In 2015, it published a document containing recommendations for compliance with the LFCE aimed at the private sector, which addressed aspects such as the appointment of a compliance officer, staff training, and the documentation of internal policies. However, that document was advisory in nature, and the existence of a compliance program was not explicitly recognized as a mitigating factor in sanction proceedings.^[4]

The 2025 reform qualitatively transforms this landscape. For the first time in Mexico, the new law creates a system in which preventive compliance has concrete legal consequences, by incorporating certification as an express power of the CNA and explicitly linking it to the sanctions regime.

The text of the LFCE makes it clear that the link between certification and mitigating circumstances is at the heart of the new instrument. Without it, certification would be a mere exercise in voluntary transparency. Thus, regulatory logic changes, now companies have a direct economic incentive to structure robust programs, and the CNA has a tool to promote a culture of ex ante compliance, rather than relying exclusively on ex post enforcement.

However, the legislature delegated to the CNA the task of defining the elements that make a program “certifiable.” This delegation is reasonable, as the technical authority is best positioned to calibrate the standards for proper functioning. The comparative analysis that follows aims to contribute to this definition process.

• Reference Models from the Americas

Official certification of compliance programs in economic competition is not a new instrument in comparative law. However, implementation models vary significantly in four dimensions: who evaluates, by what standard, what legal consequences the certification entails, and what happens when there is non-compliance despite certification. For this analysis, three jurisdictions in the Americas were considered that already have compliance programs in place, and that can serve as a guide for the CNA.

A. United States

In 2019, the U.S. Department of Justice (“DOJ”) issued its Evaluation of Corporate Compliance Programs in Criminal Antitrust Investigations, subsequently updated in 2024.^[5] This guide constitutes the most detailed and technically sophisticated international reference framework.

The U.S. model does not rely on official certification but rather on an individualized assessment by prosecutors in the context of each investigation. The guidance identifies nine dimensions of analysis that prosecutors must weigh to determine whether a compliance program was genuinely effective at the time of the violation and whether it warrants consideration in decisions regarding charges and the determination of penalties.

The first dimension, design and scope, requires that the program not be generic but rather tailored to the specific risks of the sector and the company’s business model. This means, for example, that a program designed for a manufacturing company with exposure to input cartels will be evaluated differently from one developed for a digital platform with algorithmic coordination risks. The second dimension addresses compliance culture; the authority examines whether senior management and the board of directors not only formally approve the program but also actively communicate and demonstrate a genuine commitment — what Anglo-Saxon practice refers to as “tone at the top.” This element is deliberately difficult to simulate, as it seeks consistency between management’s rhetoric and specific operational decisions.

The third dimension addresses the program’s operational accountability; it assesses whether the compliance officer has real autonomy, sufficient budgetary resources, and direct access to the board, or whether, on the contrary, the officer reports to the legal or commercial departments in a way that compromises their independence. Closely linked to this is the fourth dimension, concerning risk assessment, which must be conducted and updated periodically and explicitly incorporate emerging risks arising from new technologies, particularly the use of artificial intelligence and algorithmic pricing tools.

The fifth dimension examines training and internal communication, and here the guide introduces an important nuance: it is not enough for training to simply exist; rather, it must be tailored to the risk profile of each function or business area and built upon lessons learned from real-world cases, whether internal or external. The sixth dimension, focused on monitoring, auditing, and periodic review, is perhaps the one that best distinguishes a functional program from a merely cosmetic one; a program that is neither audited nor updated in response to regulatory or market changes can hardly be considered effective in the eyes of the DOJ.

The seventh dimension requires that the internal reporting channel be genuinely confidential, accessible to all levels of the organization, and free from verifiable retaliation. The eighth dimension addresses internal incentive and disciplinary systems; the authority assesses whether the structure of compensation, bonuses, and promotions reinforces or contradicts compliance objectives, based on the assumption that financial incentives take precedence over declarative policies when the two point in opposite directions.

The ninth and final dimension is, in terms of enforcement policy, the most decisive: remediation and the role that the compliance program itself played in uncovering the unlawful conduct. If it was the compliance program (and not an external investigation, a complaint from a competitor, or action by the authority) that detected and escalated the violation, this carries substantial weight in the prosecutor’s assessment of both the decision to prosecute and the sentencing recommendation. This aspect is directly linked to the leniency program; a well-designed program not only prevents anticompetitive conduct but also, when such conduct occurs, maximizes the likelihood that the company will be the first to self-report and thereby qualify for the immunity offered by the corporate leniency program.

This creates a very powerful alignment of incentives, as companies have a strong incentive to invest in internal detection mechanisms and not just in declarative or cosmetic policies.

It appears that this is the approach the CNA intends to take, as in recent statements, CNA Chairwoman Andrea Marván has highlighted the importance of competition compliance programs as a tool for preventing and detecting potential violations of the law.^[6]

Ultimately, the DOJ’s guidance establishes a robust and practical standard for antitrust compliance programs, one that prioritizes effectiveness over formalism, by requiring companies to demonstrate that compliance mechanisms are adequately designed, genuinely implemented, and capable of identifying and addressing competition law risks.

B. Brazil

In 2016, Brazil’s Administrative Council for Economic Defense (“CADE” for the Portuguese acronym) published its Guidelines on Competition Compliance Programs with the aim of providing non-binding guidance on the structure, implementation, and benefits of competition compliance programs.^[7] These guidelines set forth the minimum components of an effective program and how CADE will evaluate them in the context of enforcement proceedings and settlement agreements (“TCCs,” for the Portuguese acronym).

Like the DOJ, the Brazilian model does not operate through prior certification by a public authority, but rather through an ex post evaluation system: when a company is under investigation or enters into a settlement agreement, the existence and quality of its compliance program are evaluated by CADE as evidence of good faith and as a mitigating factor in determining the penalty. CADE’s Guidelines identify the elements that distinguish a genuine program from a superficial one, organizing them around risk assessment, senior management commitment, reporting channels, and internal detection capabilities.

The CADE Guide is based on the premise that an effective compliance program should not be limited to the existence of formal policies but should bring about real changes in corporate culture. Consequently, CADE distinguishes between merely formal programs (sham compliance programs) and robust programs capable of preventing, detecting, and correcting anticompetitive conduct. To this end, it identifies five essential elements: (i) commitment from senior management (“tone from the top”), (ii) ongoing training tailored to the company’s risks, (iii) oversight and monitoring mechanisms, (iv) disciplinary measures for non-compliance, and (v) alignment of the program with the specific risks of the business.

The strength of the Brazilian model lies in its integration with the leniency program and the TCCs; a compliance program that detects and reports a violation can yield significant procedural benefits, creating a real incentive for programs to be genuinely functional rather than merely documentary. The weakness is the ex ante uncertainty, as companies do not know precisely what reduction in penalties they can expect from the certification of a given program.

Unlike other models focused exclusively on cartels, the Brazilian Guidelines adopt a broad approach that covers both collusive conduct and risks associated with abuses of dominant market position, business associations, exchanges of sensitive information, and other competition law violations.

By comparison, the Brazilian model is characterized by its emphasis on transforming organizational culture and on the ex ante prevention of competition risks. The Guidelines clarify that it is up to the company to demonstrate the effectiveness of the program and that the mere existence of written policies does not guarantee any benefits. The authority has insisted that only those programs capable of demonstrating a real impact on corporate behavior deserve to be considered within the framework of competition law enforcement.

C. Colombia

Colombia likely represents the most elaborate case in the region from an institutional architecture perspective, as well as the Guidelines on the Design of Compliance Programs in the Area of Free Economic Competition, published by the Superintendency of Industry and Commerce (“SIC”).^[8]

Its institutional origin is significant, as it stems from the structural redesign introduced by Decree 092 of 2022, which established the Compliance Directorate as an autonomous unit within the SIC, with specific functions to promote best practices and monitor guarantees, conditions, and orders resulting from administrative investigations. This institutional design distinguishes the Colombian model from others in the region, as the authority not only issues guidelines but also assumes an active role in supporting the implementation of programs, similar to what Mexico aims to achieve with the creation of the General Directorate of Compliance and Enforcement.^[9]

In terms of its substantive content, the Colombian Guide also structures its recommendations around nine components. The first and most cross-cutting component is a culture of compliance and the commitment of senior management; the Guide requires that the highest governing body ensure the design, approval, updating, and implementation of the program, and that this commitment be reflected in verifiable corporate documents (board meeting minutes, corporate governance codes, management reports) and not merely in policy statements.

The second dimension is risk management regarding anti-competitive practices, structured into four sequential stages: identification, assessment or measurement, control, and monitoring, with explicit reference to ISO 31000:2018 as the applicable technical standard. The third and fourth dimensions address resources (human, financial, technical, and operational) and the role of the compliance officer, for whom the Guide requires genuine autonomy and independence, without limiting the profile to a specific profession but requiring technical capacity to investigate, determine, and respond to competition-related risks.

The remaining components address internal communication mechanisms and reporting channels; training tailored to employees’ risk profiles; incentive mechanisms and the internal disciplinary process; due diligence regarding suppliers and partners; and, finally, the periodic evaluation of the program using measurable indicators. On this last point, the Guide adopts a continuous improvement approach, once again aligning with its international counterparts in the view that a program that is not measured or updated in light of regulatory or market changes is considered ineffective, regardless of its original design.

Two elements of the Colombian Guide are particularly relevant to the analysis proposed in this article. The first is the clarification of the four possible origins of a compliance program: voluntary adoption, a commitment arising from a guarantee proposal accepted by the authority, conditions imposed in business integration processes, and orders issued as a result of administrative investigations. This typology reveals that the Colombian model does not view compliance as an exclusively preventive tool, but rather as a mechanism for negotiating a way out of ongoing enforcement proceedings.

The second element is precisely this link, the Guide devotes a specific section to incentives for cooperation with the authority, recognizing that a well-designed program not only prevents misconduct but also, when such misconduct occurs, positions the entity to access the benefits program in a timely manner. The tension between these two functions, prevention and enabling self-reporting, constitutes one of the most significant regulatory policy challenges that the CNA must resolve.

IV. Proposals for the CNA

The comparative analysis reveals that, in practice, most of the compliance programs currently in place in the Mexican market would not withstand serious scrutiny regarding their effectiveness. They have written policies, a designated Compliance Officer, and, in the most elaborate cases, annual training sessions. What they lack, however, is what the benchmark jurisdictions consider the core of the matter: verifiable evidence that the program changes actual behaviors within the organization.

A comparative analysis reveals a set of elements that the benchmark jurisdictions—regardless of their differences in institutional design—consider indispensable for a compliance program to be genuinely effective. These elements can be organized into three dimensions: governance and culture, risk management, and operations and response. When issuing its guidelines, the CNA must precisely define what evidence it will require to demonstrate compliance with each of these elements.

A. Dimension 1: Governance and Culture

The most important element of a compliance program is not found in the manual; it lies in the CEO’s response when a sales department reports that it lost a contract because it did not participate in a price-fixing agreement with competitors. That moment reveals whether the “tone at the top” is genuine or merely declarative. All relevant jurisdictions agree that a program without genuine support from senior management is, at best, cosmetic; at worst, a procedural defense that the company attempts to invoke after being investigated.

For the CNA, this means requiring concrete evidence that the board of directors has formally approved the program and reviews it periodically, that executives actively and consistently communicate it, and that there is a direct reporting line between the compliance officer and the highest level of management. A code of ethics posted on the corporate intranet is not enough; the international standard requires demonstrating that compliance policies influence business decisions, even when that influence entails costs.

The independence of the compliance officer is the second component of this dimension. The DOJ’s experience is illustrative: prosecutors do not ask whether a compliance officer exists, but rather whether the officer has the authority and resources to perform their duties without interference from business-generating departments. An officer who reports to the chief commercial officer does not provide institutional safeguards.

The Colombian SIC’s guidelines point in the same direction: the compliance officer must have access to sensitive information and the ability to escalate issues without fear of retaliation. For medium-sized companies, this does not require a full-time specialist — it can be an external consultant — but it does require that the consultant has real access to the highest level of management and the resources to operate without depending on the very department they may eventually need to investigate.

B. Dimension 2: Risk Management

Risk assessment is fundamental to the program’s actual effectiveness. A program that states that “the company is committed to complying with the Federal Economic Competition Law” without analyzing the specific risks of that particular business serves no preventive function; it is a statement of good intentions, not a management tool.

A genuine risk assessment must identify the markets in which the company operates and its position within them, regular contacts with competitors—including those that occur in trade associations under the guise of legitimate activity—commercial practices with anticompetitive potential, and emerging risks introduced by technological tools or new business models. The DOJ has been explicit in stating that assessments must be updated periodically and reflect changes in the business model. A certified program whose risk assessment is three years old and has not been revised is, in practical terms, an obsolete program.

Furthermore, this analysis must translate into differentiated operational policies—not a general competition policy, but specific protocols for participation in trade associations, for exchanging information with competitors in legitimate contexts, for submitting bids in tenders, and for interacting with distributors in situations involving vertical risk. It is this specificity that enables employees to know what to do the moment a risk materializes.

C. Dimension 3: Operations, Detection, and Response

The international standard is clear on two points: training must be tailored to risk profiles, the sales director who negotiates with competitors requires different training than the procurement department, and it must be provided on a regular basis. A one-time training session at the time of hiring does not build a culture of compliance.

In addition, an independent reporting channel is the component that turns the program into an early-detection system. Comparative evidence consistently shows that most internal violations are known to someone within the organization before they reach the authorities. The compliance program is the mechanism that allows this knowledge to be channeled toward correction before the damage becomes irreparable. For the CNA, certifying a reporting channel does not mean simply verifying that an email address exists, but rather verifying that employees trust it, that it guarantees true confidentiality, and that those who report in good faith have effective protection against retaliation.

Monitoring and auditing are what distinguish a living program from one that existed at the time of certification but subsequently ceased to evolve. The CNA should require, as a condition for both the granting and the triennial renewal of certification, evidence of periodic reviews, internal or external audits of the program’s actual functioning, and adjustments made as a result of those reviews.

Finally, the models analyzed recognize that the ability to investigate internally, remedy the conduct, and, where appropriate, voluntarily report the violation to the authority is the most powerful indicator that a program is functioning as designed.

Incentives must be aligned so that when a company detects a potential violation, it reports it to the authority, linking this to an effective leniency program; these two elements should reinforce each other to benefit enforcement.

V. Conclusions

The introduction of compliance program certification in the amended FECL is a well-founded regulatory policy decision. Comparative experience shows that genuinely effective compliance programs reduce the incidence of anticompetitive conduct, improve internal detection, and, when properly coordinated with leniency mechanisms, enhance public enforcement. Linking these programs to a mitigating factor in the penalty regime is the kind of incentive that can transform the compliance culture of the Mexican private sector.

However, the success of this instrument depends critically on the design decisions the CNA adopts in its secondary guidelines. A comparative analysis of Brazil, Colombia, and the United States reveals three key lessons: first, certification requires a precise and verifiable technical standard; second, the credibility of the process demands an evaluation mechanism that mitigates the risks of arbitrariness and capture, ideally with independent participation; and third, incentives must be sufficiently clear and universally accessible to generate widespread adoption, particularly when linked to the immunity program.

If the guidelines are technically sound, accessible in design, and credible in application, the instrument can become one of the pillars of a new culture of economic competition in Mexico.

Click here for a PDF version of the article

[1] Amílcar Peredo is the lead partner in the Antitrust Practice and currently the managing partner at Basham, Ringe & Correa. Gustavo González is a senior associate in the Antitrust Practice at Basham, Ringe & Correa.

[2] Constitutional and statutory reform on competition matters enacted in Mexico in 2025. Available in Spanish at: https://www.dof.gob.mx/nota_detalle.php?codigo=5763164&fecha=16/07/2025#gsc.tab=0

[3] OECD, Competition Compliance Programs (2021). Available in Spanish at: https://www.oecd.org/content/dam/oecd/en/publications/reports/2021/10/competition-compliance-programmes_2c1675af/9f6a5618-en.pdf

[4] COFECE, Recommendations for Complying with the Federal Economic Competition Law (2019). Available at: https://www.cofece.mx/wp-content/uploads/2021/02/DYO_Recom-ENG.pdf

[5] DOJ, Evaluation of Corporate Compliance Programs in Criminal Antitrust Investigations (2024). Available at: https://www.justice.gov/atr/media/1376686/dl

[6] National Antitrust Commission (Mexico), Chairwoman Andrea Marván Saltiel highlighted the importance of competition compliance programs and the development of clear, transparent, and impartial certification criteria, LinkedIn (June 2026), https://www.linkedin.com/posts/comisi%C3%B3n-nacional-antimonopolio_la-comisionada-presidenta-andrea-marvan-saltiel-activity-7467292369562804224-YBSL (last visited June 23, 2026).

[7] CADE, Guidelines for Competition Compliance Programs (2016). Available at: https://cdn.cade.gov.br/Portal/centrais-de-conteudo/publicacoes/guias-do-cade/compliance-guidelines-final-version.pdf

[8] SIC, Guía de Orientación para el Diseño de Programas de Cumplimiento en Materia de Libre Competencia (2024). Available at: https://sedeelectronica.sic.gov.co/sites/default/files/publicaciones/GuiaCumplimiento_sept02_2024.pdf

[9] See the Organic Statute of the National Antitrust Commission, published in the Official Gazette on November 19, 2025. Available at: https://www.antimonopolio.gob.mx/Micrositios/wp-content/uploads/2025/11/Estatuto-organico-DOF.pdf