Legal and Compliance Checklist for Employer of Record (EOR) Services in Mexico
- May 27
- 12 min read
Intro
Mexico's compliance environment rewards preparation and punishes improvisation. Employer of record services exist to absorb that complexity — but only when the EOR is genuinely capable, properly registered, and managing every obligation correctly. Getting this wrong carries real consequences: IMSS penalties, SAT surcharges, STPS enforcement under the November 2025 inspection protocol, and labor court exposure for mishandled terminations.
This checklist is built for three moments: pre-engagement due diligence (before you sign with an EOR), new hire onboarding compliance (for every Mexico hire), and ongoing compliance monitoring (quarterly). Work through it with your HR, legal, and finance teams. Every item represents a real compliance risk that has materialized for companies operating in Mexico without adequate oversight of their EOR.
Table of contents:
Provider Due Diligence: Before You Sign Anything
This is the most important section. The 2021 outsourcing reform and November 2025 STPS inspection protocol have raised the compliance stakes for every EOR operating in Mexico. Verify these items before any contract is signed.
REPSE Registration (Non-Negotiable)
Has the EOR provided its current REPSE (Registro de Prestadoras de Servicios o Obras Especializados) registration number?
Have you verified the REPSE number on the STPS public portal (repse.stps.gob.mx)?
Is the REPSE registration active and not expired?
Why this matters: Any EOR without active REPSE registration cannot legally provide specialized services in Mexico. Under the November 2025 STPS inspection protocol, fines for using non-REPSE-registered providers can exceed MXN 4 million (~$200,000) per affected worker. Additionally, service fees paid to non-REPSE providers are not deductible for Mexican corporate income tax purposes — meaning your company bears the tax consequence even if the EOR bears the legal one.
Non-REPSE service fees are not deductible for Mexican corporate income tax and trigger joint-and-several liability for unpaid IMSS contributions.
Mexican Legal Entity Verification
Does the EOR own a registered Mexican entity — S. de R.L. de C.V. or S.A. de C.V.?
Can the EOR provide the entity's RFC (Registro Federal de Contribuyentes — Mexico's tax ID)?
Is the entity registered as an employer with IMSS and INFONAVIT?
Are the IMSS and INFONAVIT employer accounts active with a clean compliance history?
Does the EOR use its own Mexican entity, or does it route through a local partner/aggregator?
Why this matters: An EOR that uses a local partner's entity creates an accountability gap. Joint liability under the 2021 reform means you need to verify the entity that will actually be your employees' legal employer, not the parent company's name.
Compliance Track Record
Can the EOR confirm they have been managing Mexico IMSS SUA filings without outstanding penalties?
Can they explain how they handled the 2026 progressive working hours reform (weekly maximum hours reduction)?
Can they explain their CFDI 4.0 generation process — specifically how they handle CFDI cancellations and reissuance?
Do they have a dedicated Mexico compliance team, or is Mexico managed remotely from a global platform?
Pricing Transparency
Is the total employer cost structure disclosed? (EOR fee + statutory contributions — IMSS, INFONAVIT, AFORE, ISN — + aguinaldo + PTU + vacation premium accruals)
Is ISN (state payroll tax) calculated per-state for your specific employee locations?
Are there any additional fees for CFDI management, SUA filing, or REPSE compliance?
Is there an FX markup on payroll funded in USD/EUR when employees are paid in MXN?
Employment Contract Compliance in Mexico
Every Mexican hire starts with the employment contract. Get this wrong, and every downstream compliance interaction is built on a flawed foundation.
Contract Language and Format in Mexico
Is the employment contract in Spanish? (Required by Mexican law; bilingual English/Spanish is permitted but Spanish controls)
Is the contract compliant with the Federal Labor Law (Ley Federal del Trabajo — LFT)?
Does the contract specify: type of employment (indefinite, temporary, or project-based), salary in MXN, payment frequency (biweekly / quincenal), working hours, rest days, and work location?
Contract Type in Mexico
For indefinite (permanent) contracts, is "contrato por tiempo indeterminado" correctly specified?
For temporary contracts: is the temporary nature clearly justified and time-limited? (Improperly structured temporary contracts convert to indefinite contracts by operation of law)
For project-based contracts, is the specific project named and its expected completion basis documented?
Note: The default under Mexican law is indefinite employment. Any deviation requires documented justification. An employee who works beyond the documented temporary period becomes indefinite by law.
Probationary Period in Mexico
Is the probationary period within legal limits? (Up to 30 days for standard roles, up to 180 days for senior/management/technical specialist positions — Article 39-A LFT)
Are the evaluation criteria communicated to the employee at the start of employment? (Failure to communicate criteria converts a probationary termination into an unjustified dismissal)
Is the probationary period documented in writing in the employment contract?
Working Hours in Mexico (2026 Reform Awareness)
Are working hours compliant with the current LFT maximum? (Mexico is progressively reducing the maximum workweek from 48 hours to 40 hours under the 2023 amendment — verify the applicable maximum for your hire date)
Are overtime provisions documented? (Overtime is compensated at 200% for the first 9 hours per week; subsequent overtime at 300%)
Are rest day and holiday provisions correctly specified?
IMSS Registration in Mexico: The Most Legally Critical Step
IMSS registration is mandatory and must be completed before the employee's first working day — not retrospectively. A single missed registration creates immediate compliance exposure.
Pre-First-Day Requirements
IMSS employer registration: confirmed active in the EOR's name (not your company's)
Employee IMSS registration: completed before day one. If the employee does not yet have an NSS (Número de Seguridad Social), the EOR must assign one through the IMSS portal
SBC (Salario Base de Cotización) calculated correctly: includes base salary plus aliquots of variable benefits (aguinaldo, vacation premium) that integrate into SBC
The 5-business-day registration window: IMSS registration must be completed within approximately 5 business days of the employment start date. Failure triggers automatic unregistered employee status — the employer is then responsible for any medical costs and faces IMSS fines. The EOR manages this registration as part of standard onboarding, but verifies that their process completes it before day one, not within 5 days.
SBC Calculation Verification
Is the SBC calculated to include integrable benefits? (Aguinaldo aliquot: 15/365 × daily salary; vacation premium aliquot: vacation days × 25% ÷ 365 × daily salary)
Is the SBC capped correctly at 25 UMAs/day (~MXN 87,000/month equivalent in 2026)?
Are non-integrable benefits correctly excluded from SBC? (De minimis benefits — food vouchers up to MXN 1 UMA, non-productivity-linked items — do not integrate into SBC)
Why SBC matters: IMSS contributions, INFONAVIT, and severance calculations (indemnización) are all based on SBC, not gross salary. An incorrectly calculated SBC creates under-contribution to IMSS (penalty exposure), over-contribution (cost waste), or incorrect severance calculations (labor court exposure).
INFONAVIT and AFORE
INFONAVIT employer contribution (5% of SBC, capped at 25 UMAs) correctly configured
AFORE retirement account enrollment for each employee confirmed
SUA (Sistema Único de Autodeterminación) bimonthly filing system active for combined IMSS/INFONAVIT/SAR remittances
Mexico Payroll Tax and Contribution Compliance
Biweekly Payroll Cycle
Payroll cycle confirmed as quincenal (biweekly — 15th and last working day of the month) or the agreed semi-monthly schedule
CFDI 4.0 digital payslips are generated and uploaded to SAT's portal for every payroll cycle
CFDI receipts contain the correct RFC of both the employer (EOR entity) and the employee
No payroll disbursed without a corresponding valid CFDI 4.0 receipt (each missing or incorrect CFDI triggers SAT fines of MXN 1,120–14,070)
ISR Income Tax Withholding
ISR withheld at the correct progressive bracket rate for each employee's cumulative monthly income (11 brackets, 1.92%–35%)
ISR withheld and remitted to SAT monthly
Annual ISR annualization performed in December — reconciling cumulative withholding against actual annual tax liability
Over-withholding refunded to employee in December payroll; under-withholding collected
Annual ISR annual declaration supports (constancias de percepciones) issued to employees
IMSS, INFONAVIT, AFORE Remittances
IMSS bimonthly SUA filings submitted on time (due by the 17th of the following bimonth)
INFONAVIT employer contributions (5% of SBC) remitted monthly
AFORE/SAR retirement contributions calculated and remitted
Work risk (siniestralidad) rate is reviewed annually and updated in IMSS records
State Payroll Tax (ISN)
ISN calculated at the correct rate for each employee's work state:
CDMX: 3%
Nuevo León (Monterrey): 3%
Jalisco (Guadalajara): 2.5%
Baja California (Tijuana): 2%
Chihuahua (Ciudad Juárez): 2%
Other states: 1–4% (verify per state)
ISN remitted to each state authority separately for multi-state teams
State payroll tax registration is confirmed for each state where employees work
Statutory Benefits Compliance in Mexico
Aguinaldo (Christmas Bonus)
Aguinaldo calculated at a minimum of 15 days of base salary (annual) or pro-rated for employees with less than one year of service
Aguinaldo disbursed by December 20 (not December 24 or December 31 — December 20 is the LFT deadline)
STPS compliance report filed by January 15, confirming Aguinaldo was paid
The most common missed detail: Aguinaldo is calculated on base salary only — not on integrated benefits or variable compensation above the base rate. Confirm the EOR uses the correct calculation base.
PTU (Profit Sharing)
PTU calculated at 10% of the EOR entity's annual taxable profit
PTU cap applied: higher of (a) 3 months of the employee's individual salary, or (b) average PTU received in the prior 3 years
PTU is distributed by May 30 of the following year
Senior management with decision-making authority was correctly excluded from PTU entitlement
PTU payment records are maintained for STPS inspection readiness
Vacation and Vacation Premium
Vacation entitlement tracked per LFT schedule: 12 days (Year 1), 14 days (Year 2), 16 days (Year 3), 18 days (Year 4), 20 days (Years 5–9)
Vacation premium (25% of vacation pay) calculated and paid when vacation is taken — not at year-end
Employees who leave mid-year: pro-rated vacation and vacation premium calculated and included in final pay
IMSS Benefits Verification
Employees can access IMSS medical facilities from day one of registration
Maternity benefit eligibility confirmed: 30 weeks of IMSS contributions required before the delivery date
Work risk insurance (seguro de riesgo de trabajo) active and siniestralidad rate correctly applied
Termination Compliance: The Checklist You Need Before You Decide
Termination in Mexico is where the most expensive compliance failures happen. The EOR manages the legal process — but the client company must provide the documentation and business rationale. Do not initiate termination discussions with an employee without first engaging the EOR.
Before Communicating Any Termination Decision
EOR consulted before any termination communication to the employee
Termination type determined: just cause (Article 47 LFT), mutual agreement (rescisión por mutuo consentimiento), or unjustified (triggers indemnización triple)
If just cause: documented evidence of the specific LFT Article 47 ground (fraud, dishonesty, violence, habitual insubordination, etc.)
Termination counseling with EOR's Mexico employment law team — not a remote compliance advisor
Just Cause Termination Process
Written dismissal notice prepared specifying:
The specific Article 47 LFT grounds
Dates of the conduct
Evidence supporting the cause
Notice delivered to the employee personally or through the STPS conciliation office (Junta de Conciliación y Arbitraje)
Delivery documented with a signed receipt or official record
30-day window between cause occurrence and dismissal notice respected (stale claims are procedurally vulnerable)
The documentation rule: Even a valid just cause can be lost procedurally. If the dismissal notice is delivered without the correct LFT language, without specifying dates and conduct, or after the 30-day window, a labor court can rule the termination unjustified regardless of the substantive cause. The EOR drafts this notice — but the client company must provide the underlying facts and evidence.
Unjustified Termination or Mutual Agreement
Indemnización triple calculated: 3 months base salary + 20 days per year of service + seniority premium (12 days/year, capped at 2× minimum wage)
All accrued benefits calculated: pro-rated Aguinaldo, accrued vacation, vacation premium, and PTU due
Final pay settlement signed with employee (finiquito — the Mexican final pay settlement document)
20 days from decision to payment — Mexican practice standard for final pay processing
IMSS Baja (deregistration) filed immediately after the last working day
IMSS Baja
IMSS deregistration is completed on the employee's last working day or the following business day
INFONAVIT employer obligations settled through the separation date
AFORE contribution for the final period confirmed
Data Privacy and Employee Data Compliance in Mexico
Mexico's Federal Data Protection Law (Ley Federal de Protección de Datos Personales en Posesión de los Particulares — LFPDPPP) governs employee personal data. Violations carry fines of MXN 100,000–320,000,000 depending on severity.
Pre-Employment
Privacy Notice (Aviso de Privacidad) provided to employee at or before signing of employment contract
Aviso de Privacidad specifies: categories of data collected, purposes, retention periods, third-party disclosures, and employee rights
Ongoing Data Handling
Data Processing Agreement (DPA) or equivalent between your company and the EOR covering employee personal data processing
Employee data minimization: only data necessary for employment purposes is shared with the EOR
Cross-border data transfer mechanism in place if employee data leaves Mexico (LFPDPPP requires adequacy determination or binding contract)
Employee data retention policy aligned with Mexican statutory requirements (payroll records: 10 years for SAT purposes)
Record Retention
IMSS records: maintained for a minimum of 5 years
SAT/ISR payroll records (CFDI): maintained for 10 years
LFT employment records (contracts, payslips, vacation records): maintained for 10 years
INFONAVIT contribution records: maintained for a minimum 5 years
Ongoing Compliance Monitoring Checklist in Mexico
Mexico's regulatory environment changes frequently. The 2026 working hours reform is active. IMSS contribution ceilings (UMA value) update annually. SAT CFDI rules evolve. ISR brackets are recalculated. State minimum wages change. A proactive EOR tracks all of this. A reactive one does not.
Regulatory Change Tracking
EOR has a confirmed process for monitoring: LFT amendments, SAT CFDI circulars, IMSS contribution ceiling updates (UMA changes), state ISN rate changes, STPS inspection protocol updates, INM immigration regulation changes
EOR proactively notified your team of the November 2025 STPS inspection protocol update (if yes, this is a good sign; if no, ask why not)
2026 working hours reduction schedule being tracked: Mexico is phasing down from 48 to 40 maximum weekly hours through 2030 — current maximum hours per your hire date are correctly reflected in employment contracts
Monthly Compliance Review
Monthly IMSS SUA filing confirmed submitted on time
CFDI 4.0 receipts generated without errors for every payroll cycle (CFDI cancellations and reissuance tracked)
ISN was remitted to each state correctly
SAT monthly ISR remittance confirmed
INFONAVIT monthly employer contributions confirmed remitted
Annual Compliance Calendar
Date | Obligation |
January 15 | STPS Aguinaldo compliance report filed |
January 31 | Annual ISR declaration supports issued to employees |
February (IMSS) | Annual SBC revision — update employee SBC for any salary changes in the prior year |
May 30 | PTU distributed to employees |
December 20 | Aguinaldo paid |
December 31 | ISR December annualization completed; over/under withholding settled |
Annual | IMSS work risk (siniestralidad) class review; update if risk classification changed |
Annual | REPSE registration renewal confirmed |
Permit Renewals (Foreign National Employees)
Temporary Resident Visa with Work Authorization expiry calendared with 60-day advance notice
INM renewal process initiated before expiry
Employee continues to work only while a valid authorization is in place — no gap between expiry and renewal confirmation
How Team Up Addresses This Checklist
Every item on this checklist represents a real compliance obligation that Team Up manages as standard across its Mexico EOR service.
REPSE: Team Up holds and maintains active REPSE registration for Mexico operations.
IMSS and SBC: Calculations use the correct integrated SBC, including benefit aliquots — not gross salary alone.
CFDI 4.0: Every payroll cycle is backed by valid CFDI receipts uploaded to SAT. Cancellation and reissuance processes are managed as standard.
ISN by state: State payroll tax is calculated and remitted per employee's work state, not at a flat rate.
PTU and Aguinaldo: Accrued monthly. PTU distributed by May 30. Aguinaldo paid by December 20.
Proactive compliance monitoring: When the November 2025 STPS inspection protocol was issued, Team Up's Mexico operations updated client documentation and REPSE compliance records. Regulatory changes are tracked as part of in-country operations, not through a remote compliance platform.
Termination guidance: Before any termination communication to an employee, Team Up provides: LFT grounds analysis, process documentation requirements, full cost modeling (just cause vs. unjustified), and execution management through final pay and IMSS baja.
Team Up's Mexico EOR operates alongside owned entities in Georgia, Armenia, Azerbaijan, Turkey, India, Kazakhstan, Uzbekistan, and Eastern Europe — delivering the same compliance quality across every market from one platform, from €199 per employee per month.
Bottom line
Mexico's compliance framework is detailed, actively enforced, and changing. The 2026 working hours reform is in progress. The 2025 STPS inspection protocol is in effect. IMSS contribution rates update. ISR brackets adjust. A proactive EOR tracks all of it and keeps your employment relationships ahead of it — not catching up after an audit surfaces a gap.
Team Up's Mexico EOR coverage starts from €199 per employee per month on a unified platform that covers 20+ countries. REPSE-registered. CFDI 4.0 compliant. Full LFT statutory benefits. In-country compliance monitoring.
And if you need compliant Mexico hiring from day one — alongside the Caucasus, Central Asia, Turkey, India, or the Philippines — the platform is already in place.
Frequently Asked Questions
What is the most common EOR compliance failure in Mexico?
Incorrect SBC calculation — specifically, running IMSS contributions on gross salary without integrating benefit aliquots. This creates under-contribution to IMSS, which compounds as a cumulative liability with monthly penalties. The second most common failure is late aguinaldo payment — missing the December 20 deadline triggers STPS enforcement, back-payment with interest, and damages the employment relationship permanently.
What does REPSE non-compliance actually cost a foreign company?
Under the November 2025 STPS inspection protocol, fines for using non-REPSE-registered providers can exceed MXN 4 million per affected worker. Additionally, service fees paid to non-REPSE providers are not deductible for Mexican corporate income tax — meaning the non-deductible EOR cost creates an effective tax surcharge on top of the fine exposure. Verify REPSE status before any EOR contract is signed.
How does immigration compliance intersect with EOR payroll registration in Mexico?
For foreign national employees, work authorization (Residente Temporal with work authorization from INM) must be confirmed before the employment relationship begins. IMSS registration and payroll cannot legally precede INM authorization. An EOR that initiates payroll before INM authorization creates an unauthorized employment relationship. Budget 4–8 weeks for the immigration process and plan hiring timelines accordingly.
How long must Mexico payroll records be retained?
CFDI payslip records must be retained for 10 years (SAT requirement). IMSS contribution records: 5 years. LFT employment records (contracts, vacation records, termination documents): 10 years. INFONAVIT records: 5 years. Data Privacy (LFPDPPP) retention periods are set by the purposes stated in the Aviso de Privacidad, subject to these statutory minimums.
What is the correct termination process for a poor-performing employee in Mexico?
"Poor performance" is not a listed just cause under LFT Article 47. To terminate for performance, the employer typically needs: documented performance standards communicated at hire, written warnings with employee acknowledgment, a formal improvement process, and documented failure to meet standards despite opportunity. Without this foundation, the termination is classified as unjustified — triggering indemnización triple (3 months + 20 days/year + seniority premium). The EOR should be consulted before any performance management action that might lead to termination.