Corporate Investigations in Mexico

Ricardo Cacho – Von Wobeser y Sierra, S.C.

Mexican companies, and the Mexican subsidiaries of multinational groups, are increasingly judged by the yardstick of US enforcement practice. The US Department of Justice (DOJ) asks whether a company’s compliance programme can detect, investigate and remediate misconduct,[1] and the cooperation credit a company may obtain depends heavily on the quality and timeliness of its own fact-finding. As experienced US practitioners warn, mistakes made in the initial phases of an investigation can have costly repercussions at a later stage.[2]

Mexico has no statute that regulates internal investigations as such. Best practice is therefore to adopt the standards reflected in the FCPA Resource Guide,[3] DOJ guidance and international practice, while adapting them to Mexican constitutional, criminal, labour and data protection rules.[4] Below we outline those practices, with particular focus on the stage that most often determines the outcome: witness interviews.

Laying the groundwork

Independence and scope. Where the conduct is serious or implicates senior management, the investigation should be led by external counsel reporting to the board, or to a committee free of conflicts.[5] A written work plan, setting out the who, what, when and where, the documents to be collected, the interviews to be conducted and the expected form of the final report, imposes discipline on the investigators and supports later privilege claims.[6]

Preservation first. As soon as potential misconduct is identified, the company should issue a hold notice, suspend automatic deletion and secure email, shared drives and, critically, messages on mobile devices, which US authorities now scrutinise closely.[7] Ownership, access and chain of custody of the evidence should be documented under recognised forensic standards.[8]

Mexican filters. The Mexican Constitution protects the inviolability of private communications, and the new federal law on personal data held by private parties governs how employee information may be processed.[9] In practice, this means relying on clear corporate policies on monitoring and on the use of personal devices for work, obtaining informed, specific and written consent before accessing a personal device, and processing only data with a documented connection to the facts under review.[10]

Interviews: where investigations are won or lost

Documents show what happened; interviews explain why, and who knew. Interviews are also dynamic: what witnesses say reveals new custodians and search terms, and newly reviewed documents in turn require follow-up interviews.[11]

Preparation. Every interview should have a defined objective and a written protocol.[12] Sequencing matters. Investigators usually begin with knowledgeable witnesses who are sufficiently removed from the conduct, and approach the central subjects only once the record is developed, since interviewing a target too early may alert them and compromise the investigation.[13] Before each session, the team should master the chronology, decide which documents will be shown and in what order, and anticipate the explanations the interviewee is likely to offer.

The Upjohn warning. Interviewees must be told that counsel represents the company, not them personally; that the conversation is confidential and may be privileged; and that the privilege belongs to the company, which may decide to waive it, including before the authorities.[14] Even where Mexican law does not require a formal warning, giving it, in Spanish and on the record, protects both fairness and the usability of the findings.

Conduct. The setting should be professional but not intimidating, held at a reasonable hour and in the interviewee’s language, without undue pressure.[15] Two investigators work best: one leads the questioning while the other takes notes and observes. Remote interviews require additional controls over unauthorised recording, the documents shared on screen and the data retained by the platform.

Reading the interviewee. Skilled interviewers begin with neutral questions to establish a baseline of how the person speaks and behaves when relaxed, then invite a free narrative before narrowing to specifics. Against that baseline, they watch for shifts in non-verbal behaviour (posture, gaze, gestures, tone of voice) that coincide with particular questions. These signals are never proof of deception on their own; their value lies in flagging topics that deserve deeper probing. Verbal cues are often more telling: answering a different question from the one asked, heavy qualifiers such as ‘to the best of my recollection’, selective memory gaps on key events alongside precise recall of peripheral ones, or explanations that shift when the topic is revisited.

Contradictions and illogical positions. The most reliable indicator of evasion or falsehood is inconsistency: with the documents, with the witness’s own earlier statements, with other witnesses, or with ordinary business logic. A manager who insists he never reviews supplier invoices, yet whose emails show him querying specific invoice line items, has not merely made a mistake; he has opened a new line of inquiry.

The confrontational interview. Interviews with the subjects of the investigation are typically held last, once the evidence has been gathered. The technique is to let interviewees commit to their account first and only then to present the evidence progressively, giving them a genuine opportunity to explain each document. Revealing the evidence too early allows the interviewee to tailor the narrative; revealing it carelessly turns the session into an ambush. Investigators must never threaten, make promises or misrepresent the evidence. In Mexico, statements obtained under pressure can be challenged in labour proceedings, so voluntariness and a contemporaneous record are essential. This stage demands skill, composure, timing and judgement, on top of the diligence the whole investigation requires.

Closing and recording. Each interview should end by reminding the interviewee of any confidentiality obligations, providing a point of contact and reiterating the company’s non-retaliation policy.[16] Counsel should prepare interview memoranda promptly. Sharing their substance with the authorities may waive privilege over the underlying notes, so disclosure strategy must be considered from the outset.[17]

From findings to a stronger compliance programme

An investigation is only as valuable as what the company does with its findings. US authorities assess whether the company identified root causes, disciplined those responsible and strengthened its controls.[18] For Mexican companies, adopting these standards while respecting local legal limits is no longer optional: it is the measure by which regulators, auditors and counterparties judge whether a compliance programme truly works.

Notes

[1] US Department of Justice, Criminal Division, Evaluation of Corporate Compliance Programs (updated September 2024).

[2] David Sarratt, Josh A Cohen and Nicholas Folly (Debevoise & Plimpton), ‘Beginning an internal investigation: the US perspective’, in The Practitioner’s Guide to Global Investigations, 10th ed. (Global Investigations Review), §§ 1–2.

[3] US Department of Justice and US Securities and Exchange Commission, A Resource Guide to the U.S. Foreign Corrupt Practices Act, 2nd ed. (July 2020).

[4] See Von Wobeser y Sierra, S.C., Diego Sierra et al., ‘Mexico: Internal Investigations’, in The Practitioner’s Guide to Global Investigations, vol. II (Global Investigations Review / Latin Lawyer, 2024).

[5] International Bar Association, IBA Guidelines on Internal Investigations of Companies (2012); Sarratt, Cohen and Folly, supra note 2, § 4.

[6] Sarratt, Cohen and Folly, supra note 2, §§ 5 and 5.3.

[7] Id., § 6.1; DOJ, Evaluation of Corporate Compliance Programs, supra note 1.

[8] US Securities and Exchange Commission, Division of Enforcement, Enforcement Manual.

[9] Political Constitution of the United Mexican States, Article 16; Ley Federal de Protección de Datos Personales en Posesión de los Particulares (Official Gazette of the Federation, 20 March 2025).

[10] IBA Guidelines, supra note 5; Sierra et al., supra note 4.

[11] Sarratt, Cohen and Folly, supra note 2, § 6.3.

[12] IBA Guidelines, supra note 5.

[13] Sarratt, Cohen and Folly, supra note 2, § 5.1.

[14] Upjohn Co. v. United States, 449 U.S. 383 (1981).

[15] IBA Guidelines, supra