Running payroll in Mexico: IMSS, INFONAVIT, ISR, and the 2026 workweek reform

Mexico runs one of the densest payroll compliance stacks in Latin America. IMSS contributions, INFONAVIT housing obligations, ISR withholding, CFDI 4.0 payroll stamping, REPSE exposure, and state payroll taxes all sit inside the same payroll cycle, with penalties that compound quickly when registrations, filings, or salary calculations drift out of line. The 2026 workweek reform adds another moving layer. Employers now need payroll systems that can absorb phased reductions in maximum weekly hours through 2030, enforce new overtime thresholds, and support electronic time-tracking obligations from January 2027 without reducing wages or benefits.

For foreign employers hiring in Mexico through an Employer of Record, the operational challenge is no longer just paying workers correctly. The real challenge is maintaining payroll that survives coordinated SAT, IMSS, INFONAVIT, and STPS scrutiny while keeping monthly labour costs predictable as statutory obligations continue expanding.

ISR is the SAT layer and the easiest of the five regulators to delegate cleanly to an EOR. The brackets are inflation-indexed under Article 152 LISR, the subsidio para el empleo sits on top for low earners, and the asimilados a salarios category sits beside it for a narrow set of board-fee and corporate-officer relationships.

ISR is the cleanest layer. The on-cost stack lives one level down, in the IMSS social-security branches, the INFONAVIT housing contribution, and the state-level ISN. This is where the 2020 pension reform is still actively raising the bill year on year, and where the SBC ceiling caps the upper exposure.

The contribution stack is monthly. The Federal Labor Law sits on top of that with a calendar of payments the employer cannot negotiate down: aguinaldo by 20 December, prima vacacional with the leave, PTU by 30 May, and a vacation entitlement that the 2023 reform doubled for new hires.

• Aguinaldo (Article 87 LFT): minimum 15 days’ salary, payable by 20 December each year. Workers with less than one year of service receive a proportional amount on the ordinary daily wage base.
• Prima vacacional (Article 80 LFT): at least 25 % of the wages corresponding to the vacation period, paid when leave is taken.
• Vacation days (Article 76 LFT, 2023 reform): doubled minimum entitlements from 1 January 2023. Year 1 = 12 days, year 2 = 14, year 5 = 20, year 6-10 = 22, year 11-15 = 24, scaling to 30 days from year 26. Workers must be able to enjoy at least 12 consecutive days under Article 78.
• PTU (Article 117 LFT): 10 % of fiscal profit, distributed 50 % by days worked and 50 % by salaries earned, with personas morales paying by 30 May each year. The 2021 cap under Article 127 fr VIII caps each worker’s PTU at the greater of 3 months’ salary or the worker’s average PTU over the prior three years (whichever is more favourable to the worker). The SCJN Second Chamber confirmed the cap’s constitutionality in 2024. Directors, administrators, and general managers are excluded; workers must have served at least 60 days during the year.
• Overtime (Articles 67-68 LFT): first 9 hours per week at 200 % (double); hours 10-13 at 300 % (triple). Maximum overtime permitted: 9 hours per week at double rate plus up to 4 hours at triple.
• Public holidays (Articles 74-75 LFT): 8 mandatory federal holidays plus inauguration and election days. Work performed on a mandatory rest day is paid at the regular daily wage plus 200 % premium (triple pay).
• Prima dominical (Article 71 LFT): 25 % premium for workers whose ordinary schedule includes Sunday.

The contractual payments are statutory but stable. The workweek framework is statutory and moving. The 3 March 2026 constitutional amendment is the most consequential labour-law change Mexico has produced in a decade and reshapes how payroll systems have to compute, record, and bill working time through 2030.

All of the above only matter if the filings land on time. Mexican payroll runs on five separate calendars across three platforms, and any one of them missed triggers proportional penalties that compound across the others.

Before paying salary, a new employer must complete four registrations:

1. SAT RFC for the legal entity, with certified acta constitutiva, comprobante de domicilio fiscal, and representative ID.
2. IMSS Registro Patronal within 5 business days of the first employment relationship; failure triggers fines of 20-350 × UMA (MXN 2,346-41,058).
3. INFONAVIT NRP, automatically assigned on IMSS registration; multi-location employers can centralise under one NRP delegation.
4. State Secretariat ISN registration in each state where workers are physically located.

CFDI 4.0 nómina stamping is mandatory under Article 99 fr III LISR. The technical standard is Anexo 20; CFDI 4.0 became the sole valid version on 1 April 2023.

The 2026 reform to Article 29-A fr IX CFF (DOF 7 November 2025, effective 1 January 2026) added a substantive reality requirement: a correctly stamped CFDI documenting a simulated transaction can be declared false, denying all tax effects and triggering criminal prosecution. Each CFDI must be stamped by an authorised PAC. The reality requirement is the part that changed in January 2026, and it shifts liability onto the issuer and the receiver in equal measure.

IMSS compliance runs across three operational systems:

• SUA for contribution calculations
• IDSE for worker registrations, removals, and SBC modifications, each within 5 business days
• SIPARE for payment-reference generation

Bimonthly payment periods run January-February, March-April, and so on, with payment due by the 17th of the following month. The annual ISR reconciliation under Article 99 LISR (DIM declaration) is due by 15 February.

Filings get the work into the four operating regulators. REPSE is what keeps the work deductible for the foreign client. Of every compliance feature on the Mexican stack, this is the one that most directly determines whether a foreign EOR engagement is economically viable.

The April 2021 reform (DOF 23 April 2021) rewrote Mexico’s staffing architecture. Article 12 LFT now prohibits the subcontracting of personnel: no natural or legal person may provide or make available their own workers for the benefit of a third party. Employment agencies remain permitted only for recruitment, selection, and training, not for providing operational staff.

The only permitted subcontracting model is the provision of specialised services or specialised works under Article 13 LFT, subject to three cumulative conditions:

1. The services or works must not form part of the corporate purpose (objeto social) or predominant economic activity of the beneficiary company.
2. The contractor must be registered with REPSE (Registro de Prestadoras de Servicios Especializados u Obras Especializadas) at the time of service delivery.
3. A written contract under Article 14 LFT must formalise the arrangement.

Article 14 LFT establishes joint and several liability (responsabilidad solidaria) between the beneficiary and the contractor for all labour, social-security, and tax obligations arising from the contracted workers during the term of the agreement.

REPSE registration through the STPS SIRPSE platform requires positive tax-compliance opinions with SAT (Article 32-D CFF), IMSS, and INFONAVIT, and is valid for 3 years, with renewal due 3 months before expiry under the STPS procedure published 21 February 2024.

The single biggest exposure for a foreign client running Mexican payroll through an EOR is REPSE, and the consequence is financial rather than operational. Article 15-D CFF denies both the ISR deduction and the IVA credit on invoices routed through a non-REPSE-compliant supplier, retrospectively and without warning.

That makes the EOR’s REPSE certificate (registro válido y vigente) the first document to review, ahead of pricing or onboarding timelines. Foreign employers should confirm that the provider’s objeto social is genuinely distinct from the client’s core business activity, that the REPSE registration covers the correct specialised-services category, and that renewal will remain valid throughout the engagement period.

PE exposure is the second major risk layer. Article 2-A LISR mirrors Article 5 of the OECD Model Convention following Mexico’s adoption of the Multilateral Instrument in 2023. Common triggers include:

• A fixed place of business, including a systematically used home office
• A dependent agent habitually concluding contracts on behalf of the foreign employer
• Anti-fragmentation rules under BEPS Action 7

A REPSE-compliant EOR materially reduces the dependent-agent and fixed-place-of-business risks because the EOR, rather than the foreign company, becomes the legal employer. The structure does not eliminate PE exposure on its own. Foreign employers still need to avoid exercising day-to-day direction, supervision, or commercial control to a degree that creates an agency PE. SAT’s 2025 Plan Maestro specifically identified cross-border staffing arrangements as an enforcement focus.

Two workplace health and safety frameworks sit alongside the payroll and tax layer.

• NOM-037-STPS-2023 (DOF 5 December 2023) governs teletrabajo, defined as work where more than 40 % of weekly hours are performed outside the employer’s premises. Employer obligations include:
  1. A written Teletrabajo Policy
  2. Validation of home-workspace safety and ergonomic conditions
  3. Provision of work equipment such as computers and ergonomic chairs
  4. Proportional reimbursement of internet and electricity costs, commonly through a fixed bono de teletrabajo
  5. Digital disconnection protections
  6. Records of equipment provided

Penalties under Article 994 LFT run 250-5,000 × UMA per infraction per affected worker, equating to MXN 29,328-586,550 at the 2026 UMA value.

• NOM-035-STPS-2018 (DOF 23 October 2018, fully effective from 23 October 2020) adds psychosocial-risk obligations that scale by workforce size:

1. 1. 1-15 workers: written psychosocial-risk policy
   2. 16-50 workers: approved questionnaires every two years
   3. 51+ workers: full organisational-environment evaluations every two years

That leaves four operational checkpoints for any 2026 Mexican EOR engagement:

1. REPSE validity and scope
   Active registration, correct specialised-services category, objeto social distinct from the client’s activity, and renewal comfortably beyond the expected engagement period.
2. CFDI reality compliance
   Under the November 2025 CFF reform, every CFDI must reflect a genuine transaction supported by documentation capable of surviving coordinated SAT/STPS/IMSS/INFONAVIT review.
3. Workweek-reform readiness
   Payroll systems must support the phased 2027-2030 reduction in weekly hours, the Article 132 fr XXXIV electronic time-tracking requirement from 1 January 2027, and the prohibition on reducing wages or benefits as hours decline.
4. NOM compliance coverage
   NOM-037 teletrabajo obligations where remote work exceeds the 40 % threshold, together with NOM-035 psychosocial-risk assessments based on workforce size.

The first move for a foreign employer entering Mexico in 2026 is not comparing EOR pricing. It is asking shortlisted providers for a copy of their REPSE certificate and tracing an existing client invoice through to the SAT deduction it supports. If the provider cannot walk through that process cleanly, the compliance structure is weak regardless of cost.