Understanding REPSE Certification: A key to legal compliance for businesses in Mexico

Key takeaways:

• REPSE certification is mandatory for companies providing specialised services or work in Mexico through subcontracting, introduced as part of Mexico’s 2021 labour reform.
• Joint liability applies. If a subcontractor is not REPSE-registered, the contracting company can also face penalties, making supplier verification critical.
• Non-compliance can be costly as fines can range from approximately MXN $200,000 to MXN $5.4 million. Unregistered businesses can also lose the right to deduct subcontracted service costs and claim VAT credits.
• Certification must be renewed every three years, within a strict three-month window before expiry; missing this window forces businesses to restart the full registration process.
• Foreign companies are not exempt. If workers are deployed in Mexico for a client, REPSE obligations may apply regardless of where the parent company is based.
• Working with a REPSE-certified partner like an EOR can help companies operate compliantly in Mexico without navigating the registration process independently.

Mexico offers a dynamic and growing market for businesses. It has emerged as a promising region for expansion for many reasons.

Of course, to fully experience the potential of this region, it’s crucial to understand and comply with a range of labour and tax regulations. Here’s where REPSE certification comes in—it is a critical regulatory framework that businesses must adhere to.

In recent years, Mexico has introduced several reforms to improve labour practices and curb the abuse of subcontracting. One of them is the REPSE certification. For companies operating in Mexico or organisations planning to scale in the country, understanding REPSE is essential to staying compliant and running smoothly.

What is REPSE certification?

REPSE (Registro de Prestadoras de Servicios Especializados u Obras Especializadas) is Mexico’s Register of Providers of Specialised Services or Works. Under Mexico’s 2021 labour reform, any company that subcontracts specialised services (like  security, IT support, construction, maintenance, and more) must hold REPSE certification. 

It was designed to eliminate the abuse of subcontracting arrangements that had long been used to deprive workers of benefits, pension contributions, and legal protections.

Through REPSE, subcontracted workers must receive the same protections, benefits, and labour standards as direct employees. The law creates shared accountability: both the provider and the contracting company are responsible for ensuring those standards are met. 

Operating without REPSE certification is illegal in specific sectors, and non-compliant companies risk significant fines and legal action. REPSE is essential for labour compliance for the following reasons:

1. Transparency: Ensures transparency in labour relations, preventing irregular subcontracting and tax evasion.
2. Worker protection: Guarantees labour rights for workers, including minimum wage, vacation time, and other benefits.
3. Combating informality: Reduces informal employment by promoting formalisation and job creation.

Who needs to register for REPSE?

Not every business in Mexico requires REPSE certification. The law primarily targets companies that provide specialised services or works on a contractual basis. 

Registration is required for any company or individual that deploys its own workers to a client’s premises to perform specialised tasks outside the client’s core business activity. Common examples include:

• IT support and technical services
• Security services
• Construction and civil engineering projects
• Maintenance works
• Other specialised industrial projects

Under the outsourcing law, the contracting company and their subcontractors share responsibility for REPSE compliance. 

Here’s an example: 

• If a multinational company hires a security firm to manage its premises, the security firm must be REPSE-certified. 
• If the security company fails to obtain certification, both parties could face penalties, demonstrating how the regulations create shared accountability throughout the contracting chain.

Foreign companies are not exempt either. If specialised services are performed in Mexico and workers are placed at a client’s disposal, REPSE obligations may apply regardless of where the parent company is based. So a foreign company without a Mexican legal entity may not be able to register directly, which is one of the reasons working with a certified partner is often the most practical route.

The case for a certified partner

For many businesses, the question is not whether to comply with REPSE but whether to handle that compliance capability internally or work with a partner who already has it down pat.

CXC holds REPSE certification in Mexico. This means we can act as a registered specialised services provider for companies that cannot, or do not want to, register independently. Combined with our Employer of Record (EOR) service, we provide a single compliant framework for businesses hiring or operating in Mexico without requiring a local entity or internal compliance function.

For companies already operating in Mexico, we can also support ongoing REPSE compliance: renewal planning, periodic reporting, supplier verification, and documentation management.

Working with a REPSE-certified partner removes the registration burden, the renewal risk, and the ongoing administrative overhead while keeping your operations fully within Mexican law. 

Meanwhile, the alternative is registering independently. While achievable, it requires clean compliance across three government bodies before you can even apply, a 6–8 week process minimum, and active management every year to avoid the gaps that trigger audits and penalties.

Key compliance challenges and pain points in REPSE certification

Navigating Mexico’s REPSE certification process can be complex, as organisations must meet various legal and administrative requirements. Below are the key obstacles businesses face when obtaining and maintaining this certification.

Complexity of compliance requirements

Navigating REPSE certification is not a simple task. It involves meeting several requirements across multiple areas, such as labour laws, tax obligations, and social security contributions. A company must comply with the Mexican Social Security Institute (IMSS) regulations, pay the correct taxes, and provide employee benefits like health insurance and pensions.

For instance, a business might need help with the complexity of correctly filing taxes while ensuring the social security system covers workers. If a company fails to provide proper documentation or misinterprets the legal requirements, it could be penalised, fined, taken to court, and more.

Joint liability risks for contracting companies

This is the risk that catches most businesses off guard. Under REPSE, the contracting company and their subcontractors share legal responsibility for labour compliance. If you hire a provider that is not REPSE-registered or whose registration lapses during the contract, then you are exposed.

To protect your business, you should:

• Verify a supplier’s REPSE registration number before signing any agreement
• Include the registration number in every contract connected to the service
• Monitor supplier status continuously, not just at the start of onboarding
• Require documentation of payroll records, tax filings, and social security contributions

Additional information: REPSE status can lapse, be cancelled, or fail renewal during an active contract period. Supplier verification needs to be part of your ongoing vendor management, not just your onboarding process.

Certification renewal challenges

Another challenge companies face is the renewal process for REPSE certification. While the initial registration process can be complicated, maintaining REPSE certification over time can be just as difficult due to the following factors:

• REPSE licences must be renewed every three years. The renewal process can only start within a specific three-month window before the licence expires. If missed, businesses will have to go through the registration process again.
• Providers must ensure all tax and social security obligations with IMSS, Mexican Revenue Service (SAT), and Instituto del Fondo Nacional de la Vivienda para los Trabajadores (INFONAVIT) are current. 
• The renewal process is done through an online portal, which only allows renewal during specific times. If a business does not renew in time, it could face serious consequences, such as the suspension of services or financial penalties. 
• The Ministry of Labor and Social Welfare (STPS) allots up to 20 working days to review renewal applications. If denied, the REPSE licence is immediately cancelled, disrupting operations.
• Mexico frequently makes changes to its laws, including the Federal Labour Law and REPSE guidelines. Staying informed about regulatory changes is crucial for compliance and successful renewal.

Financial penalties and tax implications

• Without current REPSE registration, businesses cannot deduct the costs of subcontracted services which can result in a much higher tax bill. In addition, companies that hire unregistered service providers cannot credit the VAT paid on these services, further escalating their costs.
• On top of that, businesses operating without REPSE registration may face fines ranging from 2,000 to 50,000 times the Unidad de Medida y Actualización (UMA), which translates to approximately $12,000 to $300,000. In more severe cases, fines can reach MXS $5,428,500 (around $310,000) for providing or receiving specialised services without proper registration.
• Non-compliance can also trigger scrutiny from tax authorities, leading to audits and investigations into the company’s financial practices. If discrepancies are found, businesses could face penalties and may be required to pay back improperly claimed tax deductions, severely impacting their financial stability.

Operational and reputational risks

Finally, businesses face significant operational and reputational risks if they do not comply with REPSE regulations. 

A company that is caught hiring non-registered service providers may lose clients who are concerned about ethical business practices. Clients and business partners may be less likely to trust a company that fails to meet legal standards, especially regarding labour rights.

Steps for obtaining and maintaining REPSE certification

Getting REPSE right means following the process in the right order. Before applying, companies must confirm whether they are in scope, clear any tax or social security issues, and prepare the correct documents. After approval, the focus shifts to contract reporting, supplier checks, renewal planning and keeping records ready for review.

Guidelines for initial REPSE registration

Initial REPSE registration is a multi-stage process with little room for error. 

Before applying, businesses must confirm whether REPSE applies, settle any tax or social security issues, prepare their documents, and submit the application through the official STPS platform. Missing documents or unresolved obligations with SAT, IMSS, or INFONAVIT can stop the process before approval.

Confirm whether your business requires REPSE registration

A business generally needs REPSE registration if it places its own workers at a client’s disposal to deliver specialised services or works outside the client’s core business activity. 

For example, a security firm providing guards to a manufacturing plant would usually fall within scope. A remote cloud services provider that does not place workers at the client’s site or under the client’s operational control may fall outside the scope.Individuals or companies must register when they provide specialised services or works and place their own workers at the disposal of the contracting party. It also states that applicants must prove they are current with tax and social security obligations and show the specialised nature of the services they want to register. Businesses should not assume they are exempt based on size alone. When the facts are unclear, it is safer to assess the structure before work begins.

Resolve all fiscal and social security obligations before applying

Before accessing the official STPS REPSE portal, the business should check that it is fully compliant with SAT, IMSS and INFONAVIT:

• This means having an active Registro Federal de Contribuyentes (RFC), or Mexican tax registration number; no unresolved tax debts; current Impuesto Sobre la Renta (ISR), or income tax, filings; current Impuesto al Valor Agregado (IVA), or value-added tax, filings; correct IMSS employer registration; up-to-date social security payments; and current INFONAVIT housing fund contributions.
• The STPS platform checks SAT, IMSS, and INFONAVIT compliance during the application process. If any institution returns a negative compliance result, the registration may be stopped, and the business will need to resolve the issue before applying again. This is why fiscal and social security checks should happen before submission, not during the review period.

Prepare your required documentation

STPS requires proof of the business’s legal identity, tax status, social security position, and the specialised services it wants to register. Before starting the application, prepare a complete document pack that includes:

• Active RFC with no outstanding SAT obligations.
• Valid e-firma.
• Official identification of the legal representative.
• Corporate incorporation deed and legal powers of attorney.
• Proof of tax address.
• IMSS employer registration and contribution evidence.
• INFONAVIT compliance documentation.
• A precise description of the specialised services to be registered.

The service description is especially important. It should be clear, specific, and aligned with the company’s corporate purpose or tax situation. Vague descriptions, broad service categories, or documents that do not match the registered business activity can increase the risk of rejection.

Submit your application through the STPS online portal

• REPSE applications are submitted through stps.gob.mx. Access requires a valid e-firma, and the required documents must be uploaded in the format requested by the portal. 
• Once the questionnaire and document upload are complete, the platform issues a reference number, or folio, that the applicant can use to track the application.
• The folio should be saved because it is used to check the procedure status. The STPS portal shows the date the application was received, the current stage of the process, and the expected response date.

Understand the STPS review period and what happens next

STPS has up to 20 business days to review a REPSE application after it is received through the platform.

• If the application is approved, the business receives its REPSE registration notice, a unique registration number, and a folio for each approved specialised activity. The registration number must then appear in every contract connected to the approved specialised service.
• If the application is rejected, common causes include missing documents, negative SAT, IMSS, or INFONAVIT compliance status, unclear service descriptions, or documents that do not support the specialised nature of the work. After rejection, the business must correct the issue and restart the process. This is why many companies choose to work with a REPSE-certified partner such as CXC, especially when they need compliant workforce support in Mexico without handling the registration process themselves.

Best practices for ongoing REPSE compliance

REPSE is not a one-time credential. After registration, businesses must do the following core practices to keep their licence valid and help reduce risk throughout the three-year registration period.

Meet your periodic REPSE reporting obligations

REPSE-registered providers must keep their labour, tax and social security records accurate throughout the licence period. 

This includes payroll records, Comprobante Fiscal Digital por Internet (CFDI) payroll receipts, or Mexico’s official electronic payroll invoices; SAT filings; IMSS contributions; INFONAVIT contributions; and contract information reported through the required platforms. For REPSE-related contract reporting, IMSS uses Informativa de Contratos de Servicios u Obras Especializados (ICSOE), while INFONAVIT uses Sistema de Información de Subcontratación (SISUB). Both are tied to four-month reporting periods.

These records must match the services being delivered, the workers assigned, and the approved REPSE activity. Errors in worker data, salary base contribution, or the salary amount used to calculate social security contributions, contract dates, or client details can create problems during audits or renewal. A dedicated compliance owner or local compliance partner can help keep the documentation accurate and ready for review.

Monitor your subcontractors’ REPSE status continuously

Contracting companies should verify a supplier’s REPSE status before signing any agreement for specialised services. This should be done through the REPSE public registry or supplier documentation, then supported by checks on the supplier’s RFC, tax status, and compliance evidence. The supplier’s REPSE registration number and approved activity folio must be included in the contract connected to the service.

This check should not happen only once. REPSE status can lapse, be cancelled, or fail renewal during the contract period. If a supplier loses registration while continuing to provide specialised services, the contracting company can share legal and financial exposure. REPSE verification should therefore be part of vendor onboarding, contract review, and regular supplier monitoring.

Stay current with regulatory changes to REPSE guidelines

Mexico’s labour and tax rules can change during a company’s REPSE licence period. The REPSE renewal process itself was clarified through a 2024 update published in the Diario Oficial de la Federación. Changes like this can affect documentation, renewal timing, platform procedures, and the way businesses manage their ongoing obligations.

Businesses should monitor official sources such as the STPS portal, the aforementioned Diario Oficial de la Federación, SAT, IMSS, and INFONAVIT. At a minimum, REPSE processes should be reviewed quarterly, and more often when renewal is approaching.

A compliance partner such as CXC can help monitor these changes and apply them to the right workforce structure.

Plan your REPSE renewal well in advance

REPSE licences must be renewed every three years. The renewal process can only be started during the three months before the registration expires. Once that window closes, the STPS platform automatically disables the renewal module, so the company may need to restart the full registration process instead of simply renewing its licence.

Businesses should start preparing at least four months before expiry. This gives enough time to check SAT, IMSS, and INFONAVIT compliance, update corporate documents, review approved service descriptions, and correct any issues before the renewal window opens. STPS has 20 business days to review registration and renewal applications. 

If the renewal is denied, the licence is cancelled, and the business may not be able to continue providing specialised services legally until the issue is resolved.

Companies registered in 2021, 2022, and 2023 are already within active renewal cycles under the STPS renewal calendar. Businesses should check their original registration month and compare it with the official renewal period. If internal teams do not have the time or local expertise to manage this process, CXC can support with document preparation, portal submission, and renewal tracking for Mexico operations.

Operating in Mexico without the compliance burden

Mexico’s REPSE framework exists for good reason: it protects workers and creates accountability throughout contracting chains. 

As important as this certification is, obtaining it can be tedious, time-consuming, and complex.  For companies that want to move quickly, reduce risk, or simply avoid building an internal Mexico compliance function, working with a certified partner is the most practical path. 

CXC holds REPSE certification and provides EOR services within a REPSE-certified framework, meaning your operations can be compliant from day one without the registration process, renewal management, or ongoing reporting burden sitting with your team.

If your business is providing or receiving specialised services in Mexico, your exposure starts now. Talk to CXC about how our REPSE certification and EOR framework can protect you from day one.

Contact our team today to discuss your Mexico operations.

FAQ section

Share to:

About CXC

---

At CXC, we want to help you grow your business with flexible, contingent talent. But we also understand that managing a contingent workforce can be complicated, costly and time-consuming. Through our MSP solution, we can help you to fulfil all of your contingent hiring needs, including temp employees, independent contractors and SOW workers. And if your needs change? No problem. Our flexible solution is designed to scale up and down to match our clients’ requirements.

Speak to our team

Share