Compliance · Anti-corruption · LFPDPPP
Corporate compliance in Mexico: the five rules a merch programme must clear before passing the ethics committee
A corporate merch programme can cross three regulatory zones most marketing teams overlook: the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP), the anti-corruption legislation that applies to companies listed on the stock exchange or with a parent in FCPA or UK Bribery Act jurisdictions, and the ethics code of the receptor that prohibits gifts above certain amounts or from certain vendors. Corp-Merch.MX works with clients that have full-time compliance officers and we understand that merch is not only a production and invoicing problem — it is a corporate-governance problem.
Rule one: personal data and LFPDPPP
When Corp-Merch.MX engraves a collaborator's name on a polo, a plaque or a thermos bottle, we are handling personal data. The Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) and its regulation require the responsible party (the client) and the processor (Corp-Merch.MX) to comply with the consent principle and the purpose principle.
Consent must be express when the data is used for purposes other than the labour relationship. If the client wants to hand over a polo with the collaborator's name as anniversary recognition, Corp-Merch.MX recommends that Human Resources obtain written consent with a clear explanation of the purpose: anniversary recognition, no commercial use or external publication. Corp-Merch.MX delivers a template privacy notice and consent form for the client to use with its collaborators.
Purpose must be specific and legitimate. Corp-Merch.MX uses the names delivered by the client exclusively to engrave the pieces of the order. Once the batch is delivered, Corp-Merch.MX destroys the personal-data files (Excel, CSV) and keeps only the fiscal and delivery information for the legal term (5 years for CFDI 4.0). Corp-Merch.MX delivers to the client, at the close of the order, a personal-data destruction certificate.
Personal-data transfers to third parties require express consent. Corp-Merch.MX does not transfer collaborator names to third parties without client consent. When Corp-Merch.MX subcontracts partial production to allied workshops, the names are delivered only for engraving and are returned or destroyed at the close of the batch. Corp-Merch.MX signs a confidentiality agreement with each allied workshop and keeps record of the accesses.
For clients that hand over merch to children, adolescents or vulnerable persons (interns, apprentices, collaborators' children at family events), Corp-Merch.MX applies the highest protection standard: parent or guardian consent, simplified privacy notice and delivery of the pieces in a sealed envelope to the titleholder. Corp-Merch.MX does not deliver children's merch without this documentation.
Rule two: anti-corruption and gifts to public officials
The Código Penal Federal and the Ley General del Sistema Nacional Anticorrupción criminalise bribery and illicit enrichment. For companies listed on the Mexican Stock Exchange (BMV) or on NYSE/Nasdaq, the anti-corruption legislation includes the US Foreign Corrupt Practices Act (FCPA) and, if the parent is in the United Kingdom, the UK Bribery Act. In both cases, the merch handed over to foreign public officials is subject to restrictions and registration.
Corp-Merch.MX does not produce merch that could be interpreted as a bribe. This includes high-unit-value pieces handed over to public officials without operational justification, pieces with high resale value (jewellery, electronics) and pieces handed over in commercial-pressure contexts (tenders, awards, permits). Corp-Merch.MX asks its client about the final recipient when the unit volume is high or the unit value exceeds a threshold.
For companies with ethics codes that prohibit gifts above a certain amount (frequent: USD $50, USD $100, or the equivalent amount in MXN), Corp-Merch.MX designs merch programmes that fit the limit. When the programme is for the client's own staff (collaborators, commercial team, retirees), the ethical limit does not apply and the merch can have higher unit value. When the programme is for external clients (buyers, distributors, officials), Corp-Merch.MX designs pieces with controlled unit value.
For financial-sector clients, Corp-Merch.MX knows the additional CNBV restrictions on gifts to clients and officials. Polos, caps and thermos bottles for banking or insurance events stay at low unit value and are documented with specific description to avoid regulator observations.
For health-sector clients, Corp-Merch.MX knows the CANIFARMA, AMIIF and CETIFARMA ethics codes that regulate the interaction between labs and healthcare professionals. Merch handed over at medical congresses such as Medical Expo stays within the permitted amounts and is documented for value-transfer purposes as the legislation requires.
Rule three: due diligence on the merch vendor
The compliance-mature client does not only self-control: it also due-diligences its vendors. Corp-Merch.MX delivers to its client the documentation the compliance area needs to onboard the vendor in the master file: articles of incorporation, Constancia de Situación Fiscal, positive 32-D opinion, legal representative ID, fiscal-address evidence, bank-account cover sheet with CLABE and signed ethics code.
Corp-Merch.MX also delivers information on its allied vendors: production workshops, carriers, design studios. This transparent supply chain lets the client due-diligence the entire programme and not only the direct vendor. Corp-Merch.MX signs confidentiality and anti-corruption compliance agreements with each allied vendor.
Corp-Merch.MX does not have contractual relationships with public officials, political parties or candidates (except for the commercial merch-production contracts that follow their own legislation). Corp-Merch.MX also does not have as clients companies sanctioned by CNBV, COFECE or UIF. Corp-Merch.MX verifies the UIF and OFAC lists before accepting new corporate clients.
For clients that require specific contractual clauses (FCPA, UK Bribery Act, LFPDPPP, client ethics code), Corp-Merch.MX accepts the inclusion of these clauses in the master agreement and in the individual purchase orders. Corp-Merch.MX also accepts compliance audits by the client or by an independent third party engaged by the client.
Rule four: intellectual property and brand use
Corp-Merch.MX respects the intellectual property of the brands it engraves. To use the client's logo, isotype or imagotype on polos, caps, thermos bottles and other merch, Corp-Merch.MX requires written authorisation from the brand titleholder. When the client is the titleholder, the signed purchase order is enough. When the client uses a third-party brand (typical case: tech-vendor brand on loyalty merch), Corp-Merch.MX asks for evidence of the usage licence.
Corp-Merch.MX does not reproduce registered trademarks of the client's competitors in the same merch programme. This applies to logos of technology providers, beverage brands on apparel for another brand's events, and pieces with copyright (character images, registered illustrations). Corp-Merch.MX consults the client when it detects risk of unauthorised use.
For programmes that include phrases, slogans or images created by the client, Corp-Merch.MX treats the material as confidential and does not reproduce it for other clients. Corp-Merch.MX's master agreement includes a confidentiality clause that protects designs, phrases, slogans and any creative material delivered by the client.
For programmes that use intellectual property of Corp-Merch.MX (template designs, base illustrations, generic phrases), Corp-Merch.MX licences the use to the client for the specific programme and retains ownership of the material. The client may use the produced material on its internal channels but may not resell it or licence the base design to third parties.
Rule five: audit and traceability of delivered merch
Modern corporate compliance requires traceability of every delivered piece. Corp-Merch.MX delivers to its client a per-order file with: signed purchase order, approved samples with client signature, photographic evidence of the produced batch, photographic evidence of the delivery, stamped CFDI 4.0, payment complement when applicable, and final report with quantities delivered per recipient.
For programmes with individual recipients (anniversary awards, recognitions, VIP events), Corp-Merch.MX delivers a recipient roster with full name, RFC when applicable for individual CFDI, delivery address, signed delivery date and photographic evidence. This roster serves as documentary support for internal or external client audit.
For programmes with mass recipients (trade-show events, electoral campaigns, product launches), Corp-Merch.MX delivers a delivery certificate with total quantity, piece description, location and date, signed by the client representative who receives. The certificate is attached to the programme's global CFDI.
For clients that require serial-number traceability (programmes with numbered pieces for contest, raffle or loyalty), Corp-Merch.MX assigns a number range to the produced batch and delivers the assigned number roster with the final recipient. This modality is common in commercial-incentive programmes and in end-customer raffles.
Let's review your compliance policy
If your company has a formal compliance area or ethics committee that reviews merch programmes, let's talk. We need the legal name, RFC, ethics code or gifting policy, list of allied vendors or vendors requiring due diligence, and brief of the 2026 programme. We will quote with contractual clauses compatible with your internal policy and compliance documentation ready to present to your committee.
Corp-Merch.MX is a corporate merch workshop based in Mexico City. We operate independently and are not a partner, official distributor or representative of the companies, regulatory authorities nor industry associations mentioned on this page. References to FCPA, UK Bribery Act, LFPDPPP, CNBV, COFECE, UIF, OFAC, CANIFARMA, AMIIF and CETIFARMA are made solely for descriptive purposes to identify the regulatory context of merch in Mexico. The compliance information in this guide is operational and general in nature — for your specific case consult your internal legal department, your compliance officer and your tax counsel.