Navigating Permits and Licenses in Mexico

If you operate industrial facilities in Mexico, you already know: regulatory compliance is not a task. It is an ecosystem of obligations that crosses three levels of government, dozens of regulatory agencies and thousands of municipal jurisdictions — each with its own rules, its own timelines and its own consequences when you get it wrong.

There is no unified compliance database in Mexico. There is no single portal. There is no master list of "everything you need." What applies to your manufacturing plant in Monterrey may not apply to your warehouse in Querétaro. What your municipality requires this year may change next quarter. And the penalty for not renewing a single permit can range from a fine to the complete shutdown of your operation.

This guide maps the regulatory landscape that every industrial operation in Mexico must navigate. It covers federal agencies, state variation, municipal complexity and the practical implications for companies managing multiple sites. Whether you operate one building or one hundred, this is the terrain.

Federal, State and Municipal: Three Systems, One Company

Mexico’s regulatory structure is not centralized. Unlike countries where a single agency oversees occupational safety or environmental compliance, Mexico distributes authority across three levels of government. Each level has its own agencies, its own permit types, its own inspection cadence and its own enforcement mechanisms.

For a company operating multiple sites in Mexico, this means managing compliance relationships with potentially dozens of different government entities simultaneously. Understanding which authority governs which obligation is the first step toward control.

Federal Authorities

Federal agencies set the foundation of industrial compliance in Mexico. They are the authorities with the broadest jurisdiction, the highest fines and the most complex permitting processes.

STPS — Secretaría del Trabajo y Previsión Social

The main occupational safety authority. STPS enforces 41 permanent NOMs covering fire prevention, machinery safety, hazardous substances, work at height, electrical maintenance, ergonomics, psychosocial risk, and personal protective equipment. STPS inspectors can arrive without prior notice. Fines can reach up to 5,000 UMAs ($566,300 MXN) per violation. Plants with more than 100 employees must have dedicated EHS personnel. Every employer must maintain a Safety and Hygiene Commission.

SEMARNAT — Secretaría de Medio Ambiente y Recursos Naturales

The federal environmental authority. SEMARNAT manages Environmental Impact Authorizations (MIA), atmospheric emissions licenses (LAU), registration of hazardous waste generators (NOM-052), the annual report of the Annual Operating Certificate (COA), wastewater discharge permits, and noise monitoring requirements. PROFEPA is the enforcement arm and can conduct unannounced inspections, issue fines, and shut down facilities for environmental violations.

COFEPRIS — Comisión Federal para la Protección contra Riesgos Sanitarios

The health products and food safety regulator. Mandatory for any operation involving food, beverages, pharmaceuticals, medical devices, cosmetics, supplements, or health services. COFEPRIS issues sanitary licenses, enforces Good Manufacturing Practices (GMP), conducts facility inspections, and can immediately shut down operations for violations. The operating notice is mandatory for many commercial establishments. GMP guidelines were updated in March 2025 to align with PIC/S and USMCA standards.

ASEA — Agencia de Seguridad, Energía y Ambiente

The energy sector safety regulator. ASEA oversees operations involving hydrocarbons: gas stations, LP gas distribution, fuel terminals, pipelines, and industrial fuel infrastructure. The SASISOPA framework requires a 17-element safety management system. CRE and CNH issue operating permits. Emergency NOMs (NOM-EM-006, NOM-EM-007) govern LP gas fleet compliance. Pipeline integrity standards (NOM-019, NOM-020) become mandatory in early 2026.

CONAGUA — Comisión Nacional del Agua

Manages water concession titles, extraction permits, and wastewater discharge standards for federal water bodies. Industrial operations that extract groundwater or discharge into federal waterways must obtain and maintain CONAGUA permits with periodic monitoring and reporting.

State Authorities

Each of Mexico's 32 states has its own regulatory layer. State governments manage environmental programs, civil protection requirements, and in many cases, state-level labor protections that add to federal requirements.

The practical implication: what counts as compliance in Nuevo León may require additional steps in Guanajuato. A company operating in five states must understand five distinct sets of state rules. State environmental agencies can issue their own atmospheric emissions permits for operations under state jurisdiction. Civil protection programs are typically managed at the state level, with each state defining its own risk classifications, drill requirements, and brigade standards.

State variation is one of the most common blind spots in multi-site compliance. Companies that build their compliance programs only around federal requirements frequently discover gaps when a state inspector arrives with requirements they didn't know existed.

Municipal Authorities

Mexico has more than 2,400 municipalities, and each has its own operating license requirements, fee structures, renewal deadlines, and civil protection programs. Municipal compliance is the most granular and most variable layer of the system.

The operating license — the municipal operating permit — is required for practically every commercial establishment in Mexico. It seems simple: a permit that often costs less than $1,000 MXN and requires a visit to the municipality. But simplicity is deceiving. Each municipality sets its own requirements. Some require annual renewal; others issue multi-year licenses. Some tie the license to specific commercial activities; others require separate permits for each activity. Advertising permits, land use certificates, alcohol permits, construction permits, and civil protection programs — all are managed at the municipal level.

For a company operating 50 locations in 15 municipalities, the municipal layer alone can represent 200+ active permits, each with its own renewal date and its own set of local requirements. This is where compliance fragmentation becomes unmanageable without a system.

How the Numbers Multiply

The compliance burden is not additive — it's multiplicative. Each new site you operate doesn't just add permits; it adds a new combination of federal, state, and municipal requirements that can be completely different from those of your other locations.

Permit counts for a single manufacturing plant

A single manufacturing plant in Mexico can face 50 to 80 permit obligations and NOMs: 15 to 25 applicable STPS NOMs, 5 to 10 SEMARNAT environmental permits, 3 to 5 COFEPRIS requirements (if food or pharmaceutical), 1 civil protection program, 1 municipal operating license, plus state requirements. Each with its own renewal cycle, evidence standard, and inspection risk.

Permit counts at scale

A company with 5 plants in different states faces 300+ compliance items. A shelter company managing 20 client operations faces 400 to 600 permits under a single legal entity. A retail chain with 100 locations in 30 municipalities manages 800 to 1,200 active permits. At this scale, no spreadsheet holds up. No coordinator remembers everything. No archivist survives an inspection.

The common failure is not ignorance of the rules. It's the inability to track them all simultaneously across every site, every authority, and every renewal cycle. The permit that shuts you down is rarely the complex one. It's the simple municipal license that no one noticed had expired.

What Happens When Permits Expire

In Mexico, the consequences of non-compliance are not theoretical. They are operational, financial, and reputational.

Operation shutdown

STPS can shut down a facility for safety violations. PROFEPA can seal operations for environmental non-compliance. COFEPRIS can immediately close food or pharmaceutical operations. Even a municipal inspector can prevent a business from operating if the operating license has expired. Shutdown doesn't just cost the fine — it costs idle payroll, missed deliveries, contractual penalties, and damage to your operational reputation.

Economic sanctions

STPS fines reach up to 5,000 UMAs per violation ($566,300 MXN). SEMARNAT environmental fines can be equally severe. COFEPRIS violations have their own sanction structure. Municipal fines are typically smaller but accumulate across locations. For a company with multiple violations across multiple sites, the total exposure to sanctions can reach millions of pesos.

Reputational damage

In an era of ESG reporting, supply chain audits, and social media, a compliance failure becomes public. For manufacturers supplying global OEMs, a PROFEPA seal on their facility can end supplier relationships. For shelter companies, a compliance failure under their IMMEX permit affects every client operation. For health facilities, a COFEPRIS shutdown erodes patient trust. The reputational cost often exceeds the economic sanction.

"With 150+ plants, the biggest risk isn't the fine — it's not seeing what's coming until it becomes an emergency. A $1,000 peso permit you forgot to renew can shut down the entire operation."

— José Luis — EHS Director, Multi-site Operations (150+ plants)

From Overview to Control

Understanding the regulatory landscape is the first step. The second is building a system that can track everything.

Companies that successfully manage compliance at scale in Mexico share common characteristics: they have a single source of truth for each permit, assign clear responsibilities for each renewal, project what's coming before it expires, and maintain audit-ready evidence that can be produced in minutes, not days.

This doesn't require perfection. It requires structure. A permit registry that knows what you have. A projection engine that tells you what's next. A workflow that assigns responsibilities. And an evidence repository ready when the inspector arrives.

That's what NAPSsoft EHS was built for. Not as a generic compliance tool adapted for Mexico, but as a platform designed from the ground up for the specific complexity of navigating permits and licenses in Mexico's three-tiered regulatory system.