PROFECO Enforcement: How DNC Complaints Become Fines

DNC LATAM · Compliance guides

PROFECO enforcement of Mexico’s REPEP registry runs on consumer complaints, not scheduled inspections: a consumer reports a call or message they say shouldn’t have happened, PROFECO checks whether the number was on the current REPEP release at the time and whether a prior opt-out request was honored, and each contact that fails that check can be sanctioned on its own under federal consumer-protection rules. There’s no audit calendar that catches an un-scrubbed campaign before the fact — the trigger is always a specific consumer reporting a specific call or message.

That complaint-driven model changes what “we scrub our lists” actually protects a company from. It isn’t protection against being caught during a periodic review; it’s protection against not being able to answer one consumer’s complaint about one specific contact, whenever that complaint happens to land.

Where a complaint starts

A consumer who registered a number with the Registro Público para Evitar Publicidad (REPEP), or who told a company directly to stop calling, can file a complaint through PROFECO’s consumer channels. From the caller’s side, the first sign of a problem is rarely a general warning about “your program” — it’s one number, one contact, sometimes a specific date and script. Outbound teams that picture Mexican enforcement as something closer to a scheduled FTC-style sweep of the whole campaign are working from the wrong model, as covered in TCPA vs. Mexico and Argentina DNC rules — neither Mexico’s nor Argentina’s regulator works on a calendar.

What the review actually checks

Once a complaint is open, PROFECO’s review comes down to two questions — and the second one is where Mexico’s process diverges from Argentina’s:

  • Was the number on the applicable REPEP release at the time of the contact? REPEP is published zone by zone every 15 days, so “current” means the release that was actually in effect on the contact date — not whatever file the company happened to be holding. A campaign checked against last cycle’s file, or against a zone the company never purchased, doesn’t have an answer to this question.
  • Was a direct opt-out honored, independent of REPEP status? Mexico’s registry runs on an opt-out model rather than a consent-override one — see do you need consent to cold-call Mexico? for what that means day to day. A number can be entirely absent from REPEP and still be off-limits if the person already told the company directly to stop. Unlike Argentina’s framework, there’s no “documented prior consent beats the registry” defense to fall back on here — the two controls are separate and both have to hold.

A company that can produce a dated screening record naming the REPEP release or zone context used, plus the Scrub Result showing that number’s classification, has an answer to the first question. A company that also logged the specific date a consumer opted out directly has an answer to the second. A company that can only say “we generally check REPEP” has neither — see what a screening record actually needs to contain for the gap between a general claim and a specific record.

Why each call or message compounds the exposure

Mexico’s federal consumer-protection rules treat each call or message to a number that should have been suppressed as its own violation, not as one incident covering however many contacts a campaign made. That structure is also why geographic zone gaps are a bigger problem than they first look: REPEP access is sold zone by zone, and a company that bought Mexico City coverage but dials into Jalisco or Nuevo León on the same list isn’t making one mistake — every contact into an unpurchased zone is a separate exposure, repeating on every cycle until the gap is closed. Our telemarketing fine calculator prices exposure the same way: per contact, not per campaign, which is why a list-level “we’re mostly compliant” estimate understates what a zone gap or a stale cycle actually costs.

What foreign companies get wrong

The companies that end up exposed usually aren’t ignoring REPEP outright — they’re treating a REPEP purchase as a one-time setup step instead of a recurring, zone-specific obligation. Two failure modes show up repeatedly:

  1. Buying partial zone coverage and assuming it’s national. REPEP isn’t a single national file; it’s distributed zone by zone, and a company covering only its highest-volume metro areas has a permanent, recurring gap everywhere else, not a temporary one. Our guide to accessing Mexico’s official DNC data walks through what full coverage actually requires.
  2. Not logging direct opt-outs separately from the REPEP scrub. Because Mexico’s opt-out defense doesn’t route through the national registry at all, a company that only tracks REPEP matches has no record of the consumers who opted out directly — the exact gap a complaint is most likely to expose, since those consumers already told the company once.

Nearshore floors running a mixed Mexico, Argentina, and US book face a sharper version of this: each market’s registry, refresh cycle, and opt-out standard sit side by side on the same dialer, and “we’re compliant” as a company-wide claim doesn’t transfer between them. The DNC compliance checklist for nearshore call centers treats each market as its own standing requirement rather than one shared policy.

Limiting exposure before a complaint lands

The moment to be ready for a PROFECO complaint is before one exists, not after. Three things matter most:

  1. Full zone coverage, checked against the REPEP release that was current on the actual contact date — not a prior cycle’s file and not a subset of zones treated as if it were national.
  2. A direct opt-out log, tracked separately from the registry scrub, since Mexico’s model can make a number off-limits with no REPEP entry at all.
  3. A dated record tied to the specific contact and campaign, retrievable on request, rather than a general statement that the company runs a compliance process.

DNC LATAM handles the Mexico-specific part of this by maintaining REPEP access across zones and attaching a dated screening record to every check, so the record a complaint would ask for already exists at the moment the call or message goes out — rather than being something a team has to reconstruct after the fact. The same DNC scrubbing API covers Argentina and Colombia on the same account, for teams running a mixed-country book.