2025 Edition of the Code of Principles and Best Practices for Corporate Governance.

On February 11, 2025, the Business Coordinating Council (Consejo Coordinador Empresarial, CCE) presented a new version of the Code of Principles and Best Practices for Corporate Governance (Código de Principios y Mejores Prácticas de Gobierno Corporativo, CPMPGC) with greater attention to human rights, sustainability, and the social dimension of companies.

The implementation of the principles and practices of the CPMPGC helps all types of legal entities, regardless of their size and nature, to become more competitive and reliable, thus increasing the access to more sources of financing. Legal compliance is also promoted, which, in addition to fostering a culture of integrity and avoiding fines, helps maintain a solid reputation. For family companies, the incorporation of these principles and practices allows stable succession processes and for them to transcend over time.

In this edition, certain practices were updated, others were strengthened, such as risk and compliance functions, and some new functions were incorporated, such as sustainability and a chapter dedicated to family companies.

Regarding the functions of the Risk and Compliance Committee, the catalog of activities under its charge and the risks to be evaluated, such as:

1. Social and environmental impacts;
2. Fraud and corruption prevention;
3. Psychosocial and organizational environment risk factors; and
4. In general, ethical or integrity violations, were expanded.

Additionally, this Committee must be aware of the legal provisions applicable to the company and ensure that processes are implemented for compliance, including the development and implementation of business compliance plans or programs, presenting the Code of Ethics for approval before the Board of Directors, ensuring the proper functioning of the whistleblower information system, and protecting whistleblowers, among other responsibilities.

A specific practice on personal data protection and management was added, specifically recommending the implementation of a Personal Data Security Management System to ensure the protection of this type of information from damage, loss, alteration, destruction, or unauthorized use, access, or processing. The implementation of a Personal Data Security Management System involves, among other actions:

1. Developing personal data management policies;
2. Establishing functions and obligations for those who handle personal data;
3. Creating a personal data inventory;
4. Conducting a risk analysis;
5. Identifying security measures and gap analysis;
6. Performing audits to verify compliance levels; and
7. Training company employees on the subject.

Among the new features of the CPMPGC is the addition of two new chapters related to the sustainability function and family companies. Regarding the sustainability function, the aim is for the company to identify, evaluate, and manage risks related to sustainability and analyze the social and environmental impacts that may arise from its activities.

The chapter on family companies recognizes their importance in the Mexican business ecosystem and seeks for the CPMPGC to serve as a guide for these types of companies to have mechanisms that allow them to transcend over time. It is recommended that family companies have a protocol that establishes:

1. Rules of interaction between the family and the company;
2. How to represent the interests of different family groups;
3. Asset organization;
4. Conflict resolution;
5. The use of company assets;
6. Business succession; and
7. Family employment within the company, among other guidelines.

At Cannizzo, Ortiz y Asociados, S.C. we can advise implementing the principles and practices outlined in the CPMPGC to strengthen the sustainability, competitiveness, and compliance of companies. Our team of experts is available to provide personalized advice and support in adopting these practices.

For more information, please contact Karen Ortega at [email protected].

Cordiali saluti,

Cannizzo