Mexico Social Security for Contractors: IMSS Obligations
Mexico's social security framework — administered by the Instituto Mexicano del Seguro Social (IMSS) — creates significant compliance obligations for companies engaging Mexican workers. For independent contractors, the social security picture is more nuanced than for employees, but it is far from simple: Mexican law creates employer-side IMSS contribution obligations in certain contractor arrangements that most foreign startups do not anticipate.
Understanding IMSS obligations for Mexican contractors is essential for startups engaging Mexican technical talent and for investors conducting due diligence on Mexican portfolio companies. Unreported IMSS obligations can represent substantial retroactive liabilities — contribution arrears, surcharges (recargos), and penalties — that affect company valuations and deal structures.
The IMSS Framework for Employment
Mexico's Ley del Seguro Social (LSS) requires employers to register all employees with IMSS and make monthly contributions covering: medical insurance (enfermedad y maternidad), work risk insurance (riesgos de trabajo), disability and life insurance (invalidez y vida), retirement and old age (retiro, cesantía y vejez), and childcare (guarderías y prestaciones sociales). Total employer IMSS contributions typically range from 25-35% of the employee's monthly salary, depending on risk classification and salary level.
For genuine independent contractors — individuals operating through their own legal entities (PFs con actividad empresarial or SCs) with multiple clients and genuine economic independence — IMSS obligations generally do not apply. The contractor is responsible for their own social security coverage, and the engaging company has no contribution obligation.
However, the IMSS applies economic reality analysis to contractor arrangements. An inspector from the IMSS's Subdirección General de Inspección Federal del Trabajo can review contractor arrangements and, if the relationship exhibits employment characteristics, determine that IMSS contributions are owed retroactively. This assessment can be triggered by a contractor complaint, a random inspection, or a sector-wide IMSS enforcement campaign.
The Subcontratación Reform (2021)
Mexico's Reforma en Materia de Subcontratación, effective April 2021, fundamentally restructured the legal framework for contractor and outsourcing arrangements. The reform amended the LFT, LSS, and Infonavit Law to prohibit the traditional subcontratación de personal model (where a staffing company provided workers to client companies) and replace it with a new regulated framework.
Under the reformed framework, companies may only engage service providers for specialized services (servicios especializados) that are not part of the engaging company's core corporate purpose. Software development services are typically considered specialized and therefore eligible under the reform. However, the engaging company must: (1) verify that the service provider (contractor or staffing company) is registered in the REPSE (Registro de Prestadoras de Servicios Especializados u Obras Especializadas); (2) obtain a copy of the service provider's IMSS compliance certificate quarterly; and (3) report the service contract to IMSS within 30 days of execution.
Individual vs. Entity Contractors
The IMSS analysis differs significantly depending on whether the contractor is an individual (Persona Física) or a legal entity (Persona Moral).
For individual contractor engagements, the IMSS applies the same economic reality test as the labor authority: if the relationship exhibits employment characteristics (subordination, exclusivity, fixed hours), IMSS will assess contributions as if the relationship were employment. The individual's IMSS registration as a Persona Física con actividad empresarial does not protect against this assessment if the substance of the relationship is employment.
For entity contractors (Mexican SAs, SAPIs, SCs, or similar), the IMSS analysis focuses on whether the entity is a genuine business with multiple clients, its own employees, and real commercial operations. A shell entity created solely to provide services to one company — often called a "PJ" contractor in Brazil's analogous context — does not provide meaningful IMSS protection.
Infonavit and Other Mandatory Contributions
In addition to IMSS, Mexican employers must make contributions to Infonavit (Instituto del Fondo Nacional de la Vivienda para los Trabajadores) — Mexico's housing fund — at 5% of the employee's monthly salary. Like IMSS, Infonavit contributions are triggered by employment relationships. In a contractor reclassification scenario, Infonavit arrears compound the IMSS liability.
The Sistema de Ahorro para el Retiro (SAR) — Mexico's individual retirement savings system — requires additional employer contributions of 2% of salary. SAR contributions are managed through AFORE (Administradoras de Fondos para el Retiro) accounts. Combined IMSS + Infonavit + SAR employer contributions typically total 30-40% of the worker's base salary.
Social Security Due Diligence for Investors
Investors conducting due diligence on Mexican startups with significant contractor workforces should request: (1) a list of all current contractor engagements and their duration; (2) evidence of REPSE registration for contractors providing specialized services; (3) IMSS compliance certificates for service providers; (4) an assessment of the misclassification risk profile of each contractor arrangement; and (5) the company's tax authority (SAT) filings showing contractor payment records.
Our Full IP Due Diligence package at $1,200 includes a contractor compliance review as part of the complete pre-Series A IP and legal package — covering IMSS/social security exposure alongside IP ownership gaps and open source compliance. For investors building LATAM portfolios, our VC Portfolio Scan at $499/company provides standardized coverage across portfolio companies.
Frequently Asked Questions
Must a foreign company register with IMSS to engage Mexican contractors?
A foreign company without a permanent establishment or legal entity in Mexico generally does not register directly with IMSS. The REPSE registration and quarterly IMSS certificate requirements fall on the Mexican contractor or service provider. However, if the foreign company is found to have a permanent establishment in Mexico, IMSS registration obligations may apply.
What is the REPSE and who needs to register?
The REPSE (Registro de Prestadoras de Servicios Especializados u Obras Especializadas) is administered by the Secretaría del Trabajo y Previsión Social (STPS). Any individual or entity providing specialized services to a Mexican company must be registered. Registration requires demonstrating that the services are specialized and filing compliance documentation with STPS.
How far back can IMSS assess retroactive contributions?
IMSS can assess retroactive contributions for up to 5 years under the Ley del Seguro Social's statute of limitations. For long-running contractor arrangements that are reclassified, the retroactive IMSS assessment — including contribution arrears, recargos (surcharges), and actualization adjustments — can be substantial.
Audit Your Mexico Social Security Compliance
Contractor Stack Review — $299. IMSS + REPSE + LFT classification analysis. 48-hour delivery.
Related Resources
LATAM Contractor Legal Stack Guide Mexico IP Assignment for Contractors Mexico Patent Law for SoftwareLATAM IP and Regulatory Resources
The following authoritative sources provide the legal and regulatory foundation for the topics covered in this guide. All LATAM jurisdictions are signatories to the WIPO treaties that form the international IP framework, and domestic laws implement TRIPS Agreement minimum standards.
- TRIPS Agreement — WIPO — The foundational international IP treaty binding all WTO member states, including Argentina, Brazil, Mexico, Colombia, Chile, and Peru.
- INPI Brazil — Brazil's National Institute of Industrial Property; administers software registration, patents, and trademarks under Lei 9.279/1996 and Lei 9.609/1998.
- INPI Argentina — Argentina's IP office; manages software registration under Ley 11.723 and trademark protection.
- Open Source Initiative License List — Authoritative catalog of OSI-approved open source licenses including GPL v2, GPL v3, AGPL v3, MIT, and Apache License 2.0.
- SPDX License List — Machine-readable license identifiers used in Software Bill of Materials (SBOM) generation and CI/CD compliance tooling.
- IMPI Mexico — Instituto Mexicano de la Propiedad Industrial; administers patents and trademarks under the LFPPI.
For startups operating across LATAM, compliance with LGPD (Brazil), LPDP (Argentina — Ley 25.326), LFPDPPP (Mexico), and the TRIPS Agreement framework is not optional. Each framework creates distinct obligations that require jurisdiction-specific legal review. Our fixed-price audit packages provide this review with 48-hour delivery, so your team can move quickly without sacrificing legal certainty.
Practical IMSS Compliance for Mexican Contractor Engagements
Implementing compliant Mexican contractor arrangements under the post-reforma subcontratación framework requires a multi-step process that combines STPS registration verification, IMSS compliance monitoring, and ongoing documentation management. The practical steps for US and EU startups engaging Mexican contractors are as follows.
Before engaging any Mexican contractor or service provider, verify their REPSE registration status through the STPS portal. A contractor providing specialized services who is not REPSE-registered creates regulatory risk for the engaging company — the subcontratación reform's reporting requirements cannot be satisfied without a REPSE-registered counterparty. Request a current REPSE certificate (updated annually) before signing the services agreement and as a condition of each payment.
Quarterly IMSS compliance certification is the ongoing obligation that catches many foreign startups by surprise. The subcontratación reform requires engaging companies to obtain quarterly IMSS compliance certificates from their service providers — confirming that the provider is current on IMSS contributions for the workers providing services. This quarterly cycle creates an administrative burden but provides genuine compliance assurance: a provider who is not paying IMSS contributions for their workers may be engaged in the kind of labor arbitrage that the reforma was designed to prevent.
The IP dimension of Mexican social security compliance is worth noting explicitly. A contractor who is compliant with REPSE registration and IMSS contribution obligations is operating as a genuine independent business — which strengthens the IP ownership characterization of works created under the engagement. A compliant PJ contractor (with REPSE registration, multiple clients, own employees, IMSS compliance for their workers) provides much stronger IP ownership documentation than an individual autónomo working informally. The LFDA's obra por encargo provisions and INDAUTOR registration system operate alongside this social security framework — a REPSE-registered contractor who delivers code under a properly structured services contract, with an IP assignment clause referencing the LFDA, provides the complete IP ownership documentation chain that IMPI-level enforcement and WIPO-level international protection require. Our Contractor Stack Review at $299 covers REPSE verification, IMSS compliance assessment, and IP assignment documentation for Mexican contractor engagements with 48-hour delivery.