Anexo 24 Apartado C Explained: SAT’s Real-Time Online Access Mandate for IMMEX

For nearly two decades, most Mexican IMMEX plants treated Anexo 24 as a monthly back-office batch process. Between the 5th and the 15th of each month, the trade compliance specialist would download SAT’s monthly Data Stage file, import last month’s pedimentos and ERP shipments into the Anexo 24 software, run the FIFO (PEPS) discharge engine, and generate the .txt file for Anexo 30/31 (SCCCyG). If an auditor wanted to inspect the Anexo 24 ledger, SAT had to issue a formal audit notice and wait for the company to export reports.

With the enforcement of the reformed Apartado C (Section C) of Anexo 24 of the General Foreign Trade Rules (RGCE), that monthly batch model is no longer compliant for companies holding IVA/IEPS Certification (Rubros A, AA, AAA) or Authorized Economic Operator (OEA) status.

Under Apartado C of Anexo 24, certified companies must provide AGACE (Administración General de Auditoría de Comercio Exterior) with permanent, 24/7 remote online access (via a dedicated URL, username, and password) to their Anexo 24 inventory system, and must ensure that the system reflects customs and inventory operations within a maximum of 48 hours.

1. The Structure of Anexo 24: How Apartado A, B, and C Fit Together

To understand what SAT auditors can see when they log into your system remotely, it is important to distinguish the three sections (Apartados) of Anexo 24:

2. The Two Core Mandates of Apartado C

Mandate 1: The 48-Hour Electronic Update SLA

Under Apartado C of Anexo 24, the automated inventory control system must receive information electronically from the company’s corporate accounting/ERP system, and the remaining customs and discharge records must be updated within a period not exceeding 48 hours after the completion of the customs operation.

What this kills in practice:

• No more waiting until next month’s Data Stage: You cannot wait until the 5th of the following month to load pedimentos that crossed the border three weeks ago. Your customs brokers must transmit automated daily SAAI .M validation files, XML COVE files, and PDF pedimentos (via SFTP, API, or automated web service) into your Anexo 24 staging pipeline on the day of crossing (D+0 or D+1).
• No more manual quarterly BOM updates: When engineering releases a new finished part number or modifies a Bill of Materials (BOM) in SAP, Oracle, NetSuite, or Plex, that BOM and its UMC-to-UMT conversion factor must sync into Anexo 24 before the export pedimento (RT) is modulated, otherwise the 48-hour FIFO run will trigger an immediate negative balance or unmatched part error visible to SAT online.

Mandate 2: Permanent 24/7 Remote Read-Only Access for SAT

The company must file a formal instrument before AGACE providing:

1. A dedicated, stable HTTPS URL reachable by SAT auditors without requiring proprietary client-side VPN installations that block standard SAT government network connections.
2. A dedicated read-only auditor username and password (with explicit confirmation that password expiration policies will not lock out SAT without prior formal notice of credential updates).
3. A step-by-step User & Query Manual showing the auditor how to filter and export any of the Apartado A Catalogs, Customs Entries/Exits, and FIFO Balance Reports by date range, pedimento number, or part number.

3. IT Architecture: How to Comply Without Exposing Your Global ERP to SAT

When US Chief Information Security Officers (CISOs) and IT Directors first hear that “Mexico’s tax authority demands online login credentials to our inventory system,” their immediate concern is cybersecurity and corporate data privacy.

You must never give SAT login access to your global ERP (SAP, Oracle, Microsoft Dynamics, QAD, or NetSuite). Instead, best-practice US-Mexico IT architecture uses a decoupled 3-tier synchronization pipeline:

[Tier 1: Global ERP & Customs Brokers]
  ├── ERP (SAP/Oracle): Daily Material Master, BOMs, Receipts, Shipments, Scrap
  └── Customs Brokers: Daily SAAI .M files, COVE XMLs, Pedimentos (IN/AF/RT/V1/F4)
          │
          ▼  (Automated 24h ETL / Pre-Validation Staging Gate)
[Tier 2: Internal Anexo 24 Compliance Engine]
  ├── Validates UMC-to-UMT conversion factors & BOM completeness
  ├── Matches ERP receipts against Pedimento Table 551 lines
  └── Executes daily/48h FIFO (PEPS) inventory discharge calculations
          │
          ▼  (Published Read-Only Mirror)
[Tier 3: Isolated Anexo 24 Apartado C Web Portal (SAT Access Layer)]
  └── Exposes ONLY the statutory Apartado A Catalogs, Pedimentos & FIFO Reports
      (Zero access to corporate financials, US customer pricing, payroll, or global plants)

Why the “Staging Gate” in Tier 2 Is Essential

If you pipe raw, unvalidated ERP transactions and raw broker pedimentos straight into the live Apartado C portal every 24 hours without an automated validation gate, every typo made by a warehouse clerk or customs broker, such as a missing BOM, a wrong part number, or a Kg vs. Piece UMT mismatch, will immediately generate red flags (negative inventory or over-discharges) on the live screen that SAT auditors can inspect at any moment.

Your automated daily job (T+24h) must run a Pre-Load Validation Check:

• Does every part number on today’s IN pedimento exist in the Material Catalog with a valid 8-digit tariff fraction and UMT conversion factor?
• Does every finished good on today’s RT export pedimento have an active, non-zero BOM in Anexo 24?
• Is there sufficient open FIFO (IN) inventory balance to cover today’s RT export without generating a negative balance?

4. What SAT Auditors Look For When They Log Into Your Apartado C Portal

When an AGACE auditor logs into a company’s Apartado C portal for a desk review (revisión de gabinete or certification monitoring check), they test five specific screens in under 15 minutes:

5. Action Checklist for US IT, ERP, and Trade Compliance Teams

1. Test Your Apartado C Login From an External Network Monthly: Have a team member outside your corporate firewall log into the exact URL, username, and password on file with AGACE on the 1st of every month. Confirm that SSL certificates are valid, the password has not auto-expired, and reports render without timeout errors.
2. Switch Broker Feeds from Monthly to Daily (D+1): Require all Mexican customs brokers to push validated .M files and COVE XMLs automatically to your SFTP/API endpoint every night at 11:00 PM CST for all pedimentos paid that day.
3. Automate Daily ERP-to-Anexo 24 Interfaces: Replace manual Excel CSV uploads with scheduled daily jobs that extract ERP material master additions, engineering BOM revisions, goods receipts, and export shipments every 24 hours.
4. Update AGACE Immediately If You Change Software Vendors or URLs: If you migrate Anexo 24 software providers or change your domain/IP address, file an updated notice with AGACE immediately so an auditor attempting to log in does not record a “System Unavailable / Non-Compliant” finding.