Since the adversarial criminal system came into force, criminal liability in Mexico also reaches legal persons. A company can be charged for acts committed in its name, on its behalf or for its benefit, by those acting within its sphere of organisation.
The practical consequence is that the company stops being a third party to the proceedings. It has its own procedural position, distinct from that of its officers, and it can face its own sanctions: fines, suspension of activities, closure, prohibition on carrying out certain operations, and even dissolution.
What usually decides the outcome does not happen during the proceedings, but before. The law weighs whether the company had control bodies adequate to prevent the act. That assessment is made on documents and on conduct: which risks it had identified, which controls it had put in place, and whether those controls actually operated.
Which is why compliance has stopped being a reputational question and become a defence question. A programme built after the act does not help with that act; it helps with the next one. The one that helps with this one is the one that already existed, with earlier dates and a trace of having operated.
For management there is a second consequence, less often discussed: the liability of the legal person does not replace that of the individual. They can coexist. A well-defended company and an officer with no defence of their own is a frequent and avoidable situation.