OFAC's Sinaloa Cartel action adds 18 names and changes three entries. The governor link is only in the press release

The action was taken under Executive Order 14059, which covers illicit drugs, and Executive Order 13224, the terrorism authority. All 46 cartel entries now carry both tags, [SDGT] and [ILLICIT-DRUGS-EO14059], and the line "Secondary sanctions risk: section 1(b) of Executive Order 13224".

OFAC's update for the day mixes two press releases. Five people, five companies and three changed entries belong to an Iran procurement action announced the same day. Without them, the cartel action looks like this:

Twelve of the 18 new individuals and 17 of the 25 companies are in Tijuana. Every individual entry carries a CURP, the Mexican personal registration code, and 23 of the companies carry a Folio Mercantil number from the commercial register. Distribuidora y Comercializadora ATAF, in Ciudad Juarez, carries a company number instead, SAS2022499192. Proyecto Alerta Verde, a security firm in Hermosillo, has no registration number at all.

Alfonso Arzate Garcia ("Aquiles") and Rene Arzate Garcia ("La Rana") have been on the SDN List since 9 August 2023, and Jose Angel Rivera Zazueta since 30 January 2023. All three were listed under E.O. 14059 alone.

On 29 September OFAC re-designated all three under E.O. 13224. Their entries gained the [SDGT] tag, the secondary-sanctions line and "Linked To: SINALOA CARTEL". Rivera Zazueta's entry also gained an alias, "El Flaco", and a second place of birth, Estado de Mexico.

A process that only looks at new names lets this pass, because no name was added. The change matters most outside the United States. Treasury's press release says foreign banks that knowingly conduct or facilitate a significant transaction for someone designated under the relevant authority can lose, or face strict conditions on, their US correspondent accounts. Before 29 September those words did not appear on these three entries.

The new alias brings its own noise. "El Flaco" means "the skinny one". A search for Flaco now returns both Rivera Zazueta and Zambada Sicairos, whose alias is "Mayito Flaco", and they are different men.

Treasury puts Carlos Alberto Torres Torres and his brother "at the center" of what it calls a narco-corruption scheme in Mexicali. It describes Carlos Torres as the ex-husband of the governor of Baja California and a political operator allied with "El Ruso", who commands the cartel's Mexicali plaza. Treasury says Carlos Torres "reportedly" received monthly payments from Pedro Ariel Mendivil Garcia, the former director of public security in Mexicali, and that his brother, Luis Alfonso Torres Torres, collected the money and laundered it through companies and political campaigns. Five companies, among them The Woods Bar and Raes Restaurante, are linked to the brother. The State Department revoked Carlos Torres's US visa in May 2025.

The governor is not designated. Treasury does not name her and accuses her of nothing.

This is where a PEP programme and a sanctions list part ways. EU law defines a politically exposed person's family as the spouse or an equivalent partner, children and their spouses, and parents. That is Article 3(10) of Directive (EU) 2015/849, the text in force today. Regulation (EU) 2024/1624, which takes over the definitions on 10 July 2027, brings in heads of regional and local authorities with at least 50,000 inhabitants, and the equivalent posts in other countries. It leaves the family list nearly untouched, adding siblings only for heads of state, heads of government, ministers and deputy or assistant ministers. A former spouse is in neither text.

The two former officials in the action fit the definition no better. Mendivil was Mexicali's director of public security; Rafael Buenrostro Martin was a customs official in Chihuahua and, in Treasury's words, "a legislative advisor to the Baja California state government". Both EU texts exclude "middle-ranking or more junior officials" from prominent public functions. On the EU definitions alone, we read none of the four men as a PEP or a PEP's family member. A firm's own policy can go wider.

None of that makes them low-risk; it means the PEP flag was never going to be the control that caught them. Until 29 September none of the four was on the SDN List, and whatever a firm knew about them came from somewhere else. Now the list says "Linked To: SINALOA CARTEL". The relationship to the governor appears in the press release and nowhere in the entry.

Jeronimo Javier Vera Ayala and Jorge Mario Vera Ayala were both born on 27 April 1985 in Baja California and both live in Tijuana. Their CURPs are VEAJ850427HBCRYR16 and VEAJ850427HBCRYR08. The first 16 characters are identical; only the last two differ.

Treasury does not say whether the two men are related. It gives them different roles: Jeronimo is a business partner of Jesus Gonzalez Lomeli, a cartel money launderer OFAC designated on 18 September 2025; Jorge is "a central figure and liaison for all cartel activity in Tijuana". Four companies are linked to Jeronimo, none to Jorge.

A rule that matches on surname and date of birth treats them as one person. So does a match on the first 16 characters of the CURP. Both are listed, so the outcome of a hit is the same. The record is not: a file that says "Vera Ayala, DOB 1985-04-27" cannot show which of two blocked people you dealt with.

There are more pairs. Francisco Javier and Jorge Luis Mendoza Uriarte are brothers, Treasury says. Marco Antonio Moreno Gomez Santelices and Carlos Villela Gomez Santelices share their second surname, Gomez Santelices; Treasury describes both as associates of Gonzalez Lomeli and does not say they are related to each other. Moreno alone accounts for ten of the 25 companies, among them a concert promoter and two firms with Private Equity in their names.

Both exchange houses are "Centro Cambiario" in their legal names. Only one is a "Casa de Cambio" anywhere on the list: Galerias Centro Cambiario, S.A. de C.V., in Tijuana, listed with the alias MAGIC CASA DE CAMBIO. A trade name is what tends to appear on a receipt or in a wire reference; the register holds the legal name.

Treasury says Ilia Elizabeth Felix Rivera uses the business to collect bulk cash from complicit exchanges in southern California, run mirror transactions and move the money back to Mexico. Its previous owner, her former husband, was murdered in Tijuana in October 2023 on the orders of Pedro Humberto Martinez Rodriguez, "Gordo Flubber", her partner according to Treasury and designated in the same action.

The second, Mia Centro Cambiario in Mexicali, is Rivera Zazueta's, Treasury says, and has no alias.

1. Copy names from the list, not from the press release. Treasury's release spells one security company "Videovigilancia Colabirativa, S.A.P.I."; the SDN entry reads VIDEOVIGILANCIA COLABORATIVA, S.A.P.I. DE C.V.
2. Re-screen against the changed entries, not only the new ones. Pull the Arzate Garcia and Rivera Zazueta entries from any case closed before 29 September and note the new tag and alias.
3. Match on the CURP and the Folio Mercantil where you hold them. They separate the two Vera Ayalas and identify a company whatever its name.
4. Search your payment data for the trade name. Senders and payees may record "Magic Casa de Cambio", not the legal name.
5. Check ownership around Moreno. Ten companies linked to him are listed. Under OFAC's 50 percent rule, any other company he owns half or more of is blocked too, whether or not OFAC ever prints it.
6. Store the relationship evidence separately. For Carlos Torres, the governor link lives in the press release; keep it with the case, because the SDN entry will never show it.

Money transmitters on the border are closest to this, then any EU or UK bank, payment firm or exchange business with a Mexican corridor. So is anyone buying fuel, private security or entertainment services in Baja California or Sonora; eight of the listed companies sell exactly that.

ScreenVeritAI stores every check as a point-in-time snapshot that names the list entry a match came from, so a decision made against the Arzate entries before 29 September can be told apart from one made after. PEP screening is a separate check, because an SDN entry says nothing about who a man used to be married to.

This reads what OFAC and Treasury published on 29 September 2026 and two EU texts. The designations are Treasury's allegations; we add none.

These are US measures; EU and UK listings are separate and we have not counted them. The counts here are counts of list entries. We do not name the governor because Treasury does not.