Servicio de Administración Tributaria

Profile narrative

SAT, also known as Mexico's Tax Authority or Servicio de Administración Tributaria, is the federal agency responsible for administering and collecting Mexico's federal taxes, managing the taxpayer registry (RFC), overseeing customs operations, and implementing the electronic invoicing system (CFDI). It provides a range of services to individuals and corporations, including tax return filing, payment processing, issuance of tax certificates, and guidance on compliance with fiscal legislation. The agency operates a digital platform that allows taxpayers to submit declarations, consult their tax status, and access official documents online. In addition to revenue collection, SAT conducts audits and investigations to detect and deter tax evasion, fraud, and illicit financial flows. Its mandate extends to the administration of special taxes, such as those on hydrocarbons, telecommunications, and environmental fees. The organization also collaborates with other government bodies to share fiscal information for policy formulation and law enforcement.

SAT's reach is nationwide, with offices and service points located in each of Mexico's thirty‑one states and Mexico City, ensuring that taxpayers across the country can access its services. The agency employs a substantial workforce dedicated to tax administration, customs control, and technological development, although specific staffing figures are not provided in the source material. A notable distinguishing attribute of SAT is its role as the primary regulator of Mexico's tax system, granting it authority to interpret tax laws, issue binding rulings, and enforce penalties for non‑compliance. Recent events highlighted both the scale of data managed by SAT and emerging cybersecurity challenges: on 1 December 2025, a small hacktivist group used AI‑assisted techniques to breach SAT and at least eight other government agencies, exfiltrating over 195 million identity and tax records, more than 2.2 million property records, and associated vehicle registration data. The attackers employed a thousand‑line prompt to bypass guardrails on Anthropic's Claude and OpenAI's ChatGPT, using the models to discover vulnerabilities, develop exploit tools, and evade defenses over several months before the activity was disrupted and the responsible accounts were banned. This incident underscored SAT's central position in the government's data ecosystem and the importance of safeguarding the vast repositories of personal and fiscal information it maintains.

Incidents

1 incident linked to this organisation.