Handwritten and typed sheets recovered in Tapalpa are being treated as an internal CJNG payroll. The entries focus on weekly amounts, nicknames, fuel, rent, and payments labeled for security forces. Together, they outline how a local cell may budget for surveillance and armed protection. Authorities say the material is still under analysis, including checks on authorship and authenticity. But the figures raise two questions for investigators: who was paid, and what records can confirm it.
A cabin search in Tapalpa
Authorities say the documents were found at Cabañas La Loma in Tapalpa, Jalisco, after a security operation. The location has been linked in official files to CJNG figures, including Nemesio Oseguera Cervantes, known as El Mencho. Accounts based on the seized material describe a mix of handwritten notes and computer‑printed tables. The pages read like bookkeeping, with dates, roles, nicknames, and amounts in pesos and dollars. At least one sheet is dated December 2025, suggesting recent record‑keeping. Investigators are treating the papers as a working payroll and expense log, but authorship is still being evaluated. To do that, authorities typically compare the entries with seized phones, computers, and transaction records. They also look for consistent handwriting, recurring aliases, and spending patterns that match known activity. In court, that kind of material requires a clear chain of custody and supporting evidence. For readers, the key point is scope. The sheets appear to describe staffing and payments around Tapalpa and nearby towns, not a full national ledger.
What the narconómina shows
One section describes weekly pay for halcones (lookouts) and armed operatives described as pistoleros. Lookouts are typically used for surveillance, early warnings, and route monitoring. Gunmen provide protection and enforcement for a local group. In the Tapalpa entries, about 30 to 32 lookouts are listed. Pay is set at roughly 2,500 to 3,000 pesos per week. The same pages list about 26 gunmen, with pay set at 4,000 pesos per week. A commander role is listed with pay in the 6,000 to 7,000 pesos range per week. These figures are presented as internal allocations, not formal salaries. The documents do not explain benefits, bonuses, or deductions. The records use nicknames for some roles, which complicates verification. They also do not clarify whether the payment was made in cash, by transfer, or through intermediaries. Rates can vary by region, risk level, and time period. Even so, the ledger format treats surveillance and armed coverage as regular operating costs.
The papers described as a narconómina go beyond payroll. They include line items for fuel, meeting space rent, mechanical repairs, food, and other daily expenses. Some entries refer to “hackers,” which authorities interpret as technical support for communications or monitoring. Other sections track income tied to drug sales, with references to methamphetamine, fentanyl, and marijuana. Separate entries describe revenue linked to slot machines, a cash business often flagged in laundering probes. The documents are not limited to Tapalpa. They reference multiple municipalities in Jalisco and nearby corridors. In at least one month, the sheets list income above 8.7 million pesos for Tapalpa. They also list operating costs of more than 1.3 million pesos. The same packet includes amounts recorded in U.S. dollars, suggesting parallel cash flows. Because these are informal records, investigators will need corroboration through other evidence. But the level of detail provides a starting map of how money may have moved through a regional cell.
Line items that raise corruption questions
Several items are labeled as payments to policía municipal units in towns around Tapalpa. One line item lists 138,000 pesos tied to Tapalpa police, without naming recipients. Other entries list 46,000 pesos for Atemajac de Brizuela and 86,000 pesos for Chiquilistlán. Both municipalities border Tapalpa. The documents also refer to federal security forces and a prosecutor’s office without providing full names. On their face, those labels suggest sobornos or protection payments. But the documents alone cannot prove delivery or acceptance. The labels do not clarify whether funds were for individuals, departments, or intermediaries. Prosecutors usually seek bank records, communications, surveillance footage, and witness statements before filing charges. Municipal payroll data can also be used to compare the scale of a labeled payment to official staffing costs. If authorities validate the records, the entries could become leads for internal affairs inquiries. If they cannot, the sheets still show how the group intended to budget for influence and reduced enforcement.
Why it matters now
The timing affects how investigators can use the documents. After the February 22 Tapalpa operation, federal authorities began collecting evidence tied to CJNG leadership. That process can take months. Payroll and expense notes can help connect nicknames to identities, and then to devices or vehicles. They can also show which towns were treated as priority corridors, based on recurring weekly costs. Another reason is the property itself. U.S. sanctions records have listed the cabin business under several names since 2020. Those listings tie it to suspected laundering networks linked to CJNG and allied groups. That history means the site already had a paper trail, including corporate names and addresses. Matching the new ledgers to older sanctions and local records could help map ownership and facilitators. For residents, the larger point is that financial evidence can outlast a single leader. Even if leadership changes, the networks that paid people and moved money can be traced.
For many expats, the practical impact is indirect. Tapalpa is a tourist destination. The security response has affected parts of Jalisco and nearby states in recent days. After high‑profile operations, authorities often increase checkpoints, patrols, and investigative activity. Disruptions can include road closures, flight changes, or reduced transport services on key routes. Reports after February 22 described roadblocks and vehicle burnings in multiple states. Conditions differed by region and by hour. None of this means routine life will change everywhere. It does mean plans can shift quickly in specific corridors. The documents’ value is informational. They show how a criminal group may treat surveillance, armed protection, and corruption risk as budget lines. That context helps explain why some towns face repeated pressure on local institutions. For day‑to‑day living, follow local notices and official government updates. For travelers, rely on official advisories, consult consular alerts, and avoid routes under active security operations.
