We pay an annual fee and then buy the bracelets as needed. But honestly, if your dive op forgets to put a bracelet on you or they run out of them for a day or two - you are not being ripped off. We are required to report our divers everyday in the form of a report so we are held accountable for reconciling when permit renewal time comes up. MP boats are actually checking # of divers on boats even if you don't see them - they don't always pull up to the boat. It's not a perfect science, but unless you never get the bracelets, I would not worry too much that you are paying your $2.50 a day and occasionally not getting a bracelet - the legal ops are held accountable and they do pay for them.
It always makes me laugh when some DM's "have bracelets for sale" - just shows their ignorance to the system. In order to buy them, you have to be legal including being a registered business with a Tax ID (in Mexico RFC). These DM's and Captains (or whoever) think they are fooling the system when the reality is that the MP is not fooled one bit - only the customers are.