Mexico CNBV activates bank multibiometrics

Mexico’s CNBV formalized mandatory multibiometrics for bank customer verification in July 2026, with enforcement beginning on July 2, one day after publication. For now, the authority said biometric databases may only be built with fingerprint and facial biometrics until technical specifications are defined for other biometric data.

What changed with the resolution

The resolution published in the Official Gazette fully replaced the old Annex 71 with a new Annex 71 containing binding technical specifications for biometric verification by fingerprint and face. The requirements include 1:1 matching, liveness detection, encryption, logical segregation of databases, and irreversible deletion.

The new framework also narrows the operational scope. Multibiometrics is required only for higher-risk in-person transactions tied to level 3 and 4 accounts, including passive transactions for level 4 accounts, as well as active transactions, payment services, and payment instruments associated with level 3 and 4 accounts.

What banks must do

Biometric data may be added to a bank’s own database only after being matched against official records, such as INE, SRE, the tax authority, or another federal agency with biometric verification services, with a minimum match rate of 90%.

The biometric databases defined by the CNBV cannot be sold, transferred, shared, or made interoperable with other institutions or third parties. They must also remain logically segregated and encrypted in transit and at rest.

Institutions that already had an active biometric database when the resolution took effect must file a notice with the CNBV using the Annex 75 form within 30 calendar days, with no fee or related penalty for the filing. Based on the timeline referenced in the coverage, that deadline fell around August 1, 2026.

The CNBV also gave credit institutions up to 90 business days from July 2, 2026, to adjust processes and infrastructure to the multibiometric requirements in the new Annex 71. That places full compliance between late October and early November 2026.

Impact at the teller window

In practice, the requirement translates into a reinforced protocol for cash deposits or withdrawals of 140,000 pesos or more. In those cases, the customer must present valid official identification and undergo real-time biometric validation by fingerprint or face. If the ID is damaged, the system automatically rejects the transaction.

That threshold applies to teller transactions mainly linked to level 3 and 4 accounts. According to the available coverage, it does not change how ATMs operate or affect pensioners or social program beneficiaries, whose usual amounts remain below the threshold.