Mexico tightens bank biometric checks

What changed in Mexico’s bank verification rules?

Mexico’s Ministry of Finance, SHCP, and the CNBV published new rules in the Diario Oficial that give the country’s banking system 90 business days to adapt its identity verification processes to biometric technology. The measure adds facial biometrics as an official verification method, complements fingerprint authentication, and raises the identity standard for financial institutions.

According to Imagen Radio’s coverage, the rule sets a minimum 90% match threshold against databases from the INE, the Ministry of Foreign Affairs, or other federal authorities. The aim is to strengthen customer identification and reduce risk in onboarding and validation processes.

What technical and operational controls does the rule add?

The rules allow financial institutions to build their own biometric databases, but only with cybersecurity controls that include encryption, segregation on dedicated infrastructure, and an explicit ban on selling customer biometric data.

They also add technical requirements that, according to specialized analysis, do not always appear in mainstream coverage. These include fingerprint capture meeting the NFIQ standard, facial capture following ICAO standards, and facial biometrics solutions using liveness checks compatible with ISO/IEC 30107-3.

That same analysis says the regulation also opens the door to capturing biometrics from mobile devices without specialized hardware, as long as the required quality standards are maintained. In practice, that could reshape banks’ and other financial institutions’ digital identity infrastructure strategies, as well as their deployment costs.

How does the biometric CURP fit into this framework?

The SHCP resolution amending the rules tied to Article 115 of the Credit Institutions Law incorporates the biometric CURP, with fingerprints and a photograph, as a valid official form of identification. It also orders institutions to verify that information against RENAPO, the INE, or the SRE, depending on the document used.

Ibarra, Puga & González says this raises the bar for identity verification in AML and counter-financing-of-terrorism compliance. The firm also notes that the provisions on using and verifying the CURP with biometric data will only become enforceable once the Interior Ministry, with support from the Digital Transformation Agency, formally implements the relevant verification procedures, so institutions must track the transitional regime.

What happens with MTU and transfers?

The User Transaction Amount, or MTU, requires bank customers in Mexico to activate a feature in their bank’s app that lets them set personalized limits on transfers. According to El Cronista, banks must make the configuration option available by October 1, 2025 at the latest, and from January 1, 2026, use of the feature becomes mandatory for all customers.

The same report says that if a customer does not activate MTU on time, a default limit of 12,800 pesos per transaction will apply. This is not a financial fine, but an operational safeguard designed to improve banking security and prevent fraud.

How is oversight of banks and financial firms tightening?

The Supreme Court of Justice of the Nation upheld rules giving CONDUSEF authority to impose sanctions for poor collection practices and for failures by Mexican financial institutions to register and report debt collection firms.

At the same time, a report reproduced by MSN and attributed to Publimetro México says the CNBV imposed fines of about $10 million on a network of financial intermediaries and has begun taking a tougher supervisory stance toward that network. The coverage places the case in the context of international scrutiny from FinCEN, the FATF, and USMCA commitments.

Publimetro México adds that the case is being treated as a test of Mexico’s consistency with international commitments on anti-money laundering and the fight against opioid financing under the FEND Off Fentanyl Act. On the same front, Digid says that in fintech institutions, if an outside provider is hired to handle official ID images or users’ biometric data, prior authorization from the CNBV or Banco de México is required before the provider can be integrated.