Mexico Tightens Bank Biometrics and AML Rules

Mexico’s SHCP and CNBV published new rules in the Official Gazette requiring the banking system to update customer verification processes with biometric technology within 90 business days of taking effect. The framework expands verification with facial biometrics as a complement to fingerprint checks and sets a minimum 90% match threshold against official databases from the INE, the SRE, or other authorized federal authorities.

Changes to bank verification

The rules also allow institutions to build their own biometric databases, but only under strict protection requirements. Those include a ban on selling the data to third parties and periodic cybersecurity audits, with controls covering encryption, infrastructure segregation, access controls, and secure deletion.

The regulatory push arrives as the CNBV has hardened its stance on compliance failures. Based on a review of public regulator data, Mexico’s fintech ecosystem has accumulated financial penalties of nearly 50 million pesos for violations of the Fintech Law, and three additional companies were sanctioned for similar breaches.

Pressure on banks and fintechs

At the same time, Bansí has received at least two reprimands and 15 fines published between 2018 and 2026 by the CNBV, mainly for anti-money laundering failures, regulatory breaches, and internal control deficiencies, totaling 7,257,400 pesos, according to an analysis of sanctioning decisions reviewed in public Commission records.

The regulatory pressure also extends to financial technology institutions. Their anti-money laundering and know-your-customer obligations stem from Article 58 of the Law to Regulate Financial Technology Institutions, supplemented by the CNBV’s general anti-money laundering and counter-terrorism financing provisions for the sector. In addition, when an ITF hires an outside provider to manage official ID images or users’ biometric data, it must obtain prior approval from the CNBV or Banxico before integrating that provider into its processes.

AML reform on a staggered schedule

The AML framework update promoted by Hacienda and overseen by the CNBV is set to take general effect on November 30, 2026, although not all provisions will begin then. Several technical reviews indicate that key obligations, including the comprehensive internal AML policy manual based on a risk methodology, customer and beneficial owner risk classification, new hiring procedures, and automated transaction monitoring systems, will start between March 1, 2027 and June 1, 2027, with some requirements extended into 2028 and 2029.

Baker McKenzie and KPMG agree that the new framework formalizes customer classification by risk level, the definition and monitoring of the expected transaction profile, and the updating of information recorded under earlier rules within six months after the effective date. KPMG also places full enforceability of critical components such as the Internal Policies Manual and Risk Methodology on March 1, 2027.

SHCP said the reform will be rolled out gradually starting in November 2026 to make it easier for high-risk sectors such as casinos, real estate, and the art and jewelry trade to adopt the new requirements.

More supervisory pressure

The regulatory escalation adds to other signs of a tougher stance in Mexico’s financial system. The Supreme Court upheld Condusef’s authority to sanction banks and financial institutions for poor collection practices, including failures to register and report collection agencies.

On the corporate front, the CNBV revoked the brokerage license of Casa de Bolsa Vector over irregularities tied to anti-money laundering controls, while CiBanco was sold to Grupo Multiva. Both measures were described as part of Mexican financial supervisors’ response to AML compliance deficiencies.

The pressure is also visible internationally. A recent analysis links the CNBV’s stricter sanctioning standards to the June 2025 designation of CIBanco, Intercam, and Vector as primary money laundering concerns by FinCEN, while another specialized column says the U.S. response relied for the first time on Section 2313a introduced by the FEND Off Fentanyl Act, which led to those three entities exiting the market and raised supervisory sensitivity in Mexico.