Mexico tightens biometric and digital payment rules

Mexico’s CNBV has set technical requirements for the capture, verification and protection of fingerprints and facial biometrics at financial institutions that use those data for authentication. At the same time, the federal government sent Congress a proposal for a new Digital Economy Law for Digital and Electronic Payments, while Banxico published a circular with changes for transfers made from banking apps. Banco de México also placed cybersecurity back among the risks facing the financial system.

What changed in biometrics and authentication?

The regulatory push is steering banks and other financial players toward stronger identity verification methods, including biometrics, remote authentication and technical safeguards for data. Based on the material reviewed, the CNBV has already established specific requirements for fingerprints and facial biometrics in authentication processes. The official proposal for digital payments also makes Digital CURP and the Citizen Digital File central elements.

DPL News and El Imparcial describe Digital CURP and Biometric CURP as the same document at different stages of updating, both with a fingerprint and a photograph. The idea is to use them as a remote identity credential for opening bank accounts, applying for loans and purchasing insurance online without going to a branch. El Economista adds that the initiative aims to expand QR code payments, enable remote account opening and strengthen interoperability between traditional banks and fintechs.

What role is Banxico taking in digital channels?

Banxico ordered concrete changes for transfers from mobile apps, with a compliance deadline of December 14, 2026. Circular 9/2026, published in the Official Gazette of the Federation, requires direct and indirect SPEI participants to adapt their apps and follow the Guidelines for standardizing the user experience in electronic fund transfers through mobile devices.

That regulatory move adds to the growing use of security standards in electronic payments. Global IT Media notes that the PCI Security Standards Council emphasizes PCI DSS as a framework to help mitigate data breaches, while JP3 Financial said it obtained PCI DSS 4.0.1 certification when it received Banxico and CNBV approval to launch the Paycaster digital wallet in Mexico.

How exposed is the financial system still?

Banco de México says Mexico’s financial system remains exposed to cybersecurity risks, and recent data show the pressure is increasing. According to MSN México, Banxico recorded eight cyber incidents at financial institutions between January and May 2026, twice the total logged in all of 2025.

That assessment also appears in the most recent Financial Stability Report, cited by El Heraldo de México, which lists cybersecurity alongside climate change among system risks. In the same vein, specialized columns on financial regulation point out that a banking relationship that is now almost entirely app-based forces the CNBV and Banxico to build information security, operational continuity and financial trust into digital product design.

What legal framework exists in Mexico today?

Mexico still does not have a specific cybersecurity law, but it does have a complementary criminal framework for certain financial and information-related incidents. The guide cited by Altona Spain News says the Federal Criminal Code includes provisions that apply to financial crimes and information security, even though there is no comprehensive law dedicated to the issue.

Against that backdrop, recent alerts from the ABM and Condusef, distributed by business media, keep the focus on basic operational practices for digital banking users, such as distrusting unexpected messages, never sharing passwords, PINs or SMS codes, and enabling transaction alerts. Taken together, the regulatory and operational approach points to a model in which biometrics, technical certifications, app changes and user guidance advance at the same time.