Reviewed 4 November 2026.
KYC (know your customer) in Mexico comes down to four questions a foreign business can answer lawfully: whether the identity document is current according to the authority that issued it, whether the bank account belongs to the person or company being onboarded, whether the address is real, and whether a company is what it claims to be and is owned by whom it says. Identity rests on the voter credential issued by the Instituto Nacional Electoral (INE, the National Electoral Institute) and on the Clave Única de Registro de Población (CURP, the population registry key), and bank accounts are identified by an 18-digit CLABE.
A US fintech, marketplace, payments company, lender or exporter can confirm much of this remotely, with the counterparty's consent. It cannot obtain a person's data from INE or from a bank, because Mexican law keeps both confidential. Where the checks disagree, or the counterparty or the money raises questions, KYC should turn into enhanced due diligence in Mexico, with records searches and people on the ground.
This guide covers individuals and the payment trail. Company records, tax status and signing authority are covered in our guide on how to verify a Mexican company, and personal screening in our article on background checks in Mexico.
The identity documents a Mexican counterparty will offer
Mexican banks accept a set list of identification documents, and that list shapes what customers carry. The general provisions that the Secretaría de Hacienda y Crédito Público (SHCP, the Finance Ministry) issues under Article 115 of the Ley de Instituciones de Crédito (LIC, the Credit Institutions Law), as amended by a resolution published on 10 July 2026, require an original, current official document with a photograph and signature. The list includes the INE voter credential, the passport, the military service card, the consular registration certificate and the driver's license. For foreign nationals it adds the passport and the immigration documents of the Instituto Nacional de Migración (INM, the National Migration Institute).
The INE voter credential
The credencial para votar (voter credential) is the document most Mexican adults present. Article 126 of the Ley General de Instituciones y Procedimientos Electorales (LGIPE, the General Law of Electoral Institutions and Procedures) makes the data citizens give the Registro Federal de Electores (Federal Voters Registry) strictly confidential, and the reform of 2 June 2026, the latest to the LGIPE, did not change that article. INE therefore offers outsiders two different services.
The first is INE's online check of the Lista Nominal (the electoral roll). It takes details printed on the credential and answers whether the credential is current. It does not show that the person presenting it is the holder.
The second is the Servicio de Verificación de Datos de la Credencial para Votar (Voter Credential Data Verification Service), approved by INE's General Council in resolution INE/CG92/2016 of 26 February 2016. Under that General Council resolution, it is open to private and public institutions and civil associations that have the infrastructure and sign a convenio (cooperation agreement) with INE, which must oblige them to obtain the citizen's express consent. It answers yes or no to whether the data on a credential match the electoral register, without INE releasing confidential information, and it can authenticate fingerprints. INE's privacy notice, updated on 3 June 2026, says it compares the full name, fingerprints or facial data and voter key.
A business without an agreement can use the public check, and should ask any identity verification vendor whether it queries INE under a convenio and on what consent.
The CURP and the 2025 biometric reform
The CURP is an 18-character alphanumeric key. Article 91 of the Ley General de Población (LGP, the General Population Law) now calls it the single source of identity for Mexicans and for foreigners with regular immigration status, and it records at least the holder's name, date of birth, sex or gender, place of birth and nationality. Article 91 Sexies obliges every public body and private party to request the CURP for its procedures and services. The key can be looked up free of charge on the federal government portal by entering the holder's personal data, so the key and the data a customer supplied can be compared. Like the INE check, the lookup does not show who is presenting them.
A decree published on 16 July 2025 amended the LGP. Under the new Article 91 Bis, a CURP that also contains fingerprints and a photograph is the national identification document, mandatory and of universal and obligatory acceptance throughout Mexico, in physical and digital form. Biometric data are added only with the holder's consent. Article 114 Bis fines authorities and private parties that fail to meet the obligations of Article 91 Bis, after a warning for repeated failure, at 10,000 to 20,000 times the daily Unidad de Medida y Actualización (UMA, the indexed unit for legal amounts). At the 2026 value of MXN 117.31, that is MXN 1,173,100 to MXN 2,346,200.
The systems behind it are still being built. The decree gave the Secretaría de Gobernación (the Interior Ministry) 90 days to develop a Plataforma Única de Identidad (Single Identity Platform). Its guidelines, published on 27 November 2025, let the Registro Nacional de Población e Identidad (RENAPO, the National Population and Identity Registry) authorize institutions to consult and validate identity data, on written application and once every legal, operational and technical requirement is met.
The July 2026 bank rules add the biometric CURP to the list of valid identification, but that change takes effect only when the Interior Ministry, with the Agencia de Transformación Digital y Telecomunicaciones (the federal digital agency), publishes and implements the processes for verifying it. Until then, a business should accept the biometric CURP when offered and check the key through the public lookup.
Passport, RFC and e.firma
The Mexican passport, issued by the Secretaría de Relaciones Exteriores (SRE, the Foreign Ministry), is on the banks' list of valid identification. The Registro Federal de Contribuyentes (RFC, the federal taxpayer registry and the code it assigns) identifies a taxpayer, and our guide on how to verify a Mexican company explains what the public tools of the Servicio de Administración Tributaria (SAT, the tax authority) confirm about it. The e.firma is the advanced electronic signature used with the SAT, backed by a certificate under Article 17-D of the Código Fiscal de la Federación (Federal Tax Code). Neither replaces an identity check.
Proof of address
Mexican customers are used to proving an address with a utility bill, because the bank rules accept a proof of address such as a receipt for household services, no more than three months old, unless the address matches the one on the voter credential or the consular registration certificate. A bill shows that a service is supplied at an address. It does not show that the customer lives or trades there, and a bill can be borrowed or altered.
Where the address matters, as with a vendor's warehouse, a borrower's business or a merchant's premises, the reliable confirmation is a visit. A field visit establishes whether the premises exist, whether the counterparty operates there and whether neighbors know it, and it records the date and what was seen.
Bank accounts: the CLABE and the transfer receipt
What the CLABE tells you
Every account that receives transfers through the Sistema de Pagos Electrónicos Interbancarios (SPEI, the interbank electronic payment system run by Banco de México, or Banxico, the central bank) is identified by an 18-digit CLABE (Clave Básica Estandarizada, the standardized account key) that the institution assigns. Banxico's SPEI rules leave its structure to the system's operating manual. According to the Asociación de Bancos de México (ABM, the Mexican Bankers Association), the first three digits identify the bank, the next three the city or region where the account is held, the next eleven the account itself, and the last is a control digit produced by an algorithm.
A correct control digit shows that the number is well formed. It does not show that the account is open or who holds it. The bank code still matters: a counterparty that says it banks with one institution and supplies a CLABE from another has something to explain.
Confirming the account holder with a test transfer
The beneficiary name typed into a transfer is not checked against the account. Banxico's user experience guidelines for mobile transfers, which take effect on 14 December 2026, require a banking app sending to a CLABE to show the name of the receiving institution associated with it, and allow the app to show that a beneficiary name the user typed was not validated. For transfers to a mobile number linked to an account, the app must query Banxico's services and show the beneficiary's name masked.
The Comprobante Electrónico de Pago (CEP, the electronic payment receipt) fills the gap. Banxico's SPEI rules define the CEP as a digital document recording that the amount of a SPEI transfer was credited to the beneficiary's account, generated from the information the receiving institution must send to confirm the deposit, and carrying a digital seal that Banxico's validator can check. CEPs are available in PDF and XML for transfers made since 24 February 2012, and Banxico's 2016 announcement of its batch service states that they can be obtained by those involved in the payment. To download one, the sender needs the transfer date, the tracking key or reference number, both institutions, the beneficiary account and the amount.
A business can therefore send a small transfer from its own account to the CLABE the counterparty supplied, download the CEP and compare the beneficiary details reported by the receiving bank with the person or company being onboarded. The business is a party to the payment, so it asks no bank for anyone's information. Bank account details are financial data, which under the 2025 data protection law require the holder's express consent unless an exception applies, so the onboarding terms should state that accounts will be verified this way and the counterparty should accept them.
What no one can lawfully obtain from a bank
Article 142 of the LIC makes information on deposits, operations and services confidential. To protect their customers' privacy, banks may give it only to the depositor, debtor, holder or beneficiary and the other parties the article names, to their legal representatives and those empowered over the account, and to the authorities the article lists, among them prosecutors and the federal tax authorities. Bank employees are liable for breaching that secrecy, and the bank must compensate the damage caused. The reform of 14 November 2025, the latest to the LIC, did not amend Article 142.
Because the bank may release the information only to those people and authorities, a provider who offers a Mexican account holder's balances, statements or account details is offering information it could not have obtained lawfully. Lawful account checks work from the counterparty's own documents and consent and from payments the business itself makes.
Mexico's own KYC rules, in outline
Mexican counterparties meet KYC under three sets of domestic rules, which shape what they expect to be asked for.
Banks follow the SHCP's general provisions under Article 115 of the LIC. The resolution published in the evening edition of the Diario Oficial de la Federación (DOF, the Federal Official Gazette) on 10 July 2026 took effect the next day and gives banks 18 months to adapt. For level 2 Bis and level 3 deposit accounts, banks must verify, directly or through a third party, either the CURP against RENAPO's records (QR code, full name and 18-character key) or the voter credential against INE's records (identifier code, year of registration, voter key and issue number and year).
A level 2 Bis account opened remotely also requires a proof of life, through mechanisms set by the Comisión Nacional Bancaria y de Valores (CNBV, the banking and securities regulator). Mexican customers will increasingly expect a liveness check and a database match when they onboard remotely.
The Ley para Regular las Instituciones de Tecnología Financiera (the fintech law), issued on 9 March 2018, regulates crowdfunding institutions and electronic payment fund institutions. Article 58 requires them to establish measures to prevent and detect operations that could amount to terrorist financing or money laundering under Articles 139 Quáter and 400 Bis of the Código Penal Federal (Federal Criminal Code), under general provisions that the SHCP issues after hearing the CNBV.
Outside the financial system, the Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita (LFPIORPI, the federal anti-money laundering law), last amended on 16 July 2025, lists in Article 17 the vulnerable activities subject to client identification, among them non-financial lending, real estate development and brokerage, vehicle sales, notarial services and virtual asset exchange or custody. Article 18 requires those who carry them out to identify clients through officially recognized documents, ask for the client's occupation where there is a business relationship, obtain documents identifying a corporate client's beneficial controller and keep the file for at least ten years. Our guide to beneficial ownership in Mexico explains how the 2025 reform defines the beneficial controller.
Personal data: consent and the privacy notice
The Ley Federal de Protección de Datos Personales en Posesión de los Particulares (Federal Law on the Protection of Personal Data Held by Private Parties) was published on 20 March 2025, took effect the next day and repealed the 2010 law. Oversight sits with the Secretaría Anticorrupción y Buen Gobierno (the Anti-Corruption and Good Government Ministry), which Article 39 empowers to verify compliance. The former regulator, the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI), was dissolved under the constitutional reform published on 20 December 2024, and the 2025 law moved its staff to that ministry.
Processing requires the data subject's consent unless an exception in Article 9 applies (Article 7). Consent is tacit where the privacy notice was made available and the person did not object, but financial or patrimonial data require express consent, and sensitive data express written consent (Article 8). The notice must state at least the controller's identity and address, the data processed, the purposes, the means to limit use or disclosure, how to exercise the rights of access, rectification, cancellation and objection, and how changes will be notified (Article 15). A KYC flow needs a notice that names identity and account verification among its purposes, and an express consent for the account check. Our background check guide covers consent in screening.
Companies and the people behind them
When the counterparty is a company, KYC adds its legal existence, tax standing, signatories and owners. The corporate registry is searched through SIGER 2.0, as our Mexico company search guide explains. Mexico has no public register of beneficial owners, and the beneficial ownership guide sets out how ownership is established. The people who sign for, own or receive payment for the company then go through the identity and account checks above, and the account should stand in the company's name, not in a shareholder's or an employee's.
Screening against US designations, including the Mexican cartels designated as foreign terrorist organizations in 2025 and 2026, is covered in our article on due diligence in Mexico and cartel-related risk.
When KYC should become enhanced due diligence
KYC confirms that the documents and the account agree. Enhanced due diligence establishes who the counterparty is and where its money comes from, through records searches and field inquiries rather than database matches. The onboarding policy should name the triggers in advance, so that staff escalate on facts.
On identity and payments, the triggers include a credential that INE's check reports as not current, a CURP record that does not match the name or date of birth supplied, a CEP showing a beneficiary other than the counterparty, a request to pay a third party, and repeated changes of bank details, particularly just before a payment. Each may have an innocent explanation, and each needs one supported by documents.
On the business, they include an address that a visit cannot confirm, a tax address at a virtual office while the business operates elsewhere, a registered activity that does not fit the work proposed, a recently formed company that claims a long history, and an RFC on the SAT's presumed or definitive false invoicing lists.
On ownership and conduct, they include owners or signatories who will not identify themselves or the beneficial controller, a refusal to consent to checks, a counterparty that holds or recently held public office or is close to someone who does, adverse press or litigation, a business in a vulnerable activity that cannot show it meets its own identification duties, and any link to a designated cartel. Record a refusal as a finding.
Enhanced due diligence then adds a litigation search in the states where the counterparty lives and trades, adverse media in Spanish including the regional press, a field visit and ownership and related-party mapping. Where the concern is money already lost or diverted, the work becomes a fraud investigation.
Where we come in
Warden Consulting, founded in 1995, runs KYC and enhanced due diligence on Mexican individuals and companies from its office in the World Trade Center in Mexico City, with investigating lawyers supervising each file. We check identity documents with the issuing authorities' tools, verify who holds the bank accounts a counterparty supplies, confirm addresses by field visit in any of Mexico's 32 states, and run company, beneficial owner, litigation and adverse media checks. Matching the bank accounts a counterparty supplies against the named account holder is part of the vendor checks we run for marketplace clients.
We work at onboarding volume for platforms that take on many counterparties, or case by case where one relationship carries the risk, and report each finding with its source and date so that compliance teams can file it. To scope a program or a single check, contact our Mexico City office.
Frequently asked questions
How do I verify a Mexican INE voter credential?
Enter the details printed on the credential in INE's online Lista Nominal check, which reports whether the credential is current. Confirming that the person presenting it is the holder requires INE's data verification service, which needs a convenio with INE and the holder's express consent and can compare fingerprints or facial data.
Can I check a CURP online?
Yes. The CURP can be looked up free of charge on the federal government portal using the holder's personal data. The result confirms the key and the data behind it, not the identity of the person presenting them.
Is the biometric CURP mandatory in Mexico?
Since the reform published on 16 July 2025, Article 91 Bis of the Ley General de Población makes a CURP with fingerprints and a photograph the national identification document, of mandatory acceptance throughout Mexico. Adding the biometric data requires the holder's consent, and the July 2026 bank rules recognize it only once the Interior Ministry publishes and implements the processes for verifying it.
How can I confirm who holds a Mexican bank account?
With the counterparty's express consent, send a small SPEI transfer from your own account to the CLABE supplied, then download the CEP from Banco de México with the transfer data. The CEP is generated from the receiving bank's confirmation of the credit, so the beneficiary details on it can be compared with the counterparty's name.
Will a Mexican bank confirm an account holder's details?
No. Article 142 of the Ley de Instituciones de Crédito lets a bank give information on deposits, operations and services only to the client, its representatives and those empowered over the account, and to the authorities the article lists.
What documents does KYC in Mexico usually require?
For individuals, a current official photo identification, usually the INE voter credential or a passport, the CURP, the RFC where the person is a taxpayer, and a proof of address no more than three months old. For companies, add the incorporation deed and bylaws, the signatory's power of attorney, the SAT tax status certificate and documents identifying the beneficial controller.
This article is general information, not legal advice.