Biometric CURP in Mexico: Is It Already Mandatory for the Private Sector?

By Mario Shai Aguado González

A New Model for Digital Identity in Mexico

On July 16, 2025, one of the most significant reforms in the area of citizen identification was published in the Official Gazette of the Federation: the incorporation of biometric data into the Unique Population Registry Code (CURP).

With this, Mexico is launching the creation of a National Digital Identity System, based on fingerprints and photographs, administered by the Ministry of the Interior (SEGOB) through the National Population Registry (RENAPO).

The goal is clear: to have a single document—both physical and digital—that can be used to verify people’s identities in all public and private transactions.

What changes with the reform of the General Population Act?

The reform introduced Articles 91-A through 91-F and 114-A into the General Population Act (LGP), which establish the legal framework for the new system.

The main changes include:

• Mandatory national identification document:
  The biometric CURP becomes the official form of identification accepted nationwide.
• Government interoperability:
  This will enable connections to national health, education, and social security registries, ensuring the integration of information across public institutions.
• Creation of a Single Identity Platform:
  Centralizes the management, validation, and authentication of digital identities under the control of SEGOB.
• Extension to the private sector:
  All public and private entities will be required to request the biometric CURP for the processing of procedures and services once the system is fully implemented.
• Penalty provisions:
  Article 114 Bis provides for fines ranging from 10,000 to 20,000 UMA’s (approximately $1.13 million to $2.26 million pesos) for those who fail to comply with the obligation to accept or request it.

Consent remains key

Although the LGP mandates the use of this document, it also recognizes that the inclusion of biometric data requires the data subject’s express consent.

This means that SEGOB must obtain such consent before collecting or transferring fingerprints and photographs, in accordance with the principles of informational self-determination and privacy set forth in the Constitution and the General Law on the Protection of Personal Data Held by Obligated Entities (LGPDPPSO).

A coercive implementation or one lacking valid consent could be challenged on the grounds that it violates fundamental rights.

Is it already mandatory for individuals?

Strictly speaking, there is a legal obligation, as Article 91 Sexies stipulates that the biometric CURP must be used in identity verification processes by any public or private entity.

However, it is not yet enforceable or subject to penalties. This is because:

• The regulations for the General Population Act have not yet been published.
• Biometric data collection modules are currently only in the pilot phase in certain regions (Veracruz, Mexico City, and the State of Mexico).
• The digital infrastructure and technical protocols have not yet been fully implemented.
  

The reform set a deadline of 90 calendar days—expiring on October 15, 2025—for public institutions to adopt the necessary measures. However, without regulations or operational systems in place, the requirement cannot yet be enforced.

What's Next

To ensure the system is fully operational, SEGOB must issue regulations defining:

• Procedures for biometric capture and validation.
• Formats and mechanisms for consent.
• Database interoperability protocols.
• Transition periods between the traditional CURP and the biometric CURP.
• Special rules for minors, people with disabilities, or foreign residents.
  

Conclusion: A necessary transition, but one that remains incomplete

The biometric CURP represents a decisive step toward digital identity in Mexico, with direct implications for personal data protection, public administration, and the relationship between individuals and the government.

However, its practical implementation still depends on the publication of the regulations and the technological infrastructure that supports its operation.

Until that happens, individuals and private entities are not yet required to apply for a biometric CURP, although they should prepare to do so as soon as the regulatory framework takes effect.

bgbg will continue to monitor regulatory and technological developments related to this system, as well as their implications for personal data protection, digital identity, and regulatory compliance.