On July 16, 2025, a presidential decree (the “Decree”) was published in the Official Journal of the Federation, amending, adding, and repealing several provisions of the General Law on the Forced Disappearance of Persons, Disappearance Committed by Private Individuals, and the National Search System for Missing Persons, as well as to the General Law of Population.

The reform was proposed by the President of the Republic, Claudia Sheinbaum, with the aim of establishing a new institutional framework for public security and to strengthen the mechanisms for searching for, locating, and identifying missing persons in Mexico. Among the main changes is the authority granted to the Mexican Department of the Interior to incorporate biometric data into Unique Population Registry Codes (“CURP”) so that they are considered a mandatory national identification document. The reform also calls for the creation of the Unified Identity Platform, a centralized system for managing, validating, and accessing the new biometric CURP.

Below are key questions and answers about the newly introduced biometric CURP:

¿What is the biometric CURP?

The CURP is an 18-character alphanumeric code that serves as an official personal identifier for citizens and residents in Mexico. It is generated using personal information derived from birth certificates, naturalization documents, or immigration records and is required for a wide variety of procedures, including tax filings, school and business registrations, and access to healthcare services.

The biometric CURP refers to an upgraded national identification card that will incorporate the CURP code of the holder, their photograph, and that will be bound to certain biometric data.

¿What information will the biometric CURP include?

The new biometric CURP card will contain and/or be bound to the following information and personal data:

• Full name
• Date and place of birth
• Gender
• Nationality
• Photograph
• Fingerprints

In accordance with Articles 91 and 91 Bis of the reform to the General Law of Population, the CURP will retain its 18-character alphanumeric structure, and a photograph of the holder will be added, as well as their fingerprints, in order to strengthen its function as an official identification document.

Although some reports have suggested that iris scans are being collected in the modules where the biometric CURP is currently being processed, the Decree does not expressly contemplate iris recognition as a required element. The iris, being a physical characteristic used to identify or authenticate a person, is considered sensitive biometric data, and its collection outside the established legal terms would be improper and contrary to the Decree.

¿Where will the biometric data be stored?

The Mexican Department of the Interior, through the National Population Registry (“RENAPO”), will establish coordination and collaboration mechanisms with various government authorities to integrate individuals’ biometric data into the new biometric CURP card. The Mexican Department of the Interior, with technical support from the Digital Transformation and Telecommunications Agency (the “Digital Transformation Agency”), will develop the Unified Identity Platform for the consultation, validation, and management of the biometric CURP.

The Unified Identity Platform will serve as a permanent, immediate and real-time source of consultation, which will be interconnected with databases or information systems to conduct searches across multiple databases (public and private), provided that such searches are conducted for the purposes of locating, tracking, and identifying missing or unlocated persons.

It should be noted that the biometric CURP will be linked to the National Health System Registry and may be integrated into other national registries and systems. In this regard, although the biometric CURP will not be stored within the Unified Identity Platform itself, it may be accessed and/or monitored through the interconnection of said Platform with various registries or information systems.

The Unified Identity Platform is not yet operational. In addition, the corresponding regulations and guidelines must be issued to establish minimum security mechanisms and procedures for access control and traceability of operations.

¿What is the purpose of the biometric CURP?

According to the Decree, the biometric CURP will become the mandatory official national identification document, universally valid throughout Mexican territory. It will be available in both physical and digital formats and will be used to validate individuals’ identities, with the understanding that all public and private entities will be required to request the biometric CURP in order to provide their services and carry out their procedures.

¿Is obtaining the biometric CURP mandatory?

Both the President and the Department of the Interior have indicated that implementation will be gradual, such process means that it will not be mandatory immediately.

Nonetheless, article 91 Bis of the General Law of Population, amended by the Decree, expressly states that the biometric CURP will be the mandatory national identification document, with universal acceptance and mandatory status throughout the national territory.

The reform also stipulates that this document will be an essential requirement for carrying out numerous essential procedures, such as: accessing health services, public education, participating in social programs, and conducting banking transactions, which in practice, makes the biometric CURP a mandatory document for the vast majority of people residing in the country.

The reform also imposes new obligations on both public institutions and private entities. Within 90 calendar days from the effective date of the Decree,  they must adopt the necessary protocols to incorporate the biometric CURP as a requirement in the procedures and services they offer. Repeated failure to comply with this obligation will be punished with fines ranging from 10,000 to 20,000 times the daily value of the Measurement and Updating Unit (UMA), which is equivalent to approximately between USD $60,000 to $120,000.

¿Where and how can it be obtained?

The Mexican Department of the Interior, through RENAPO, will oversee the physical version of the biometric CURP and will establish coordination and collaboration mechanisms with the various authorities to integrate individuals’ biometric data into the CURP, either through:: (i) the transfer of biometric data already held by the authorities of the three levels of government to RENAPO, or (ii) the direct assistance of the holders at the centers that the Department itself will set up for such purposes, with the prior consent of the holders in both cases.

Meanwhile, the Digital Transformation Agency will be in charge of the digital version of the CURP as identification; however, as of now there is not much certainty regarding the differences between the physical and digital versions.

The procedure consists of going to an authorized office, submitting the required documentation, and having your biometric data taken to link it to the CURP.

So far, the pilot program for issuing the biometric CURP is available only at selected Civil Registry and RENAPO offices in specific municipalities and boroughs throughout the country. However, it is expected that by 2026, all modules will be enabled so that citizens and residents can apply for this new form of official identification.

¿When does the reform take effect?

The Decree took effect on July 17, 2025, but implementation is expected to be gradual.

According to the transitory provisions of the reform to the General Population Law, it is established that, within 90 calendar days after its entry into force: (i) the Department of the Interior, in collaboration with the Digital Transformation Agency, must develop the Unified Identity Platform; and (ii) all public and private entities must adopt the necessary protocols to include the biometric CURP as a requirement in the procedures and services they manage.

Key Risks and Concerns

This article does not aim to offer absolute certainty, but rather to outline the most relevant aspects of the reform. Although the Decree establishes certain guidelines, official communications have at times been inconsistent, and doubts remain regarding how both the biometric CURP and the Unified Identity Platform will be implemented and operated in practice. Therefore, it is critical to closely monitor the regulations and their interpretation in order to gain a clearer understanding of the progress made in their implementation.

Despite the benefits associated with the consolidation of a unified national identity, the reform also poses significant risks, particularly in terms of data protection:

1. Both public and private entities must prepare to adopt the necessary measures to incorporate the biometric CURP as a requirement in the procedures and services they provide.

• As of now there is no certainty regarding the differences between the physical and digital versions of the biometric CURP, since, as recently announced by the director of RENAPO at a press conference on August 22, 2025, plastic cards will no longer be issued for the physical version. Instead, the CURP holder will receive it via email and will be able to print and laminate it.

• Biometric data, such as fingerprints and iris scans, are considered sensitive personal data under Mexican law and various international treaties on the subject. Improper or excessive use of such data can pose a significant risk to individuals’ privacy and identity rights.

Therefore, it is essential that both authorities and individuals who require the biometric CURP to provide or contract services, ensure that this information is processed appropriately, securely, and proportionately.

• Mandatory use of biometric data, including fingerprints and photographs, increases the risk of privacy breaches in the event of hackings, data leaks, or unauthorized access to the databases where this information is stored.
• Cybersecurity experts warn that digitalization and centralizing of identity increase exposure to cyberattacks, which can compromise system integrity and data security.
• Various civil society organizations and digital rights advocates have raised concerns that centralized biometric databases could foster an ecosystem of mass surveillance, without clear mechanisms for oversight or effective protection against the misuse of information, especially in contexts of corruption or institutional weakness.