Overview
- The CNBV published a resolution that took effect Wednesday requiring banks to be allowed to capture and store facial and fingerprint biometrics for customer authentication.
- The rule obliges institutions to validate captured biometric data against federal databases such as the INE, SRE and SAT before using it to verify identity.
- A new technical annex, Anexo 71, requires employees who handle enrollments to register their own biometrics and mandates annual internal reviews to prevent misuse or data substitution.
- Privacy lawyers and data experts warn the resolution leaves unclear whether customers can refuse sensitive biometric capture and raises access concerns because a recent intelligence law lets authorities request private biometric records without prior judicial orders.
- Regulators present the move as strengthening fraud and anti‑money‑laundering controls after increased international scrutiny of some Mexican banks and as part of a broader push toward digital identity and mandatory mobile‑line registration.