and CNBV in 2026: The challenge is no longer to recognize a face

CNBV · DIGITAL IDENTITY

Facial recognition's just a part of the problem.

For years, much of the conversation about biometrics in financial services was summed up in a question: does his face coincide? The modification published by the National Banking and Value Commission (CNBV) 1 July 2026 requires more difficult questions.

What was his or her relative identity from? The biometrics were captured directly from his or her person? Are there mechanisms to detect a photo, a screen or another simulation attempt? Is that person previously enlisted under another identity? Who did his or her capture? Where's his or her biometrics been stored? Can we have an examination about his or her original data? What happens when his or her institution stops using his or her base? Is there sufficient evidence to rebuild the whole process with a review?

These questions explain why to interpret the amendment only as “CNBV with face biometrics” The important change is another: biometrics begins to be understood within an architecture where identification, capture, validation, encoding, authentication, security, evidence and governance have to work as a whole.

A biometric coincidence can answer if two samples appear to belong to the same person. Building confidence requires far more demonstration.

That article has information and technological aims and does not constitute legal or regulatory advice and for an interpretation applicable to a particular case, have a look at its area of law or compliance and review the official text of the resolution published in the FOD.

1. What really modified the CNBV?

The decision was published in the FOD on 1 July 2026 and amends the general provisions applicable to credit institutions. CNBV aims to set clear, simplified and approved guidelines so that institutions can integrate files and conduct client identification and authentication processes effectively and gain information and documentation necessary for financial operations and services.

Before this amendment, some face-to-face operations already required fingerprint checks against sources such as the National Electoral Institute (INE) and the Secretariat of Foreign Affairs (SRE). The statement of motif itself recognizes that the framework already referred to biometric data as authentication mechanisms but did not expressly cover facial biometrics within these processes.

That's why it's wrong to simplify change as “before you can't wear face. Now you can.”The right reading is more precise: CNBV expressly incorporates facial biometrics into a set of processes and lays down technical and operational conditions for using them.

2. The first question is not “Do we have biometrics?” but “Where does it apply?”

The resolution should not be interpreted as a uniform obligation for any financial interaction. Article 51 Bis refers, among other cases, to individuals who in person request passive transactions related to Level 4 Bank Accounts, active transactions, services, and payment means related to Level 3 and 4 Bank Accounts, when the accounts are held at the same institution or at another one.

A number of cash withdrawals and transfers from Bank Accounts Level 4 are also shown in the biometric basis scheme referred to in Article 51 (2).

Not all operations necessarily follow the same process and the result of this mapping determines which verification mechanism corresponds to each case.

The architecture should not start by choosing a biometric motor. It should start by understanding the regulatory journey that should be solved.

3. A biometric base of its own changes the model

Article 51 Bis 2 allows the institution, in place of certain mechanisms provided for in 51 Bis and 51 Bis 1, to build its own biometric database under the technical requirements of Annex 71, and to subsequently use it for certain identity verification processes.

But there's a critical condition: the identity isn't incorporated into that base without an earlier check. To integrate the base, the institution will have to check the coincidence of the client's biometrics with respect to:

• National Electoral Institute (INE);
• Secretariat for Foreign Affairs (SRE)
• Mexican fiscal authority
• another federal unit providing biometric monitoring services.

It should also preserve documentary evidence of the result of that survey.

The proper basis should not be transformed into a collection of photographs with a misestablished identity. The reliability of future authentication depends directly on the reliability of initial encoding.

4. What identifications does the process have?

Article 51 Bis 2 lays down, inter alia:

• as a valid vote issued by INE;
• valid Mexican passport
• valid consular registration
• Identification issued by another Mexican fiscal authority or federal dependence, if its biometrics can be verified under the appropriate mechanism.

5. RENAPO doesn't fulfill exactly the same function as INE or SRE

That distinction should be quite clear.

The biometrics answer one part of the question.

6. The enrolment order also matters

That's an important and little commented about. Annex 71 and Article 51 Bis 2 have stated that, first, biometrics of employees, managers and officials that will be in charge of capturing biometrics of customers have to be registered.

Also, the process should prevent an operator from registering his own biometrics as a substitute for those of his client and the first capture process should be verified annually by internal Controller's officials.

It doesn't just exist. “client's identity”. There are also an operator's identity and an actor's traceability involved in encoding.

7. Facial biometrics: a selfie isn't an identity

Annex 71 lays down a number of requirements for first facial capture that can be read in layers. Each layer resolves a different problem - from person's uniqueness to the technical quality of the image to be processed.

That shows that regulations do not deal with “facial recognition” there are at least four different problems:

A facial recognition algorithm may be precise and still be part of a bad identity process.

8. Facial detection, survival and comparison: three different things

To merge these three layers is a common error while evaluating biometric technologies. Regulation requires that biometric information be obtained directly from the person and that applications avoid registration of information from mechanisms that purport to simulate another person's biometrics. INE, passport and consular registration.

The conceptual presentation attacks that this type of controls seek to mitigate are photo, screen reproduction and other physical elements used to simulate biometrics. If we mention the evolution of the digital risk - such as deepfakes - we should make clear that this is a technological evolution of the risk and not a term that the resolution expressly uses.

9. 1:1 and 1: N do not solve the same problem

A 1:1 comparison may be positive and even if the same person is registered under different identities cannot be responded.

1:1 confirms a stated relationship. 1: N looks for relationships that perhaps the user did not declare.

10. 90%: What does and does not mean

For the voter ID card (credencial para votar), the provision establishes that the biometric information obtained must match at least 90% with INE records, under the technical requirements defined by the Institute. For the Mexican passport and consular ID (matrícula consular), equivalent checks against SRE appear under the corresponding technical requirements.

But that No means that CNBV require a 90% universal threshold for any biometric comparison. “Comparison” as an algorithmic process in which biometric templates are evaluated by matching scores with thresholds previously established by the institution itself.

A regulatory threshold isn't the same as an operational threshold.

11. Fingerprint doesn't go away: model remains multibiometric

The resolution does not replace face prints. The transitional regime currently allows to form bases for fingerprint and face biometrics, until the Commission lays down specifications for other biometrics.

The level of specificity indicates that CNBV It looks at biometrics as a complete system composed of sensor, capture, software, quality, transmission, security and process - not just algorithm.

12. Exemptions: The process should work when the happy path doesn't work

The resolution includes persons who, by physical impairment, cannot provide at least one of the required biometrics. That should have documented procedures and be entered in the file. The Annex mentions examples such as amputations, grafts, malformation, permanent damage, prostheses, disease or other circumstances.

To design only the happy path isn't to design a regulated process.

relative with the user's experience, good architecture should cover recaptures, low quality, exceptions, human intervention, alternative routes, evidence and review.

13. Security: regulation reaches all the way down to the infrastructure

The provision requires preserving integrity, retention, availability and tamper-resistance. Annex 71 establishes, at a minimum, the following controls:

14. A proper base does not mean a shared basis

The Regulation lays down that information contained in biometric client bases should not:

• disposal, sale and transfer
• be shared or requested under exchange schemes;
• be protected for re-use;
• used by interoperability between institutions or third parties

To conduct checks referred to in this Section. The checks have to be performed against information contained in the basis formed by each institution.

That opens up basic architectural questions for technological due diligence: tenant isolation, residence, segregation, processing, retention, ownership, permits, completion, disposal and exportability of evidence. These are technological due diligence questions, not specific contractual requirements that the rule expressly lays down.

15. What happens when a database is no longer used?

When an institution decides to stop using the base, it should:

1. conduct the information concerning CNBV by Annex 75, within the applicable time and place;
2. to suppress biometric data;
3. using administrative, technical and physical measures that prevent unauthorized recovery, access or treatment;
4. preserve documentary evidence of procedure.

The ability to correctly erase can be as important as the ability to capture correctly.

Offboarding also forms part of architecture. An institution that replaces components of its track should at first evaluate what information lies with the supplier, what resides with its own infrastructure, how it's segregated, how evidence is preserved, how completion is performed, what should be eliminated and what should be maintained for regulatory or operational reasons. That does not constitute legal advice about data portability.

16. Continuous compliance: implementing isn't an end

The institution that lays down a basis should conduct an annual validation with respect to the safety mechanisms referred to in Annex 71. CNBVThe Commission may request additional information from the Commission after serious or repeated technical, operational or safety violations have been undertaken and may, after the procedure referred to, conduct a partial or complete, temporary or final suspension of the use of the base.

Moreover, the first capture process should be verified every year by Internal Controller - a review other than security validation.

Biometric compliance is a continuous operating system, not an implementation project.

17. Evidence: a “match” is not enough

The resolution requires documentary evidence at different times: collation against authorities, conformation processes, alternative mechanisms, exceptions, data disposal and corrective actions.

An enterprise architecture should be able to answer:

18. Annex 75 Connects Technology with Regulatory Government

A number of actions require information or applications using Annex 75 formats and have been referred to as an initial use of a basis, an existing basis at the time of entry into force of the resolution, an alternative mechanism, an alternative document and an alternative check and an end to the use of some mechanisms or bases.

The technical architecture and the regulatory file should not be built independently.

19. Regulation does not close the door to innovation

Article 51 Bis 3 allows that CNBV authorising processes other than those referred to for the establishment of the base.

• detailed description of the mechanism
• adoption by Council
• technological infrastructure in each part of the process
• means of transmission and maintenance;
• checks of integrity, proper reading and non-handling
• and availability.

The institution should preserve evidence of the outcome of the meeting with authorities.

20. Different monitoring documents and actions may also be put into place

Section 51 Bis 5 allows that CNBV It should be established that the result is reliable to identify the person and that there are some valid elements of identification with respect to a Mexican fiscal authority or federal office providing biometric verification.

The request should include, inter alia: detailed description, Council approval, technological infrastructure, documentary validation method, procedure for checking that the document corresponds to the carrier and evidence of effectiveness as approved by the Risks Committee.

For an institution, technological innovation also means being capable of explaining and demonstrating design.

21. A conversation involving the whole institution

When an identity becomes an infrastructure, it ceases to belong to a single area.

22. 13 questions to evaluate - or replace - a biometric supplier

1. 1

   Do architecture allow our biometric information to be properly insulated?

2. 2

   Where are we processing and storage?

3. 3

   What coping mechanisms /PAD and what independent evidence about them?

4. 4

   Do you support the capture requirements our process needs?

5. 5

   Can 1:1 biometric authentication be allowed?

6. 6

   Do you have a real capacity for 1: N duplication as necessary?

7. 7

   How do you integrate with INE, RENAPO or other sources our process requires?

8. 8

   What evidence does every operation generate?

9. 9

   How does information in transit and storage protect?

10. 10

    What controls exist about privileged users, login and audit?

11. 11

    Can you join our infrastructure without rebuilding the complete flow?

12. 12

    Can they coexist temporarily with existing components or providers during a transition?

13. 13

    How do you manage the data's life cycle when you change architecture or end your relationship?

We can discuss what skills your institution already has, what it needs to complement and what components would make sense to evolve.

23. From compliance with technological architecture

How a regulatory requirement can be translated into technological capabilities - isn't a list of what CNBV demand JAAK.

24. Where goes JAAK?

In JAAK We have been developing digital identity infrastructure. Our approach does not come from assuming that all institutions require exactly the same flow but from combining identity, biometrics, sources, risk and evidence capabilities according to architecture and the process that needs to be solved.

An institution may require a complete architecture or only replace or supplement a particular component. Modularity allows an entity to think of an identity as an infrastructure, and not as a closed flow.

25. Additional skills: beyond this resolution

JAAK also has skills as lists AML/ risk, digital signature, certified evidence, NOM-151 and other layers of confidence journey.

They can be complementary because, in practice, an institution can check biometric identities and later evaluate risk signs, sign and preserve evidence:

That builds a bigger journey, but it doesn't have to be mixed with the concrete biometric obligation that analyzes this article. NOM-151 can check What's NOM-151 and why it matters in digital contractsand risk lists AML/PLD, the risk lists PLD/AML.

26. Adaptable technologies: replacing a component should not require reconstruction

Institutions rarely start from a blank sheet. There are production channels, core systems, mobile applications, portals, anti-fraud engines, repositories, rules and vendors that are already part of the operation.

That's why an enterprise technology should consider gradual integration, co-existence, modularity, decoupling, APIs, SDKsand development.

The technical viability, transition model and regulatory obligations should be assessed for each architecture.

27. Technology with evidence

You can check the details of these attestations and other safety checks at The Security Page JAAK.

28. A architecture of confidence does not end up KYC

Each cape can operate within an integral architecture or be incorporated only where an institution needs to complement, replace or develop a capacity.

The challenge is no longer to recognize a face

The update of CNBV leave an idea especially relevant to any institution that's revising its identity infrastructure: a reliable biometric depends on far more than a comparison algorithm.

Requires enrolment, presence, quality, official source, authentication, duplication, infrastructure, security, government, evidence, review and evolving capacity.

The challenge is no longer to recognize a face. It's to build architecture that allows us to trust and prove why.

Sources and references

• Resolution amending general provisions applicable to credit institutions (biometric), Official Journal of the Federation, 1 July 2026.
• Article 51 Bis of the General Provisions applicable to credit institutions.
• Article 51 Bis 2 — building your own biometric database.
• Article 51 (3) - authorisation of different proceedings.
• Article 51 Bis 4.
• Article 51 Bis 5 — alternative verification documents and actions.
• Annex 71 - technical requirements for capture, quality, infrastructure and biometric safety.
• Annex 75 - notice and request formats before CNBV.
• The transitional articles of the amending resolution.

A hyperlink to the official DOF publication is not included because they have no verified access to the exact URL at the time of this article's publication. It's recommended to have an official text directly at dof.gob.mx.