The National Banking and Securities Commission (CNBV) updated the provisions applicable to the monitoring of identities in some banking operations. The reform incorporates new possibilities for using face biometrics and lays down technical, operational and safety requirements that institutions have to consider in their identification processes.
published in the Official Journal of the Federation (DOF) on 1 July 2026, the resolution amends a number of Articles of the General Provisions applicable to credit institutions, known as the Unique Circular of Banks (CUB) and incorporates a new version of Annex 71.
One of the most important issues is the transitional period of 90 business days to make the corresponding adjustmentsas from the entry into force of the resolution.
For banking institutions, change represents an opportunity to review their identification mechanisms, evaluate the safety of their biometric processes and strengthen how they check their customers' identities.
What happened with facial biometrics of CNBV 2026?
Identity checks are an important component of banking operations and allow them to put in place controls to identify persons performing specific transactions, reduce risks of undercutting and strengthen financial service security.
With the reform published on 1 July 2026, CNBV It updated the provisions related to the use of biometric information and expressly incorporates new facial verification options with respect to the considerations referred to by the Regulation.
A number of provisions previously focused mainly on the use of fingerprints. The upgrade expands technological alternatives and lays down conditions for facial information.
Nevertheless, Reforms do not mean that all banks are obliged to replace fingerprint with facial recognitionInstitutions should identify what provisions are applicable and what mechanisms they can use under their authorized operations and procedures.
The main changes are focused on three issues:
- Biometric monitoring: introduction of new possibilities for using facial information in regulated identification procedures.
- Biometric bases of their own: setting up conditions for shaping, using and protecting biometric client records.
- Security and technical requirements: update of Annex 71 with monitoring related to capture, biometric comparison, prevention of suplanting, infrastructure and information protection.
The reform amends Articles 51 Bis, 51 Bis 2, 51 Bis 3, 51 Bis 4 and 51 Bis 5 as well as Annex 71.
The scope of these measures should be interpreted as applicable to credit institutions and not as a general and indistinct obligation for all financial and technological enterprises in the country.
Time line CNBV 2026: dates and deadlines for implementation
The publication of the reform lays down different moments that the institutions have to distinguish to plan their suitability.
The same obligation should be met with respect to the entry into force of the Regulation and with some dependent on biometric bases or some procedures.
1 July 2026: published in the Official Journal
The resolution is officially published and includes amendments to the Unified Circular of Banks.
Following this publication, institutions can identify amended provisions, review their current processes and determine what technical, documentary and operational adjustments they require.
2 July 2026: entry into force
The resolution enters into force the day after its publication.
That date forms the reference point for computing the transitional deadlines set out in the document.
Since that date, the institutions have to consider the new provisions and appropriate conditions of adequacy.
August 2026: notice period for pre-existing biometric bases
The resolution lays down a transitional period of 30 calendar days for those institutions that have biometric bases in regulated situations.
That period corresponds to the submission of an applicable notice to the CNBV and should be distinguished from the general period of adequacy.
The institutions currently in this situation have to verify that the information referred to above has been submitted and have been required to have the necessary documentation.
October 2026: final stage of review and adequacy
During October, the institutions undergoing reform have to pay special attention to their status of suitability, considering the close end of the general deadline.
At this stage it is important to check that mechanisms for capture, biometric comparison, safety and documentation meet applicable requirements.
It was also important to identify potential deviations, assign responsibility and document measures undertaken.
General deadline: 90 working days
The transitional procedure lays down a maximum period of 90 working days from the date of entry into force for the intended adjustments.
The computation should consider the incompetent days applicable to the CNBVThe exact date of expiry should therefore be verified with the appropriate official schedule and should not be calculated from Monday to Friday only.
That period should not be confused with the specific warnings for biometric bases.
The main recommendation for the institutions is to avoid waiting at an end to check their level of readiness. The implementation of biometric controls can involve infrastructure adjustments, operating procedures, safety tests and regulatory documentation.
What lays down in Annex 71 to CNBV about facial biometrics?
One of the most important components of the reform is an update to Annex 71, which lays down technical specifications related to biometric monitoring mechanisms.
Its importance lies with the fact that using facial recognition does not depend only on an algorithm capable of comparing images.
It also requires capture conditions, controls to prevent supelling, quality mechanisms and information protection measures.
Capture and quality of face image
The quality of biometric information directly affects the reliability of comparison processes.
Thus, Annex 71 includes specifications for first face capture, including image characteristics, light conditions, face position and quality controls.
The intended parameters include the front capture of two dimensional color images and resolution requirements as a minimum distance of 90 pixels between the eyes at established locations.
Automatic mechanisms for evaluating capture quality are also envisaged.
These controls reduce problems associated with incomplete images, inappropriate lighting conditions or catches that do not have the necessary biometric processing characteristics.
It is important to distinguish first capture requirements from those applicable to subsequent authentication as they are not necessarily identical.
Liveness detection and Suplantation Prevention
A facial photo can provide useful information to conduct a biometric comparison, but monitoring systems should also consider suplanting attempts.
The scenarios that can affect these processes include the presentation of photographs, videos, masks and other means used to attempt to mislead a biometric system.
The Liveness detection, also known as liveness detection, allows to evaluate signs related to a person's genuine presence during capture.
Annex 71 incorporates requirements for monitoring mechanisms and reference to technical evaluations, including ISO/ IEC 30107-3, as appropriate.
Those mechanisms are part of a biometric safety strategy and have to be assessed under the required technical conditions.
Biometric Comparison 1:1 and duplication 1: N
Regulation also makes it important to distinguish two biometric operations that have different functions.
Comparison 1:1: allows us to evaluate whether the face caught corresponds to a biometric reference determined, as a photo associated with a previously registered identity.
Identification or duplication 1: N: allows to compare a capture against multiple searches within a biometric base to identify potential coincidences.
Comparison 1:1 is useful for verification or authentication processes while duplication 1: N allows for the detection of potential duplication or misassociation within a base.
Annex 71 lays down specific requirements related to these capabilities and the institutions have to determine which are applicable to their processes.
Security and protection of biometric information
The implementation of biometric technologies also requires protecting information that is captured, processed and stored.
Annex 71 lays down safety checks related to:
- Filling of information stored and transmitted.
- Restriction of access to authorized personnel.
- Retirement of information and monitoring of infrastructure.
- Secure system and equipment configuration.
- Assessment of vulnerabilities and safety tests.
- Protection from unauthorized extraction or copies.
- Integrity, conservation and secure disposal of information.
These requirements show that biometric safety does not depend exclusively on the accuracy of face recognitionbut also of the infrastructure, procedures and controls that support its functioning.
Bank identity check: how face biometrics are complemented, OCR and official consultations
Identity checks can be strengthened by combining different technological mechanisms that allow an individual's information to be tested from different sources.
In this context, face biometrics, liveness detection, optical character recognition (OCR) and document validation and official consultations have complementary functions.
Their integration allows them to build processes that are not dependent only on an image or a data stated by the user.
Facial biometrics and liveness detection: check person
Facial biometrics allow analysis of face characteristics to make a comparison with a reference, such as photo contained in an official identification.
When undergoing a liveness detection, the process can also evaluate genuine presence signs during capture.
In JAAKthese capabilities are integrated to compare a person's face with his or her identification image while evaluating signs related to the authenticity of the capture.
That means strengthening the verification that the person involved in the proceedings corresponds to his or her documentary identity.
Technology OCR: Extracting and processing documentary information
The optical character recognition, known as OCR, allows to automatically extract visible information from an identification.
Instead of relying exclusively on manual capture, this technology facilitates the processing of fields contained in the document.
JAAK use OCR to extract information from the identification and allow its subsequent contrast with other verification elements.
Automated extraction also helps to identify inconsistencies between visible data and information from other sources.
Validation of the QR code from INE: to check document information
Voting credentials may include information elements that allow for additional checks.
JAAK have the capacity to consult information associated with the QR code of INE and contrasting with visible data and data extracted by OCR.
That mechanism allows us to check the consistency between different representations of documentary information, depending on the credential model and available service capabilities.
Thus, QR validation complements an identification reading and contributes to detecting potential inconsistencies in its data.
Consultation with official sources: INE and RENAPO
Another component of an identity check includes contrasting information with official sources.
JAAK includes consultation services as INE and RENAPOenabling additional checks of identity data to be performed, as required and with the scope of each consultation.
These verifications complement the results of facial biometrics and documentary processing.
It is important to distinguish information about documentary or registry information from a biometric comparison conducted directly against an official basis. Each mechanism should be evaluated according to the type of information consulted and the regulatory requirement to be met.
A comprehensive monitoring process
When these technologies are used in a complementary way, different signals can be tested within a single process:
- The person: with face biometrics and liveness detection.
- The document: by capture and reading OCR and analysis of his information.
- Documentary consistency: with validation of elements as the QR code INE.
- Official information: through consultation with services such as INE and RENAPO.
That approach helps to strengthen confidence in verified identity, detect inconsistencies and support identification decisions within digital processes.
The combination of controls does not remove all risks or replace the particular obligations of each institution but allows a more complete monitoring architecture to be established than an isolated use of a single mechanism.
The biometric bases of their own: what banks can do and what restrictions they have to consider
The reform also lays down conditions for credit institutions to form and use biometric bases proper to their clients, as required by the regulations.
Those bases allow biometric references to be retained for subsequent verification or authentication processes, as long as the necessary technical, operational and safety requirements are met.
Biometric rolling and later authentication
The biometric encoding consists of capturing and registering biometric information from a person to associate with a particular identity.
During this procedure, the institution should implement the applicable capture, monitoring and safety checks.
The information registered can then be used as a reference to conduct authentication processes, in accordance with authorized mechanisms and related provisions.
The quality of initial encoding is particularly important as an incorrect biometric or misassociated reference may compromise subsequent checks.
Can biometric bases be shared among institutions?
The opportunity to form its own biometric bases does not mean that institutions can freely share or market their customers' information.
The Regulation lays down restrictions on the exchange, transfer and re-use of biometric bases for regulated verification procedures.
Each institution should therefore carefully evaluate how information was administered and how third parties were involved and what conditions were allowed for its use.
What happens when a technological supplier is hired?
Institutions can rely on specialized providers to implement technological components of their identity monitoring processes, considering the provisions applicable to the recruitment of third parties.
Nevertheless, the institution's regulatory responsibilities are not removed from its external technologies.
It is necessary to evaluate the capabilities of the supplier, information protection mechanisms, contractual terms and technical evidence to prove how the controls have been operated.
Checklist CNBV 2026: What should banking institutions do to get ready?
Filling with new biometric requirements requires co-ordination between compliance, technology, information security, operations, law and risks.
Although specific actions will depend on the processes of each institution, there are seven priority activities enabling an integrated review.
1. To identify operations subject to new requirements
The first step is to determine which operations, channels and identification procedures are within the scope of the amended provisions.
That review lays down what obligations are applicable and prevents technological changes that do not meet a specific regulatory need.
2. To evaluate existing biometric mechanisms
Institutions should review their current biometric capture and comparison mechanisms.
It was important to identify what technologies they used, what their conditions of operation were and whether they had the necessary skills to meet the corresponding requirements of Annex 71.
3. Review capture quality and enforcement
The registration and authentication processes have to be evaluated with reference to applicable technical parameters.
That includes revising the quality of images, capture controls, mechanisms against presentation attacks and required technical evaluations.
4. Validate document and official consultation processes
Institutions should identify how they verify information about their identities and what mechanisms they use to contrast with official sources.
That review may include documentary reading, OCRmonitoring and consultation with authorities as required.
It should also be established that the type of consultation undertaken corresponds to the specific regulatory requirement to be met.
5. To strengthen biometric information security
The technological architecture, encryption, access management, information segregation and biometric protection mechanisms have to be reviewed.
The safety checks and technical tests provided for by applicable provisions should also be evaluated.
6. Review notices, authorizations and documentation
Institutions have to check if their processes require warnings to the CNBVspecific authorisations or additional documentation.
They should also check compliance with their deadlines, especially when using their own biometric bases or alternative procedures.
7. To conduct and preserve evidence
The implementation should be accompanied by documentation to confirm the controls and results of the evaluations undertaken.
The relevant evidence includes operational procedures, test results, infrastructure documentation, safety checks and constancy of applicable regulatory procedures.
Preparation does not end with the introduction of biometric technologies. It also requires showing that processes work under the necessary technical, operational and safety conditions.
How does that help? JAAK To strengthen an identity check process?
The development of digital identity requirements in the financial sector makes it increasingly important to have mechanisms that will allow people to be checked, their documents analysed and information contrasted with reliable sources.
In JAAK We develop an identity check technology that integrates different controls into a single process.
Nuestras capacidades incluyen:
- Facial biology: Comparison of face captured with photo of information submitted.
- Liveness detection: an assessment of genuine presence signs to strengthen controls with respect to suplanting attempts.
- Technology OCR: automated collection of information contained in official identifications.
- Validation of the QR code from INE: consultation and contrast of documentary information with visible and extracted data OCR.
- Consultation with official sources: information monitoring through services such as INE and RENAPO, according to available integrations.
The combination of these capabilities allows organisations to build monitoring processes that relate to the person, his or her identification and information consulted from official sources.
To financial institutions currently evaluating their identification mechanisms as a result of regulatory changes CNBVthis approach allows to analyse different layers of verification within an integrated technological architecture.
The conformity with Annex 71 should be assessed in accordance with the particular requirements of each institution and with the technical capabilities effectively implemented.
In JAAK We assist organisations to strengthen their digital identity processes through technologies that combine biometric monitoring, documentary and official consultations.
FAQ about facial biometrics and CNBV 2026
The CNBV forcing all banks to use facial recognition?
No. The reform incorporates new possibilities for using facial biometric information in specific identity checks.
Institutions should evaluate their applicable provisions and mechanisms for each operation.
The update should not be interpreted as a general obligation to replace all verifications with fingerprint with facial recognition.
When does the 90 working day period of CNBV?
The decision lays down a maximum period of 90 working days after its entry into force on 2 July 2026 to complete the necessary adjustments.
The exact date should be determined by considering the schedule of inoperative days applicable to CNBV.
What's Annex 71 about facial biometrics?
Annex 71 lays down technical requirements related to the capture, quality, comparison and protection of biometric information.
It also includes supple prevention mechanisms, security controls and specifications for some registration and authentication processes.
What's the difference between facial recognition and liveness detection?
Facial recognition allows to compare face characteristics with biometric reference.
The liveness detection evaluates signs related to a person's genuine presence during capture.
Both mechanisms can be used in a complementary manner to strengthen identity monitoring processes.
Is it necessary to consult INE To check his identity?
The obligation depends on the operation and the applicable regulatory procedure.
The provisions cover monitoring mechanisms with competent authorities' registries.
Thus, institutions should identify what consultations and procedures fall within their operations and the technical and authorisation requirements associated with them.
What requirements should meet their own biometric bases?
Institutions that form their own biometric bases have to cover applicable provisions with respect to registration, verification, security, information management and regulatory notices.
They should also consider restrictions on using and transferring biometric information.
Can banks hire outside providers to verify identities?
They can be supported by specialized technological providers, as long as recruitment and services meet applicable provisions.
The institution should evaluate the controls, skills and responsibilities associated with the contracted service.
How do they complement OCRface biometrics and official consultations?
Each technology allows an analysis of a different component of an identity.
Facial biometrics compare face characteristics; liveness detection evaluates genuine presence signs; OCR It removes documentary information and official consultations make it possible to check some data with officials' records.
When these mechanisms are integrated, organisations can identify inconsistencies and strengthen the reliability of their verification processes.
Conclusion: from regulatory adequacy to more reliable identity processes
The reform published by CNBV 1 July 2026 represents an important update to the identity monitoring mechanisms used in certain banking operations.
The introduction of new facial biometrics and the update of Annex 71 reveal the importance of evaluating not only the technologies used but also the capture conditions, anti-beaming controls, information security and procedure documentation.
With a transitional 90-day period, institutions have to review their applicable obligations and identify potential gaps and ensure that their processes have appropriate controls.
The combination of facial biometrics, liveness detections, documentary validation and consultations with official sources allows for a strengthening of identity checks through a number of complementary signs.
Because to verify an identity isn't just to recognize a face but to build confidence about the person, his document and information that supports his or her identity.
In JAAK We develop technological solutions to help organisations build safer, more reliable and more responsive digital identity processes to their operational needs.
Know how JAAK can strengthen your identity check processes
Official sources
Official Journal of Federation. Resolution amending general provisions applicable to credit institutions, published 1 July 2026.
https://sidof.segob.gob.mx/notas/5792307
National Banking and Securities Commission. General provisions applicable to credit institutions, Articles 51 Bis to 51 Bes 5 and Annex 71 as published.
The content describes the general scope of the reform and does not replace the legal appraisal of each institution.