Mexico Mobile Line Registration: CURP KYC Rules and 2026 Deadlines

On December 9, 2025, Mexico's Telecommunications Regulatory Commission (CRT) published the Lineamientos para la Identificación de Líneas Telefónicas Móviles in the Diario Oficial de la Federación (DOF). These guidelines establish mandatory Know Your Customer (KYC) obligations for all mobile network operators (MNOs) and mobile virtual network operators (MVNOs) operating in Mexico.

The rules implement the identification duty in Mexico's 2025 Telecommunications and Broadcasting Law, which allows operators to provide mobile service only on lines associated with an identified holder. The linking process began in January 2026. A modification published in 2026 replaced the original June 30, 2026 deadline with a staggered schedule based on the last digit of each number, running from August 15 to December 31, 2026.

This framework is different from PANAUT, the biometric mobile user registry that Mexico's Supreme Court struck down in 2022. There is no central biometric database, and operators may not keep biometric data, photos, or ID copies on their platforms.

For operators, these Guidelines represent a fundamental shift in how mobile services are managed. The requirements cover everything from identity validation procedures to data protection obligations, with tight implementation deadlines and clear penalties for non-compliance.

This guide breaks down what telecom operators need to do, when they need to do it, how to meet the requirements effectively, and provides a solution to streamline the compliance.

Related Solutions

One Touch KYCMexico CURP Verification APIMexico RFC Fetch API

What are Mexico's new mobile line KYC requirements for operators?

Mexico's new mobile line KYC requirements of mandatory registration aim to eliminate the anonymity that has facilitated criminal activities such as extortion, fraud, or identity theft conducted through mobile networks.

For telecom operators, the Mexican CRT Guidelines introduce five important compliance obligations:

1. Enable service only for linked lines

Operators must make sure that all mobile telephone lines (whether prepaid or postpaid, physical SIM or eSIM) are linked to a verified Titular (account holder) before activation.

Lines that are not properly linked to an identified individual or legal entity cannot be turned on or kept active. This requirement brings the identity verification practices used for postpaid contracts to all mobile services, including the prepaid market.

New lines activated after January 9, 2026, cannot be enabled until identity validation is done.

2. Validate identity through government databases (RENAPO, SAT)

Identity validation must be done through official government sources.

• For individuals, operators must verify the Clave Única de Registro de Población (CURP) by checking with the Registro Nacional de Población (RENAPO).
• For legal entities, the Registro Federal de Contribuyentes (RFC) must be validated through the Servicio de Administración Tributaria (SAT).

This automated process makes sure that the identity information given during registration matches official government records, creating a standard verification method across all operators. Validation requirements include:

• Identity data must be checked against government databases when registration happens
• Mexican nationals and foreign residents must provide a valid CURP, which operators verify through RENAPO
• Companies must provide RFC, validated through SAT systems
• Foreign nationals can identify with a passport, a CURP for foreigners, or an INM visitor or resident card that contains a CURP
• Operators cannot approve registrations that fail the automated government database check
• Government databases are the final authority for identity confirmation

3. Establish inquiry and management platforms

The Guidelines require operators to set up two separate digital platforms within specific timeframes.

• Management Platform (The Plataforma de Gestión de Líneas Telefónicas Móviles): must be ready within 30 days of when the Guidelines take effect, letting users link and unlink mobile lines.
• Inquiry Platform (The Plataforma de Consulta de Líneas Telefónicas Móviles): must be deployed within 60 days, allowing users to see all lines registered under their identity.

These platforms must work both online and at physical service centers, and operators must tell the CRT the platform URLs once they are live.

4. Send weekly SMS notifications to unregistered users

During the implementation period, operators must actively reach out to users with unlinked lines. Weekly SMS notifications must go to unregistered numbers, telling users about the registration requirement, giving clear steps on how to complete the process, and warning about the service suspension deadline.

This notification requirement continues until the line is successfully linked or suspended, giving users enough time to comply before losing service.

5. Report security incidents within 24 hours to CRT

Operators are directly responsible for protecting customer data collected during registration. Any information security incident or personal data breach must be reported to the CRT and relevant authorities within 24 hours of detection. This fast reporting requirement allows for quick regulatory response to potential data problems and keeps things transparent when handling sensitive customer information.

The obligation fits with Mexico's Federal Law on Protection of Personal Data Held by Private Parties, putting telecommunications operators under close watch, given the amount and sensitivity of the data they will handle.

These five requirements form the foundation of Mexico's mobile line identification system, changing how operators manage customer relationships and moving the telecommunications sector toward a fully verified, traceable mobile network.

Who needs to register, and what are the deadlines?

The CRT Guidelines apply universally to all mobile line users in Mexico, regardless of service type or user category. The following groups must register their mobile lines:

• Individual users (Mexican nationals): All persons holding prepaid or postpaid mobile lines must link their numbers using their CURP and official photo identification
• Individual users (foreign residents): Temporary or permanent residents can register with a passport, a CURP for foreigners, or an INM resident card that contains a CURP
• Individual users (tourists and visitors): Short-term visitors with Mexican lines can register with their passport, one of the identification options recognized in the 2026 modification
• Legal entities (companies): Businesses must register corporate lines using the company's RFC, legal representative credentials, and documentation proving representative authority
• Existing line holders: All users with lines active before January 9, 2026, regardless of how long they have held the number
• New line purchasers: Anyone activating a new line (physical SIM or eSIM) on or after January 9, 2026

Linking began in January 2026, and new lines can't be activated until they are linked. For lines that are still unlinked, the 2026 modification sets these deadlines by the last digit of the phone number:

After a line's deadline passes, the operator sends an SMS warning and must disable the line within the following 72 hours. Linking the line afterwards restores service.

How does the registration and deregistration process work?

The registration process requires operators to verify user identity and link mobile lines to verified individuals or legal entities. Users can complete registration through two channels:

1. In-person at operator service centers
2. Remotely through digital platforms

Both methods follow the same core validation requirements but differ in execution and verification steps. Below’s a detailed look.

The CRT's Registra tu línea portal sends users to their operator's platform. Registration itself is done with the operator and is free.

Presential (in-person) and remote linking procedures

Channel #1. Presential (in-person) registration

1. User visits an operator service center with physical identification documents.
2. Operator staff reviews the ID and verifies that it is valid and matches the user.
3. Staff inputs the information into the validation system
4. System processes identity check through government databases in real time
5. If validation succeeds, the line is immediately linked
6. Confirmation folio is generated with date and time stamp
7. User receives printed confirmation document

Channel #2. Remote (online) registration

1. User accesses the operator's Plataforma de Gestión through the company website.
2. User uploads a clear photo or scan of an official identification document
3. User enters personal information (name, CURP or RFC, phone number)
4. User completes liveness verification step (real-time selfie with prompted actions)
5. The system performs automated validation against government databases
6. If successful, the user receives a digital confirmation folio. If unsuccessful, the user can retry (up to three attempts total)

Users have up to three attempts to complete online registration. If all three attempts fail (due to document quality issues, liveness verification problems, or validation mismatches), the user must complete registration in person at a service center.

Documentation requirements for different user types

• For Mexican nationals: Valid official photo identification containing CURP (voter ID/INE, passport, or national biometric ID document), CURP.
• For legal entities: Document showing the company's registered name and RFC, a valid official ID of the legal representative, and a document proving the representative's legal authority.
• For foreign nationals: Valid passport, temporary CURP for foreigners (if applicable).
• For minors: Lines must be registered to an adult Titular, as minors lack legal capacity to contract. The adult can register up to 10 lines total, which may include lines used by minors.

Registration limits and confirmation process

The Guidelines impose a maximum of 10 mobile lines per individual. This limit applies regardless of whether lines are prepaid or postpaid, and counts all lines across all operators. However, users who already held 10 or more postpaid lines before the Guidelines took effect are exempt from this restriction.

Legal entities, and individuals with business activity who provide a tax-status certificate, are not subject to the 10-line limit.

Once registration completes successfully, the system generates a confirmation folio. This folio contains:

• Unique registration number
• Date and time of registration
• Phone number linked
• Name of Titular
• Validation result confirmation

Users should save this folio as proof of registration. Operators must provide the folio immediately after successful linking, either as a printed document (for presential registration) or digital confirmation (for remote registration). The folio serves as evidence of compliance if any questions arise later.

Unlinking procedures

The Guidelines distinguish between two types of unlinking based on who initiates the process and their role. Both types can be done through the same channels as registration: in person at service centers or online through the management platform.

• Titular unlinking: When the Titular (account holder) requests unlinking, the line becomes fully disabled. The line loses all service except the ability to receive emergency alert messages, make calls to emergency numbers, and contact the operator's customer service system. This status continues until either the line reaches the end of its lifecycle or a new Titular links the line.
• Usuario unlinking: When a Usuario (end user) requests unlinking, only the Usuario's association with the line is removed. The line remains active and linked to the Titular. Service continues normally because the Titular link is still in place. This applies when, for example, a company employee returns a corporate phone, but the company retains the line for reassignment.

What happens with unregistered lines after the deadline?

Unlinked lines are disabled within 72 hours of the deadline for their last digit. A disabled line can still call emergency number 911, citizen-service numbers 079 and 089, and the operator, and it still receives earthquake alerts. Ordinary calls, SMS, data, and top-ups are blocked until the line is linked.

Operators face CRT enforcement through:

• Random inspections without prior notice at operator facilities
• Verification visits during business hours to check compliance systems
• Mandatory cooperation requirements with CRT verification activities
• Revenue-based fines for non-compliance
• Mandatory corrective action plans
• Potential license implications for severe violations

How can operators protect customer data while meeting KYC mandates?

The CRT Guidelines require strict data protection to balance identification benefits against privacy risks. Operators handle sensitive information, including government IDs and validation results, creating significant responsibility for proper data handling aligned with Mexico's Federal Law on Protection of Personal Data.

Here are some of the key data protection requirements:

• No biometric storage: Operators cannot retain biometric data, selfies, facial templates, or ID document copies after validation completes. Data must be deleted immediately once validation succeeds or fails.
• No commercialization: Registration data cannot be sold, shared, used for marketing, customer profiling, or any commercial purpose beyond line identification and legal compliance obligations.
• Data minimization: Operators record only what the rules allow: the holder's name, CURP or RFC (or, for foreigners, country of origin and passport number or foreign CURP), the linked phone number, the validation source consulted, and the result.
• Federal law compliance: Must implement technical and organizational security measures, conduct regular audits, maintain incident response procedures, and ensure third-party vendors meet equivalent standards.
• Privacy notices required: Clear notices must explain data collection, use, storage, and protection before users submit information. Must be provided at service centers and on-screen during remote registration.

How to implement the mobile line registration system?

Meeting Mexico's new mobile line KYC requirements means handling millions of identity verifications quickly and accurately while staying compliant with CRT Guidelines. This is where specialized technology solutions come in.

Signzy offers verification tools built for telecom operators dealing with regulatory compliance:

• One Touch KYC: brings identity verification, document validation, and liveness checks into one flow, so operators can process remote registrations without stitching together separate systems.
• CURP verification: Connects directly to RENAPO databases to verify Clave Única de Registro de Población in real time. For operators, this means instant validation for Mexican nationals and foreign residents without manual checks or delays that could create bottlenecks during high-volume registration periods.
• RFC verification: Handles Registro Federal de Contribuyentes validation through SAT database integration. This is particularly useful for operators managing corporate accounts where legal entities need to register multiple lines and provide legal representative credentials.

These tools help operators meet the data minimization requirements, keep validation evidence for CRT inspections, and handle high registration volumes as the final deadlines in October, November, and December 2026 approach.

Book a demo with Signzy to explore how automated verification can help your team meet CRT compliance requirements efficiently.