Mexico’s New KYC for Mobile Line Guidelines Explored - 2026 Guide

On December 9, 2025, Mexico's Telecommunications Regulatory Commission (CRT) published the Lineamientos para la Identificación de Líneas Telefónicas Móviles in the Diario Oficial de la Federación (DOF). These guidelines establish mandatory Know Your Customer (KYC) obligations for all mobile network operators (MNOs) and mobile virtual network operators (MVNOs) operating in Mexico.

The regulations stem from Article 104 of the 2025 Telecommunications and Broadcasting Law, which requires operators to activate and maintain mobile services only for lines associated with verified users. The Guidelines took effect immediately upon publication, with the registration window opening January 9, 2026, and a hard compliance deadline of June 30, 2026.

For operators, these Guidelines represent a fundamental shift in how mobile services are managed. The requirements cover everything from identity validation procedures to data protection obligations, with tight implementation deadlines and clear penalties for non-compliance.

This guide breaks down what telecom operators need to do, when they need to do it, how to meet the requirements effectively, and provides a solution to streamline the compliance.

What are Mexico's new mobile line KYC requirements for operators?

Mexico's new mobile line KYC requirements of mandatory registration aim to eliminate the anonymity that has facilitated criminal activities such as extortion, fraud, or identity theft conducted through mobile networks.

For telecom operators, the Mexican CRT Guidelines introduce five important compliance obligations:

1. Enable service only for linked lines

Operators must make sure that all mobile telephone lines (whether prepaid or postpaid, physical SIM or eSIM) are linked to a verified Titular (account holder) before activation.

Lines that are not properly linked to an identified individual or legal entity cannot be turned on or kept active. This requirement brings the identity verification practices used for postpaid contracts to all mobile services, including the prepaid market.

New lines activated after January 9, 2026, cannot be enabled until identity validation is done.

2. Validate identity through government databases (RENAPO, SAT)

Identity validation must be done through official government sources.

• For individuals, operators must verify the Clave Única de Registro de Población (CURP) by checking with the Registro Nacional de Población (RENAPO).
• For legal entities, the Registro Federal de Contribuyentes (RFC) must be validated through the Servicio de Administración Tributaria (SAT).

This automated process makes sure that the identity information given during registration matches official government records, creating a standard verification method across all operators. Validation requirements include:

• Identity data must be checked against government databases when registration happens
• Mexican nationals and foreign residents must provide a valid CURP, which operators verify through RENAPO
• Companies must provide RFC, validated through SAT systems
• Non-residents provide passport information for validation
• Operators cannot approve registrations that fail the automated government database check
• Government databases are the final authority for identity confirmation

3. Establish inquiry and management platforms

The Guidelines require operators to set up two separate digital platforms within specific timeframes.

• Management Platform (The Plataforma de Gestión de Líneas Telefónicas Móviles): must be ready within 30 days of when the Guidelines take effect, letting users link and unlink mobile lines.
• Inquiry Platform (The Plataforma de Consulta de Líneas Telefónicas Móviles): must be deployed within 60 days, allowing users to see all lines registered under their identity.

These platforms must work both online and at physical service centers, and operators must tell the CRT the platform URLs once they are live.

4. Send weekly SMS notifications to unregistered users

During the implementation period, operators must actively reach out to users with unlinked lines. Weekly SMS notifications must go to unregistered numbers, telling users about the registration requirement, giving clear steps on how to complete the process, and warning about the service suspension deadline.

This notification requirement continues until the line is successfully linked or suspended, giving users enough time to comply before losing service.

5. Report security incidents within 24 hours to CRT

Operators are directly responsible for protecting customer data collected during registration. Any information security incident or personal data breach must be reported to the CRT and relevant authorities within 24 hours of detection. This fast reporting requirement allows for quick regulatory response to potential data problems and keeps things transparent when handling sensitive customer information.

The obligation fits with Mexico's Federal Law on Protection of Personal Data Held by Private Parties, putting telecommunications operators under close watch, given the amount and sensitivity of the data they will handle.

These five requirements form the foundation of Mexico's mobile line identification system, changing how operators manage customer relationships and moving the telecommunications sector toward a fully verified, traceable mobile network.

Who needs to register, and what are the deadlines?

The CRT Guidelines apply universally to all mobile line users in Mexico, regardless of service type or user category. The following groups must register their mobile lines:

• Individual users (Mexican nationals): All persons holding prepaid or postpaid mobile lines must link their numbers using their CURP and official photo identification
• Individual users (foreign residents): Temporary or permanent residents must register using their valid passport or temporary CURP for foreigners
• Individual users (tourists and visitors): Short-term visitors with Mexican mobile lines must register using their passports, though practical challenges remain for this group
• Legal entities (companies): Businesses must register corporate lines using the company's RFC, legal representative credentials, and documentation proving representative authority
• Existing line holders: All users with lines active before January 9, 2026, regardless of how long they have held the number
• New line purchasers: Anyone activating a new line (physical SIM or eSIM) on or after January 9, 2026

The registration window runs from January 9, 2026, to June 30, 2026. Users with existing lines have this full period to complete registration. Those activating new lines after January 9, 2026, must register within 30 days of activation.

Lines that remain unregistered after June 30, 2026, will be suspended starting July 1, 2026, with service limited to emergency calls only.

"Deploying two platforms in 30 and 60 days seemed impossible until we partnered with Signzy. Their pre-built integrations with RENAPO and SAT saved us months of development work. We launched on time and haven't looked back." — Chief Information Officer, Telecommunications Infrastructure Provider, Mexico.

How does the registration and deregistration process work?

The registration process requires operators to verify user identity and link mobile lines to verified individuals or legal entities. Users can complete registration through two channels:

1. In-person at operator service centers
2. Remotely through digital platforms

Both methods follow the same core validation requirements but differ in execution and verification steps. Below’s a detailed look.

Presential (in-person) and remote linking procedures

Channel #1. Presential (in-person) registration

1. User visits an operator service center with physical identification documents.
2. Operator staff reviews the ID and verifies that it is valid and matches the user.
3. Staff inputs the information into the validation system
4. System processes identity check through government databases in real time
5. If validation succeeds, the line is immediately linked
6. Confirmation folio is generated with date and time stamp
7. User receives printed confirmation document

Channel #2. Remote (online) registration

1. User accesses the operator's Plataforma de Gestión through the company website.
2. User uploads a clear photo or scan of an official identification document
3. User enters personal information (name, CURP or RFC, phone number)
4. User completes liveness verification step (real-time selfie with prompted actions)
5. The system performs automated validation against government databases
6. If successful, the user receives a digital confirmation folio. If unsuccessful, the user can retry (up to three attempts total)

Users have up to three attempts to complete online registration. If all three attempts fail (due to document quality issues, liveness verification problems, or validation mismatches), the user must complete registration in person at a service center.

Documentation requirements for different user types

• For Mexican nationals: Valid official photo identification containing CURP (voter ID/INE, passport, or national biometric ID document), CURP.
• For legal entities: Document showing the company's registered name and RFC, a valid official ID of the legal representative, and a document proving the representative's legal authority.
• For foreign nationals: Valid passport, temporary CURP for foreigners (if applicable).
• For minors: Lines must be registered to an adult Titular, as minors lack legal capacity to contract. The adult can register up to 10 lines total, which may include lines used by minors.

Registration limits and confirmation process

The Guidelines impose a maximum of 10 mobile lines per individual. This limit applies regardless of whether lines are prepaid or postpaid, and counts all lines across all operators. However, users who already held 10 or more postpaid lines before the Guidelines took effect are exempt from this restriction.

Legal entities face no line limits and may register as many lines as needed for business operations.

Once registration completes successfully, the system generates a confirmation folio. This folio contains:

• Unique registration number
• Date and time of registration
• Phone number linked
• Name of Titular
• Validation result confirmation

Users should save this folio as proof of registration. Operators must provide the folio immediately after successful linking, either as a printed document (for presential registration) or digital confirmation (for remote registration). The folio serves as evidence of compliance if any questions arise later.

Unlinking procedures

The Guidelines distinguish between two types of unlinking based on who initiates the process and their role. Both types can be done through the same channels as registration: in person at service centers or online through the management platform.

• Titular unlinking: When the Titular (account holder) requests unlinking, the line becomes fully disabled. The line loses all service except the ability to receive emergency alert messages, make calls to emergency numbers, and contact the operator's customer service system. This status continues until either the line reaches the end of its lifecycle or a new Titular links the line.
• Usuario unlinking: When a Usuario (end user) requests unlinking, only the Usuario's association with the line is removed. The line remains active and linked to the Titular. Service continues normally because the Titular link is still in place. This applies when, for example, a company employee returns a corporate phone, but the company retains the line for reassignment.

What happens with unregistered lines after the deadline?

Lines that remain unregistered after June 30, 2026, will be suspended starting July 1, 2026. Suspended lines can only make emergency calls and contact the operator's customer service. Standard voice, SMS, and data services are blocked until registration is completed.

Operators face CRT enforcement through:

• Random inspections without prior notice at operator facilities
• Verification visits during business hours to check compliance systems
• Mandatory cooperation requirements with CRT verification activities
• Revenue-based fines for non-compliance
• Mandatory corrective action plans
• Potential license implications for severe violations

How can operators protect customer data while meeting KYC mandates?

The CRT Guidelines require strict data protection to balance identification benefits against privacy risks. Operators handle sensitive information, including government IDs and validation results, creating significant responsibility for proper data handling aligned with Mexico's Federal Law on Protection of Personal Data.

Here are some of the key data protection requirements:

• No biometric storage: Operators cannot retain biometric data, selfies, facial templates, or ID document copies after validation completes. Data must be deleted immediately once validation succeeds or fails.
• No commercialization: Registration data cannot be sold, shared, used for marketing, customer profiling, or any commercial purpose beyond line identification and legal compliance obligations.
• Data minimization: Only five data fields allowed: name, CURP/RFC, phone number, validation source consulted, and validation result. No addresses, emails, birthdates, or demographic data permitted.
• Federal law compliance: Must implement technical and organizational security measures, conduct regular audits, maintain incident response procedures, and ensure third-party vendors meet equivalent standards.
• Privacy notices required: Clear notices must explain data collection, use, storage, and protection before users submit information. Must be provided at service centers and on-screen during remote registration.

How to implement the mobile line registration system?

Meeting Mexico's new mobile line KYC requirements means handling millions of identity verifications quickly and accurately while staying compliant with CRT Guidelines. This is where specialized technology solutions come in.

Signzy offers verification tools built for telecom operators dealing with regulatory compliance:

• One Touch KYC: This solution brings together identity verification, document validation, and liveness checks into one flow. Instead of managing separate systems for each step, operators can process registrations faster while meeting all the Guidelines' requirements. This matters when you're trying to register millions of users before the June deadline.
• CURP verification: Connects directly to RENAPO databases to verify Clave Única de Registro de Población in real time. For operators, this means instant validation for Mexican nationals and foreign residents without manual checks or delays that could create bottlenecks during high-volume registration periods.
• RFC verification: Handles Registro Federal de Contribuyentes validation through SAT database integration. This is particularly useful for operators managing corporate accounts where legal entities need to register multiple lines and provide legal representative credentials.

These tools help operators meet the 30-60 day platform deployment deadlines, handle the data minimization requirements (only storing name, CURP/RFC, phone number, and validation result), and process the registration volumes needed to reach compliance before July 1, 2026.

"We needed a solution that could handle 50,000 registrations daily without breaking. Signzy delivered that and more. The CURP verification accuracy is 90%+." — Chief Technology Officer, Major Mobile Network Operator, Mexico.

Book a demo with Signzy to explore how automated verification can help your team meet CRT compliance requirements efficiently.