Mexico’s new banking rules signal a new era for biometric identity verification

By Jesús Aragón, CEO and Co-founder of Identy.io

Opening a bank account today looks very different than it did a decade ago. Behind each transaction is a growing reliance on advanced identity verification technologies that help protect both customers and banks.

As AI-powered fraud becomes more sophisticated, financial institutions are under pressure to strengthen identity verification without adding friction for customers. AI-driven deepfake fraud is projected to increase 495 percent in 2026 compared to 2025, highlighting how quickly fraud techniques are evolving. Rather than isolated incidents, financial institutions are confronting a broader shift in which AI enables fraud to scale more rapidly, making it increasingly difficult for traditional authentication methods to keep pace.

In Mexico, that effort has taken the form of new requirements issued by the National Banking and Securities Commission (CNBV). On July 1, 2026, the agency published amendments to the General Provisions Applicable to Credit Institutions, expanding existing identity verification requirements to include facial biometrics alongside fingerprint verification for in-person banking transactions.

Previous regulations relied primarily on fingerprint verification for in-person identity confirmation. Under the new rules, financial institutions have 90 days to implement liveness verification methods while continuing to protect biometric information from being sold, shared or transferred to third parties. The amendments also require facial biometric verification to achieve a minimum 90 percent match against government identity records, strengthening identity authentication requirements across financial institutions.

The update reflects a trend across Latin America. Governments are placing greater emphasis on the use of biometrics, financial services are becoming more digital and fraud is growing more sophisticated. Organizations such as the FIDO Alliance were founded to help advance stronger authentication standards as identity threats continue to develop. Together, regulations and industry standards reinforce the importance of building identity verification systems that can adapt over time rather than simply satisfy today’s requirements.

For banks, complying with these requirements means implementing authentication systems that can verify the biometric sample is being presented by a real person. Fraud techniques will keep evolving, and platforms built only to satisfy the current rule risk falling behind.

Understanding liveness detection

Liveness detection is a process used to determine whether a biometric sample is coming from a person who is physically present during authentication, rather than from a photograph, recorded video or mask. This authentication method has become increasingly important as criminals adopt more advanced methods to bypass identity systems. Artificial intelligence has made it easier to create deepfakes or realistic synthetic media, and presentation attacks using printed photos, video replays and masks continue to undermine traditional facial recognition technologies.

Liveness detection analyzes characteristics that are not easy to replicate artificially, including natural facial movement, skin texture, depth and light reflection. If signs of manipulation are detected, the sign-in attempt can be rejected before access is granted.

For Mexico’s financial institutions, understanding these approaches is important as they race to comply with the CNBV’s updated identity verification requirements. While the regulation requires banks to incorporate facial biometrics into in-person authentication, implementation decisions will determine how effectively institutions can defend against advancing fraud techniques while maintaining an efficient customer experience. As generative AI continues to advance, liveness detection should be viewed as an evolving capability that must adapt to sophisticated attacks rather than a one-time implementation.

Recent evaluations, including the U.S. Department of Homeland Security’s Remote Identity Validation Rally (DHS RIVR), show that liveness detection has become increasingly effective against traditional presentation attacks. As those attacks become harder to execute, fraudsters are shifting toward injection attacks and synthetic identities that bypass the camera altogether, requiring identity verification technologies to address a new generation of threats.

Preparing for the next phase of biometric verification in banking

For financial institutions operating in Mexico, the immediate priority is meeting the CNBV’s 90-day implementation timeline. Deploying secure facial biometric solutions is only one part of that effort. Banks should also evaluate whether their authentication systems can effectively detect presentation attacks, resist sophisticated AI-generated fraud and provide a seamless experience for legitimate customers.

As identity verification expands across mobile applications, ATMs and online banking, organizations should consider how touchless biometric authentication will be managed consistently across every channel. With additional biometric modalities being adopted, maintaining interoperability and centralized identity management becomes increasingly important.

Automated biometric identification systems (ABIS) can help support this transition by centrally managing biometric identities, matching individuals across multiple channels and helping maintain a single, consistent identity record. Independent benchmarks, including the National Institute of Standards and Technology’s (NIST) Friction Ridge Image and Features Technology Evaluation (FRIF TE) demonstrate that modern fingerprint identification systems can achieve exceptionally high identification accuracy at operational scale, providing objective validation.

Once an identity has been securely established, financial institutions can also begin issuing reusable digital identities, such as verifiable credentials or BioCode QR codes, allowing customers to authenticate across future interactions without repeating the full enrollment process while maintaining security and privacy, as the verification can be done on device offline.

Complying with today’s regulations is only one part of building a resilient identity verification strategy. As biometric verification becomes more common across Latin America’s financial sector, liveness detection will play an important role in helping institutions distinguish genuine users from fraudulent attempts while supporting compliance with regulatory requirements. A resilient approach combines touchless biometric capture on trusted mobile devices, centralized identity management through ABIS to establish a trusted source of identity and reusable digital credentials that allow verified identities to be securely carried into future transactions. Organizations that invest in secure, privacy-conscious biometric infrastructure today will be better positioned as both threats and regulations continue to change.

About the author

Jesús Aragón is the CEO and Co-Founder of Identy.io, a deep-tech company pioneering on-device biometric authentication for secure, password-less digital identity. With Agnitio Voice ID, he was part of the founding of the FIDO Alliance to shape the global standards for strong, phishing-resistant authentication. He began his career at Hewlett-Packard and Texas Instruments before moving to Silicon Valley, where he held various executive positions. Jesús successfully went through an IPO with Audience Inc. and drove Agnitio’s acquisition by Cirrus Logic. With over two decades of experience in mobile innovation, cybersecurity, and M&A, he has established a global track record of scaling technology ventures. An entrepreneur at heart, Aragón continues to drive the future of digital identity and privacy-by-design innovation.

Article Topics

biometric authentication  |  biometric liveness detection  |  biometrics  |  financial services  |  identity verification  |  Identy  |  Mexico