Resolution modifying the General Provisions applicable to credit institutions (biometrics)

If the document is presented incomplete on the right margin, it is because it contains tables that exceed the default width. If this is the case, click here to view it correctly.

DOF: 01/07/2026

RESOLUTION that modifies the General Provisions applicable to credit institutions (biometrics)

At the margin, a seal with the National Coat of Arms, which says: United Mexican States.- Treasury.- Ministry of Finance and Public Credit.- National Banking and Securities Commission.

The National Banking and Securities Commission, based on the provisions of articles 52, eighth paragraph and 98 Bis of the Credit Institutions Law, as well as 4, fractions II, XXXVI and XXXVIII and 16, fraction I of the National Banking and Securities Commission Law, and

CONSIDERING

That, the Credit Institutions Law confers upon the National Banking and Securities Commission the authority to issue general provisions, with the purpose of establishing clear, simplified and homogenized guidelines that allow credit institutions to integrate files and carry out customer identification and authentication processes efficiently, ensuring the adequate obtaining of information and documentation necessary for the celebration and follow-up of financial operations and services, in accordance with best regulatory practices;

That, in the context of in-person operations, Article 51 Bis in relation to Article 51 Bis 4 of the General Provisions applicable to credit institutions establishes that credit institutions must verify online that the fingerprint of the natural person presenting the voter ID card, passport or consular registration coincides, at least, by ninety percent with the records of the National Electoral Institute and the Ministry of Foreign Affairs, Mexican tax authority or federal agency that provides an information verification service. However, the current regulation does not contemplate verification by facial biometrics, despite the fact that Article 310, fraction IV, of the aforementioned Provisions already provides for the use of biometric data as authentication mechanisms, and

That, as a result of the above, it is necessary that the Provisions expressly contemplate the possibility of using biometric information that allows for the reliable identification of users, provided that the institutions verify the coincidence of said information with the records of the National Electoral Institute, the Ministry of Foreign Affairs or another Mexican tax authority or federal agency that provides a similar verification service, measures with which certainty, security, and reliability of the authentication processes will be given, promoting the stability of the financial system for the benefit of the general public; has resolved to issue the following:

RESOLUTION THAT MODIFIES THE GENERAL PROVISIONS APPLICABLE TO CREDIT INSTITUTIONS

SINGLE.- Articles 51 Bis, first paragraph, fraction I, subitems a), second paragraph, b), second paragraph and c), second paragraph; 51 Bis 2; 51 Bis 3; 51 Bis 4, first paragraph, fractions I, subitem b), first and second paragraphs, II, first paragraph, subitem b), first and second paragraphs, and V, first, second and third paragraphs; 51 Bis 5; and Annex 71 of the General Provisions applicable to credit institutions, published in the Official Gazette of the Federation on December 2, 2005 and modified by resolutions published in said dissemination organ, are REFORMED and SUBSTITUTED, to read as follows:

" Article 51 Bis.- Institutions shall require natural persons who in person request the celebration of passive operations related to Level 4 Bank Accounts, or active operations, services or payment means related to Level 3 and 4 Bank Accounts, when such accounts are opened in the Institution itself or in another, and such operations may be carried out for their own account or on behalf and in the name of third parties, to provide the following regarding the person presenting themselves and, where applicable, the person they represent:

I.

. . .

a)

. . .

Institutions shall carry out the verification actions referred to in Article 51 Bis 4, fraction I of these provisions regarding the person presenting themselves. In the case where the operation is carried out by a representative, the biometric data of the represented person will not be verified online.

b)

. . .

Institutions shall carry out the verification actions referred to in Article 51 Bis 4, fraction II of these provisions regarding the person presenting themselves. In the case where the operation is carried out by a representative, the biometric data of the represented person will not be verified online.

c)

. . .

Institutions shall carry out the verification actions referred to in Article 51 Bis 4, fraction V of these provisions regarding the person presenting themselves. In the case where the operation is carried out by a representative, the biometric data of the represented person will not be verified online.

. . .

. . .

. . .

II. to IV. . . .

. . .

. . .

. . .

. . .

. . .

. . . "

" Article 51 Bis 2.- Institutions, in substitution of what is required by Articles 51 Bis and 51 Bis 1 of these provisions regarding identity verification, may form a database of biometric information of their customers, observing the technical requirements provided in Annex 71 of these provisions, in order to use it for the verification of the identity of their customers in the celebration of contracts to carry out passive operations related to Level 4 Bank Accounts; active or service operations, or in the request for payment means, related to Level 3 and 4 Bank Accounts, when such accounts are opened in the Institution itself or in another, as well as for making cash withdrawals and transfers of funds charged to Level 4 Bank Accounts, provided that they give notice and attach the information requested in the corresponding format of Annex 75 to the Commission, no later than within 20 business days following the date on which they begin operations in the matter of identity verification using the biometric information database.

The foregoing, provided that Institutions carry out, for the integration of said database, the verification of the coincidence of the customer's biometric information with the biometric records of the National Electoral Institute, the Ministry of Foreign Affairs, the Mexican tax authority or another federal agency, which provides a biometric information verification service. Likewise, institutions must have documentary evidence of the safeguarding of the verification of the coincidence carried out between the customer's biometric information with the records of any of the agencies referred to in this paragraph.

Institutions, for the purposes of verifying the identity of their customers, when forming their own biometric information database, must adhere to the following:

I.

Require the natural person whose data will be stored in the aforementioned database, their valid voter ID card issued by the National Electoral Institute in the country or through the consular offices of the Ministry of Foreign Affairs abroad, valid Mexican passport issued by the Ministry of Foreign Affairs in the country or through its consular offices abroad, valid consular registration issued by the consular offices of the Ministry of Foreign Affairs abroad, or identification issued by another Mexican tax authority or federal agency, whose biometric data can be verified in accordance with what is established in fraction III of this article.

In the event that the natural person presenting themselves does not have any of the documents mentioned in the previous paragraph, Institutions shall require two of the other identifications mentioned in provision 4th, fraction I, subitem b), sub-subitem (i) of the General Provisions referred to in article 115 of the Credit Institutions Law issued by the Ministry or those that replace them, and carry out the verification actions provided for in Article 51 Bis 4, fraction IV of these provisions.

II.

First capture the biometric information of their employees, executives or officials who will be in charge of collecting those of the customers. Once this capture is concluded, they will collect those of their customers.

In both cases, Institutions must comply with the technical requirements established in Annex 71 of these provisions.

III.

Regarding the valid voter ID card issued by the National Electoral Institute in the country or through the consular offices of the Ministry of Foreign Affairs abroad, valid Mexican passport issued by the Ministry of Foreign Affairs in the country or through its consular offices abroad, valid consular registration issued by the consular offices of the Ministry of Foreign Affairs abroad, the verification actions indicated in Article 51 Bis 4, fractions I, II and V of these provisions must be carried out; or, regarding other identification documents other than those indicated in this fraction, carry out the verification of the coincidence of the customer's biometric information with the biometric records of the Mexican tax authority, or corresponding federal agency.

IV.

Likewise, they must corroborate the existence of the Customer's Unique Population Registry Key with the National Population Registry and that the data provided by the customer coincides with that of said Registry, observing for this purpose what is established in Article 51 Bis, fraction II of these provisions.

When an Institution forms a biometric information database of its customers, in accordance with the procedure established in this article, it must carry out an annual validation regarding the security mechanisms mentioned in Annex 71 in compliance with the verification indicated in Article 168 Bis 14, fraction IX of these provisions and send to the Commission, no later than within 20 business days following the conclusion of the validation, the actions for the attention of deviations identified in said validation.

The Commission may require the Institution at any time additional information for the purpose of supervising compliance with the requirements established in this article. Likewise, prior to the right of hearing granted to the Institution, it may instruct the partial or total, temporary or definitive suspension of the use of the biometric information database, when in the judgment of the Commission itself it is determined that the Institution has seriously or repeatedly failed to comply with technical, operational and security requirements.

The information of the databases containing customer biometric information must not be alienated, sold, transferred, shared or requested under any scheme of exchange, safeguarding, reuse or interoperability between Institutions or with third parties, to carry out the identity verifications referred to in Second Section, of Chapter II, of Title Two of these provisions. This without prejudice to what is established in Article 113 of the Law to Regulate Financial Groups.

Likewise, the verification actions referred to in said section must be carried out exclusively against the information contained in the databases formed by each Institution. Without prejudice to the foregoing, Institutions may contract with third parties the services for the formation of their databases in compliance with the requirements referred to in this article, article 51 Bis 3 and Chapter XI of Title Five of these provisions.

When Institutions decide to cease using the biometric information database, they must give notice to the Commission in accordance with the corresponding format of Annex 75 of these provisions, at least 20 business days after the end of use of the aforementioned database. Once its use is concluded, they must carry out the suppression of the biometric data contained in the aforementioned database, through administrative, technical and physical security procedures and measures that prevent its recovery, access or unauthorized treatment, and conserve documentary evidence, for when the Commission requires such evidence.

Article 51 Bis 3.- The Commission may authorize the use of processes other than those indicated in Article 51 Bis 2, fractions I and II for the formation of the biometric information database, for which Institutions must carry out the verification of the coincidence of the customer's biometric information with the biometric records of the National Electoral Institute, the Ministry of Foreign Affairs, the Mexican tax authority or another federal agency, which provides a biometric information verification service, and have the necessary security elements for the safeguarding and integrity of the information. For the purposes of the authorization provided for in this paragraph, Institutions must present to the Commission the corresponding format of Annex 75 with the following:

I.

The detailed description of the mechanism, which must be approved by its Board of Directors, as well as the Technological Infrastructure used in each part of the process.

II.

The description of the means necessary for the transmission and safeguarding of the information that guarantee its integrity, the correct reading of the data, the impossibility of its manipulation, as well as its adequate conservation and availability.

In the implementation of the mechanism approved for the formation of the biometric information database, Institutions must observe what is indicated in the second and third paragraphs of Annex 71 of these provisions, with the exception of subitem a) of the third paragraph of said Annex; as well as comply with the sixth paragraph of article 51 Bis 2 of these Provisions.

Institutions must have documentary evidence of the safeguarding of the result of the verification of the coincidence carried out between the customer's biometric information with the records of any of the authorities referred to in the first paragraph of this article.

When Institutions decide to cease using said database, they must give notice to the Commission in accordance with the corresponding format of Annex 75 of these provisions, at least 20 business days after the end of use of the aforementioned database. Once such use is concluded, they must carry out the suppression of the personal data contained in the aforementioned database, through administrative, technical and physical security procedures and measures that prevent its recovery, access or unauthorized treatment, and conserve documentary evidence of the foregoing, which must be available to the Commission, for when it requires it.

Article 51 Bis 4.-

. . .

I.

. . .

a)

. . .

b)

Verify online that the biometric information obtained from the natural person presenting the voter ID card issued by the National Electoral Institute coincides, at least, by ninety percent with the records of said Institute. For these purposes, the biometric information obtained must comply with the technical requirements specified by said Institute. The readers of the biometric information indicated, as well as the applications that Institutions make available for this purpose, must ensure that the biometric information is obtained directly from the titular person, avoiding the recording of biometric data coming from a mechanism that intends to simulate the biometric information of another person, as well as having security measures that guarantee that the information stored, processed or sent through these, is not known or used by unauthorized third parties.

Institutions must provide mechanisms and documented procedures to carry out the contracting and request for payment means indicated in Article 51 Bis, as well as the carrying out of the operations referred to in Article 51 Bis 1 of these provisions, with those natural persons from whom it is not possible to obtain at least one of the biometric data for any physical impediment, for the purposes of their authentication before the National Electoral Institute, which must be recorded in the respective customer file.

. . .

. . .

II.

. . .

a)

. . .

b)

Verify online that the biometric information obtained from the natural person presenting the Mexican passport coincides, at least, by ninety percent with the records of the Ministry of Foreign Affairs. For these purposes, the biometric information obtained must comply with the technical requirements specified by said Ministry. The readers of the biometric information indicated, as well as the applications that Institutions make available for this purpose, must ensure that the biometric information is obtained directly from the person, avoiding the recording of biometric data coming from a mechanism that intends to simulate the biometric information of another person, as well as having security measures that guarantee that the information stored, processed or sent through these, is not known or used by unauthorized third parties.

Institutions must provide mechanisms to celebrate the contracts or request for payment means indicated in Article 51 Bis, as well as the carrying out of the operations referred to in Article 51 Bis 1 of these provisions, with natural persons who, for any physical impediment, it is not possible to obtain at least one of the biometric data, for the purposes of their verification before the Ministry of Foreign Affairs, which must be recorded in the respective customer file.

. . .

III. and IV.

. . .

V.

In the case of the valid consular registration issued by the consular offices of the Ministry of Foreign Affairs abroad, Institutions will verify the coincidence of the data indicated below with the records of said Ministry:

a) to c)

. . .

Additionally, Institutions must verify online that the biometric information obtained from the natural person presenting the consular registration coincides, at least, by ninety percent with the records of the Ministry of Foreign Affairs. For these purposes, the biometric information obtained must comply with the technical requirements specified by said Ministry. The readers of the biometric information indicated, as well as the applications that Institutions make available for this purpose, must ensure that the biometric information is obtained directly from the person, avoiding the recording of biometric data coming from a mechanism that intends to simulate the biometric information of another person, as well as having security measures that guarantee that the information stored, processed or sent through these, is not known or used by unauthorized third parties.

Institutions must provide mechanisms to celebrate the contracts or request for payment means indicated in Article 51 Bis, as well as the carrying out of the operations referred to in Article 51 Bis 1 of these provisions, with natural persons who, for any physical impediment, it is not possible to obtain at least one of the biometric data for the purposes of their verification before the Ministry of Foreign Affairs, which must be recorded in the respective customer file.

. . .

. . .

Article 51 Bis 5.- The Commission may authorize Institutions to use identification documents other than those indicated in article 51 Bis and to carry out verification actions other than those indicated in article 51 Bis 4 of these provisions, for which they must present the corresponding format of Annex 75 of these provisions, with their proposal of the process which must include the identification document to be used with its respective verification action, which may include any of the identification documents and verification actions indicated in this Chapter, provided they prove that its result, in the judgment of the Commission itself, is reliable to identify the natural person in question and said verification actions include some element of identification that is validated before any Mexican tax authority or federal agency that provides a biometric information verification service.

In the implementation of the distinct verification actions that, where applicable, are approved, Institutions must observe what is indicated in the sixth paragraph of the aforementioned article 51 Bis 2, as well as compliance with the second and third paragraphs of Annex 71 of these provisions, with the exception of what is indicated by subitem a) of the third paragraph of said Annex.

When requesting the approvals referred to in the first paragraph of this article, Institutions must present the following:

I.

The detailed description of the process, which must be approved by its Board of Directors, as well as the Technological Infrastructure employed in each part of this.

II.

The method of validation of the identification documents that will be admitted to carry out the contracting or operation in question, as well as the procedure to verify that said documents correspond to their holder.

III.

Evidence that the means of verification of the validity of the identification documents of potential customers has the effectiveness approved by the risk committees of the Institutions.

When Institutions intend to modify the described procedure, they will require prior authorization from the Commission.

Likewise, when Institutions decide to cease using any identification document and the respective verification action authorized in accordance with this article, they must give notice to the Commission in accordance with the corresponding format of Annex 75 of these provisions, within 20 business days following the end of its use. "

TRANSITORY PROVISIONS

FIRST.- This Resolution will enter into force the day after its publication in the Official Gazette of the Federation.

SECOND.- Institutions that, upon the entry into force of this Resolution, have formed a biometric database

biometric information data of their clients must present within a period of 30 natural days, a notice to the

Commission

in accordance with the corresponding format of Annex 75 referenced in article 51 Bis 2 of the

present Resolution, indicating the date of formation of said database, as well as the date from which they use it in

matters of verification, specifying the type of biometric identification and verification they use.

THIRD.- Institutions must adhere to what is established in this modifying Resolution, within a maximum

period of 90 business days counted from its entry into force.

FOURTH.- Institutions may only form the database of biometric information data of their clients in

accordance with article 51 Bis 2 and 51 Bis 3 for the biometric data of fingerprint and facial biometry referred to in

Annex 71 of these provisions, until such time as technical specifications for other types of

biometric data that the Commission deems necessary to foresee for purposes of authentication of the clients of the

Institutions are included.

Sincerely

Mexico City, June 25, 2026. - President of the National Banking and Securities Commission, Ángel Cabrera

Mendoza. - Rubric.

ANNEX 71

TECHNICAL REQUIREMENTS FOR THE CAPTURE OF FINGERPRINTS

AND FACIAL BIOMETRY AS

BIOMETRIC DATA

Institutions may only form the database of biometric information data of their clients for the biometric data of

fingerprint and facial biometry referred to in this annex, until such time as technical specifications for other types of biometric data are foreseen in the applicable regulation that the Commission deems necessary to foresee for purposes of authentication of the clients of the Institutions and having documentary evidence of said verification, which must be available to the Commission when it so requires.

The process of first capture of biometric data of fingerprint or facial biometry must consist of registering,

first, the biometric data of fingerprint or facial biometry, as applicable, of the employees, executives

and officials of the Institutions who will be in charge of registering said biometric data of the clients. Secondly, the aforementioned employees, executives and officials referred to, will proceed to capture the biometric data of fingerprint or facial biometry, as applicable, of the clients of the Institution, this process must be verified annually by the Internal Audit managers of the Institution.

The biometric data capture process must prevent an employee, executive or official of the Institution

from registering their own biometric data in substitution for that of the client. Institutions at all times must

guarantee the integrity of the stored or transmitted biometric information, as well as the conservation, availability and the impossibility of manipulation of such information. For the purposes of what is provided in this paragraph, Institutions must adjust at least to the following:

a)

Logically segregate the biometric information databases in the Technological Infrastructure in which

such information is stored.

b)

Store and process biometric information in Technological Infrastructure dedicated exclusively to these

services, in independent network segments through security components that allow only

authorized traffic to said infrastructure.

c)

Securely configure equipment, according to the type of infrastructure element, ports,

services, permissions, access lists, manufacturer updates and factory configuration.

d)

Establish access controls and identification and authentication mechanisms for all and each of the

Users of the Technological Infrastructure, which allow them to be recognized unequivocally and ensure

access only to persons expressly authorized for this purpose. Both mechanisms must include

specific controls for those Users of the Technological Infrastructure with greater privileges,

derived from their functions, such as those of database and operating system administration,

including audit logs on all accesses.

e)

Have encryption mechanisms for information when transmitted or stored.

f)

Conduct tests aimed at detecting vulnerabilities and threats, as well as penetration in the

different elements of the Technological Infrastructure in order to implement defense mechanisms that

prevent unauthorized access and use of information.

g)

Implement controls for the conservation of information, including those regarding the integrity

of stored information, which allow identifying any changes to original data, as well as of

conservation and secure deletion that prevent at all times that they can be known by unauthorized third parties.

h)

Implement controls that restrict consultation, extraction, copying or any form of unauthorized

access to the biometric information contained in the databases.

I.

Fingerprint Capture

The biometric data records made by Institutions will consist of an image capture of the papillary ridges

of the fingers on a contrast surface by pressure, from which the biometric data are obtained.

This capture must consider controls that ensure that they are obtained directly from the person, avoiding the registration of

fingerprints coming from impressions on any material that intends to simulate the fingerprint of another person (live fingerprint test). For the purposes of what is provided in this paragraph, Institutions must adjust at least to the following:

a)

Institutions must capture at least six fingerprints of their clients.

b)

Institutions must use fingerprint readers of at least two fingers per reading (dual devices) for

the first fingerprint capture procedure for the integration of their databases.

c)

For the fingerprint capture process, the minimum image requirements are as follows:

Scanner resolution

(points per inch)

Depth

(pixels)

Minimum dynamic range

(gray levels)

500

8 bits

200

Platform operation parameters (software and hardware) for fingerprint capture

PARAMETER

DECISION

OBSERVATION

First fingerprint capture

Captured Image

Type of capture

M

Flat live.

Number of fingers

M

10 for employees, executives and officials.

6 for clients as a minimum.

This, except for the exception established in this annex.

Finger position

MP

Fingers must be placed in the center of the platter with

respect to its horizon and parallel to the surface of

capture.

Capture angle

MP

Fingers must be placed at 90° with a rotation of ±10°

with respect to the horizon of the platter.

Movement in capture

MP

Avoid sliding of fingerprints on the platter at the time of

capture, to avoid stained images.

Visualization

MP

The operator must observe in real time information of the

capture.

Segmentation

MP

Proven by NIST in the test called "Slap Seg II test".

Sequence

M

Validate that fingerprints of each finger are not repeated during a

same capture process.

Deduplication

M

Validate that fingerprints of clients or employees of the

Institution are not previously registered in the database with the information of another client or employee of the

Institution.

Devices

Dual

M

EFTS certified annex F

FAP 45.

Decadactylar (4-4-2)

M

EFTS certified annex F

FAP 50 or 60.

Sequence review.

Surface

M

Contrast by pressure

Image

M

Generates RAW.

Preview of the taken image.

Information to obtain from the

device

M

The serial number is mandatory.

Optionally the device must have Firmware version,

manufacturer, and model.

Operation

Assisted

M

Yes. Hierarchical fingerprint capture and at least one

fingerprint of the operator must be registered, who must be registered biometrically

in the Institution.

Analysis of quality parameters

M

According to NFIQ.

Cleaning

MP

Clean the platter before each fingerprint capture for

optical readers.

Illumination

MP

For optical devices avoid light sources on the capture

device.

Recapture

M

In case of not obtaining the minimum quality parameters, at

least 3 attempts per fingerprint.

Transmission

Compression of images at 500

points per inch (ppi, by its

acronym in English)

M

Unique compression from RAW image. WSQ max 10:1.

Decision: M->Mandatory

O->Optional

MP->Best practice

Exception to fingerprint capture

In case that clients, employees, executives and officials of the Institutions are permanently unable to

imprint their fingerprints on the respective readers, it must be specified that it is not possible to perform the

capture of the fingerprint image due to amputations, grafts, malformation, permanent injury, prosthesis,

disease, among others.

In any case, the largest number of possible fingerprints must be captured, making the corresponding annotations in the

file.

In the case that there are previously registered biometric data, Entities must have

verification procedures and actions provided for in Article 51 Bis 4, fractions I, II and V that allow verifying that the

data of the client coincide with the biometric records of some Mexican tax authority or federal dependency, when

clients are permanently unable to imprint their fingerprints on the respective readers.

In case that the applications, processes, parameters or devices used in the capture of fingerprints do not

adhere to the requirements of this annex, Institutions must submit them to the approval of the Commission referred to in article 51 Bis 3. However, regarding the capture of fingerprints of the clients of the Institutions,

in no case can this be less than six fingerprints, except for the exception provided in this annex.

Biometric Authentication using the fingerprint database of the Institutions themselves

For the process by which fingerprint reading is made for purposes of authentication (1-to-1 matching) of

clients already registered, and its use as Authentication Factor Category 4, if applicable, the capture requirements of

image are as follows:

Scanner resolution

(points per inch)

Depth

(pixels)

Minimum dynamic range

(gray levels)

300

4 bits

12

500

8 bits

80

PARAMETER

DECISION

OBSERVATION

Biometric Authentication

Captured Image

Number of fingers

O

1 to 4 depending on the type of reader.

Any finger

O

Yes. The sample against all user records.

Recapture

O

Yes. A minimum of three attempts is suggested.

Devices.

Mobile

M

EFTS certified annex F or PIV FAP 30.

Dual

M

EFTS certified annex F FAP 45.

Decadactylar (4-4-2)

M

EFTS certified annex F FAP 50 or 60.

Unidactylar

O

PIV is recommended.

Transmission

Format

O

Any of the following: Proprietary Format, RAW Format,

compressed image with ANSI INCITS 378 or ISO/IEC 19794-2 standards.

Decision: M->Mandatory

O->Optional

MP->Best practice

II.

Operational guidelines for facial recognition

The applications and devices used in the process of capturing facial elements must consider at least

the following requirements:

Platform operation parameters (software and hardware) for facial biometric capture:

PARAMETER

DECISION

OBSERVATION

First facial biometry capture

Processes

Deduplication

M

Validate that captures of clients or employees of the

Institution are not previously registered in the database with the information of another client or employee of the

Institution according to NIST FRVT 1:N standard

Identity Spoofing

M

ISO/IEC 30107-3 or Face Verification Certification.

Digital and photographic requirements

M

ISO 19794-5 standard sections 7.3, 7.4, 8.3 and 8.4.

Facial image capture

Captured Image

M

2D Full Frontal, 24 bits color minimum eye distance 90

pixels.

Posture

M

Must allow a rotation of at least ±5° frontal in any

direction (up, down, left, right).

Expression

M

Neutral facial expression. Smiles, winks, etc. should be avoided.

Gaze at the camera lens (except for physical impediments).

Illumination

M

Balanced and distributed in each part of the face. To achieve skin tones

natural and avoid red eyes.

Depth of Field

M

The central pose of the complete face will be in focus from the

crown to the chin and from the nose to the ears.

Glasses

M

The use of any type of frame is not allowed.

Accessories

M

Only

medical

accessories

are allowed

(without hats, or

accessories that cover the face).

Impediments for taking

M

Closed eyes.

Hair covering eyes or forehead.

Elements obstructing the forehead.

Facial Hair

M

It is allowed.

Background

O

A uniform light-colored background will be used that contrasts with the

face and hair, pale gray or white is recommended.

Operation

M

Controlled lighting environment.

Assisted

M

Yes.

Segmentation and feature extraction

M

Crop according to ICAO standard. Automatic feature extraction by software.

Quality review

M

Automatic by software, the ICAO standard must be evaluated for

image quality.

Biometric Authentication

Image Capture

O

Same as facial image capture.

Number of Images

O

One full frontal.

Transmission

Format

M

Biometric Template, compressed image with ISO/IEC 19794-5:2011 standards

Decision: M->Mandatory

O->Optional

MP->Best practice

Biometric Authentication using the facial biometry database of the Institutions themselves

For the process by which facial biometry reading is made for purposes of authentication (1-to-1 matching) of

clients already registered, and its use as Authentication Factor Category 4, if applicable, the capture requirements of

image are as follows:

PARAMETER

DECISION

OBSERVATION

Comparison

Captured Image

Image Resolution

MP

Minimum value of the distance between eyes (IED) of about 90 pixels,

preferably 120 pixels.

Transmission

Format

M

Any of the following: Biometric Template with Proprietary Format,

RAW Format, compressed image with

ISO/IEC 19794-5:2011 standards

Decision: M->Mandatory

O->Optional

MP->Best practice

In case that the applications, processes, parameters or devices used in the capture of facial biometry do not

adhere to the requirements of this annex, Institutions must submit them to the approval of the Commission referred to in

article 51 Bis 3.

III.

GLOSSARY

The following definitions in singular or plural will be applicable only for the purposes of this Annex.

ANSI: American National Standards Institute, of the United States of America.

Biometric Authentication: The Process by which the identity of the User is verified with the biometric data of

fingerprints or face that the Institutions have previously obtained. This process implies searches for

stored patterns of a single individual (1 to 1).

Comparison: Process by which the Biometric Template generated from a "live capture" is compared

with the other Biometric Template(s) generated and saved previously, through algorithmic calculations and scores

of matching that are evaluated based on matching thresholds previously established by the Institution.

Deduplication: The specialized data compression technique used to avoid duplicate copies of these.

EFTS (by its acronym in English Electronic Fingerprint Transmission Specifications): The specifications for transmission

of biometric information of the Federal Bureau of Investigation of the United States of America (FBI).

FAP (by its acronym in English FingerPrint Acquisition Profile): It is a subdivision of the categories applied to the

devices for fingerprint acquisition based on dimensions, number of simultaneous fingers to capture, quality of the

image. When accompanied by a number (30, 45, 50, 60) this indicates the capture area in inches (45=1.6 x 1.5;

60=3.2 x 3.0, etc.).

ICAO: The standard for passport photographs issued by the International Civil Aviation Organisation.

INCITS (by its acronym in English InterNational Committee for Information Technology Standards): The central forum of the

United States of America, dedicated to the creation of standards for technological innovation.

ISO/IEC: The standard for information security published by the International Organization for Standardization and

the International Electrotechnical Commission.

NFIQ: NIST Fingerprint Image Quality. The fingerprint image quality standards defined by the

NIST.

NIST: National Institute of Standards and Technology.

PIV: The standard defined by NIST for 1-to-1 fingerprint verification (comparison of a fingerprint against a

record).

Biometric Template: Alphanumeric representation of information extracted from one or more biometric samples.

Platter: The capture surface of the fingerprint capture device.

RAW: The format of the raw (unprocessed) image capture of a fingerprint.

Segmentation: The process by which the fingerprint image of each finger is individualized, based on

a compressed image with WSQ or a single RAW image obtained from the reader, to obtain up to four images

independent, one for each finger.

Slap Seg II Test: The test that evaluates the precision with which the algorithm segments images in multi-finger captures.

WSQ (by its acronym in English Wavelet Scalar Quantization): The standard created by the FBI that defines the format for the

compression of fingerprint images.

---

In the document you are viewing, there may be text, characters or objects that are not displayed correctly due to conversion to HTML format, so we recommend always taking the digitized image of the DOF or the PDF file of the edition as a reference. The content, form and scope of the published documents are the strict responsibility of their issuer.

CONSULT

BY DATE

Su

Mo

Tu

We

Th

Fr

Sa

INDICATORS

Exchange Rate and Rates as of 08/22/2026

UDIS

8.805261

See more

SURVEYS

Did you like the new image of the Official Gazette website?

No

Yes

Official Gazette of the Federation

Río Amazonas No. 62, Col. Cuauhtémoc, C.P. 06500, Mexico City Tel. (55) 5093-3200, where you can access our service menu

Electronic address: dof.gob.mx

113

LEGAL NOTICE | SOME RIGHTS RESERVED © 2026