Digital Identification Mexico

This document describes the identity-management system (IMS) in Mexico and its importance to the financial-sector environment. It reflects on the need for digital identification and authentication procedures and processes. The document analyzes different options for the digital identification of individuals and legal entities in Mexico while meeting financial policy objectives and regulation. This document will be valuable for policy makers who are seeking to create a more efficient and inclusive digital identification system within Mexico.

Key Insights

Executive Summary:

The objective of this document is to describe the identity-management system (IMS) in Mexico and its importance to the financial-sector environment while reflecting on the need for digital identification and authentication procedures and processes.

The document analyzes the different options for, and policy implications of, the digital identification of individuals and legal entities in Mexico when meeting financial policy objectives and regulation.

Mexico shows a high rate of identity theft, which in 2017 reached 20,000 cases, and all existing IMSs are affected by duplication of numbers.

Authorities in Mexico are seeking solutions to the complex task of improving efficiency in the financial and government sectors when identifying individuals and legal entities, while balancing other public-policy objectives, such as governance, technological neutrality, safety, privacy, and universal coverage.

The identity-management ecosystem in Mexico includes many different government-issued identification credentials and little coordination between the entities that issue credentials

This creates a risk of duplication of efforts, information, and identities, since each entity provides its own type of ID to registrants.

It also makes it difficult to verify the identity of an individual in Mexico. Mexico has developed digital features of identification systems through different initiatives, but these are not coordinated under a common vision and strategy at the federal level.

Primary federal foundational identification system for individuals is the National Registry of Population and Personal Identification (Registro Nacional de Población, RENAPO).

RENAPO is responsible for assigning a unique identity number, the Unique Population Registry Code (Clave Única de Registro Nacional de Población, CURP) and by 2017 had issued 186 million numbers. The population of Mexico is around 130 million.

Mexico has several functional registries that were created for specific purposes

The National Electoral Institute (Instituto Nacional Electoral, INE) issues voter credentials to all citizens of voting age. The registration number provided by the Federal Tax Payer Registry (Registro Federal de Contribuyente, RFC) is also used as an identification credential for individuals by financial service providers.

In the case of legal entities, the RFC number is the primary ID number used for verification in the financial sector

However, deficiencies have also been observed in the RFC number, including duplications and a lack of universal coverage.

The Legal Entity Identifier (LEI) has started making its way to the Mexican companies, but few legal entities have been registered through the Mexican-certified Local Operating Unit (LOU). This is due to two main factors: First, the request for an LEI is voluntary except for those clients of credit institutions that are involved in over-the-counter operations.

Digital Identity in Mexico

In Mexico, various organizations regulate AML controls, depending on the type of financial institution

Mexico’s financial-inclusion strategy includes a series of measures based on business initiatives and novel products that will allow financial intermediaries to supply services to satisfy the needs of an important segment of the population that still lacks access to the formal financial system

Legal framework covering aspects related to identity, identification, and authentication presents gaps that need to be addressed to provide for legal certainty regarding the development and further use of digital identity by all types of users.

Although the temporary nature regarding the use of INE credential for verification and authentication purposes by third parties has been clarified in recent regulation, there is still a need to clarify the role of RENAPO toward the INE database. In addition, for the development of digital IMSs, it might be necessary for additional credentials to be recognized to operate in the digital environment by defining a set of minimum attributes that can be accepted.

The adoption of digital identity in Mexico requires coordinated action and a common vision from all the stakeholders, including public and private actors.

Authorities should develop a national strategy to achieve universal registration and unique identities. In this process, RENAPO, as the holder of the primary mandate to maintain the population database at national level, must be an active partner.

Key Statistics & Data

• The World Bank’s 2017 Identification for Development dataset shows that 11,082,404 people are still unregistered in Mexico, or 8 percent of its population.
• Mexico shows a high rate of identity theft, which in 2017 reached 20,000 cases.
• By 2017 RENAPO had issued 186 million Unique Population Registry Codes (CURP)
• The INE-registered voters was 86,296,040 by December 2016.
• The INE database currently holds 91 million fingerprints and 95 million facial images and carries out 60,000 queries daily.
• In 2015, 154,242,881 individuals and 3,764,454 firms were included in the country’s credit reporting system.

Methodology

The data was collected from documents related to the Financial Inclusion Global Initiative. This paper also builds on Identity Systems Analysis Country Report for Mexico, which was issued by the World Bank in 2015.

Implications and Conclusions

The expansion of digital ID technologies presents opportunities to reach the overall objective while also presenting trade-offs that require thorough consideration from the authorities. In this context, consistent implementation of the Law on Transparency and the Law on the Protection of Personal Data is necessary, in particular when application programming interfaces (APIs) are involved in the usage of personal information for authentication and identification purposes, and data is transferred from public authorities to private actors. It might also be necessary to revisit KYC requirements for digital onboarding when building a digital identification.