But by July 2026, every one of the country's roughly 130 million mobile phone lines must be linked to a biometric national ID, and unregistered numbers get suspended on July 1.

Refuse the biometric credential and lose your phone.

The CURP Biométrica upgrades Mexico's existing population registry code, the Clave Única de Registro de Población, from an 18-character alphanumeric string into something far more personal. The updated system captures face, fingerprint, and iris biometrics, packages them with a QR code and digital signature, and produces what amounts to a mobile-readable identity document tied to your body.

Registration happens at RENAPO and Civil Registry offices, where staff scan all ten fingerprints, both irises, take a facial photograph, and record a digital signature. You'll need a valid photo ID, a certified CURP, and an original or certified birth certificate just to walk in.

The government has framed this primarily as a tool for addressing Mexico's crisis of forced disappearances. The biometric data feeds into a Unified Identity Platform connecting the National Population Registry with the National Forensic Data Bank and records held by prosecutors and intelligence agencies, enabling real-time identity searches. That's the stated purpose.

The actual system being built does considerably more than locate missing people. The legislation gives broad access to biometric and personal information to law enforcement, intelligence agencies, and the National Guard, and the law doesn't require authorities to notify citizens when their data gets accessed. You won't know who's looking at your biometrics, or why, or how often.

The SIM registration mandate is what turns a theoretically optional credential into an effectively compulsory one. Mexico enacted its mandatory mobile registration law on January 9, 2026, requiring all cell phone numbers, including prepaid and postpaid lines as well as physical SIM and eSIM, to be verifiably linked to an individual with a government-issued credential. Carriers must verify subscriber identity against the national biometric database.

That means anonymous prepaid SIMs, long relied on by domestic abuse survivors, journalists, and political activists, will simply stop working for anyone who doesn't complete biometric registration before the deadline.

This is Mexico's third attempt at linking phone numbers to identity. The track record should concern anyone paying attention. Mexico's first cell phone registry, called RENAUT, was launched in 2008 and required users to register their numbers with their CURP. Within months, the private information of millions of cellphone users was leaked and allegedly sold by high-ranking corrupt officials within the federal government. RENAUT was abandoned by 2012. The second attempt, PANAUT, required biometric data including fingerprints and facial recognition. Digital rights organization R3D and others challenged the law, and in 2022, Mexico's Supreme Court struck it down as unconstitutional, citing privacy violations.

So here we are at attempt number three. The biometric CURP collects the same categories of sensitive data that the Supreme Court found unconstitutional just four years ago, except now it's attached to a much larger identity platform with far more access points for government agencies.