Identity verification for Fintech
We validate CURP against RENAPO, RFC against the SAT and the ID card against the INE Lista Nominal. We run sanctions lists and judicial records. The evidence of every query stays attached to the customer file.
Singula builds the file from each source's literal response
The query goes to RENAPO, the SAT or the INE. The answer arrives with its date and its receipt. The field-by-field match comes in the same call. Everything lands in the customer file.
Singula does not decide for you. We return the data exactly as the source delivered it, the field-by-field match and the evidence of the query; the acceptance policy and any report to the authority remain your compliance team's call.
Where it fits in your operation
The products behind this solution
CURP at RENAPO
Live registry query plus a field-by-field match against what your form captured.
RFC at the SAT
Confirms whether it is in the taxpayer registry and able to receive invoices.
INE + Lista Nominal
OCR of front and back, plus a verdict: active, cancelled, duplicated or stolen.
Identity verification
24-hour link: document, liveness check and selfie matched against the document photo.
Lists and sanctions
Nine categories per search, all from public sources, with certainty tiers and homonym disambiguation.
Judicial records
Case files with court, state, parties and rulings, for individuals and entities. In a company we search its legal name and its trade name in a single query.
How it works
From a signup form to a file with evidence, in four calls.
Create the customer
You create one record per customer. Every later query hangs off that identifier and lands in its audit trail.
Individual or legal entity
Validate the identifiers
CURP is queried at RENAPO and matched field by field — name, surnames, date, sex — against what you captured. RFC goes to the SAT registry.
RENAPO · SAT
Verify the holder
A 24-hour link to upload both sides of the ID, a selfie and liveness. The selfie is matched against the photo on the document and the card is checked against the INE Lista Nominal.
expires in 24 h
Screen and close
Lists and judicial records answer in the same call; the identity verification result reaches your system as soon as the holder finishes.
Signed webhook
The evidence of every query is filed into the customer record.
SOFIPOs, SOFOMES, fintech institutions and banks share the same core duty: identify whoever opens the account, build their file and keep a record of the checks. Singula returns the source data and stores every query in that file with its date and its receipt.
The legal references on this page — those in this section and also the ones in the flow, the use cases and the FAQ — are orientative and are not legal advice. Singula delivers the source data and the evidence of the query; the identification policy, the privacy notice and the consent, any filings with the authority and the decision to accept or reject a customer belong to the entity and its compliance officer.
- 01
Financial Technology Institutions
ITFs authorised under the Fintech Law — electronic payment funds and crowdfunding — fall under the anti-money-laundering regime and CNBV supervision.
- 02
Customer identification file
The general provisions require building and keeping each customer's identification data. CURP and RFC are part of that file whenever the person has them.
- 03
Non-face-to-face identification
Remote onboarding requires contrasting the applicant's data and biometrics against the records of the authority that issued the ID. The applicable provisions set the match threshold, the video recording and the anti-spoofing controls. That biometric comparison against the authority is run by the entity through its own authorised channels. Singula covers the documentary side and its evidence: ID OCR, CURP queried at RENAPO, a liveness check and a comparison of the selfie against the photo printed on the document.
- 04
Blocked persons list and public lists
The Blocked Persons List is issued by the UIF at the Ministry of Finance, it is confidential and it reaches the entity through its own channels: Singula does not query it. What we add is a complementary control, never a substitute — nine categories built from public sources (sanctions, criminal, tax, PEP, debarment, export control and more), each hit scored with a certainty level. Showing up as a PEP is not unlawful: those hits are reported as informational and do not block on their own.
- 05
Personal data and consent
Biometric data is sensitive personal data: the LFPDPPP now in force requires express, written consent to process it (Art. 8) and lists separately the cases where consent is not required (Art. 9). The privacy notice and the consent are the financial institution's responsibility; Singula does not collect them for you. The flow records what was queried, when, with what result and — on the identity link — from which device, IP and time.
- 06
Retention and traceability
The file and its supporting evidence must be retained and available to the authority. Every query leaves its receipt, the full source response and its date.
One call per source. One file per customer.
You create the customer once and every tool hangs off that identifier. Synchronous queries answer in the same call; asynchronous ones return a receipt and notify you through a signed webhook.
# Alta no presencial · un customer_id, varias fuentes
curl -X POST https://api.singula.mx/app/identity-verification/customer/cus_lzk9m4ab3f/create \
-H "Authorization: Bearer sk_live_..." \
-H "Content-Type: application/json" \
-d '{ "document_type": "INE" }'
→ {
"verification_url": "https://app.singula.mx/v/8f3ad2c1",
"expires_at": "2026-05-02T14:22:08Z",
"request_id": "req_9c4b2ad17e"
}
// Webhook cuando el titular termina (identity.completed):
{
"event": "identity.completed",
"status": "verified",
"verification": {
"document_type": "INE",
"overall_confidence": 0.941,
"face_result": {
"match_decision": "match",
"liveness_decision": "live"
},
"checks": {
"mrz_check_digits": true,
"curp_renapo_match": "high",
"lista_nominal": "vigente"
}
}
}
# Score consolidado — lectura del expediente
curl https://api.singula.mx/app/risk/customer/cus_lzk9m4ab3f \
-H "Authorization: Bearer sk_live_..."
→ { "score": 22, "risk_level": "low", "confidence": 71, "tools_run": 5 }Frequently asked questions
It gives you the inputs and the evidence: the data exactly as RENAPO, the SAT or the INE returned it, the field-by-field match and an audit trail with the date and receipt of every query. The identification policy, the filings and the accept-or-reject decision stay with you.
Both, and they are separate tools. The calculation applies the RENAPO algorithm to the data you captured and proves nothing about the person existing. The validation actually queries the registry: it returns the person, their status and the match against what your form captured.
The query is logged as an error, with its date. It is different when the source answers but finds no record: the response indicates the key is not registered, and that result is stored in the file.
There is no background job running on its own. List screening is on demand: one call, one answer. If you need periodic re-screening you schedule it on your side and fire the query before each relevant operation; every run is logged separately.
Signals from the tools you already ran on that customer: identity, lists, judicial and digital presence. There is no credit bureau data and no financial information. The scale runs 0 to 100; lower score, lower risk.
Creating the account and making the first top-up unlocks CURP, RFC, INE and the digital presence searches. Compliance tools — lists, judicial records and identity verification — unlock once your company verification is complete. The sandbox is available at no cost from day one.
Other solutions
Open your first account this week
Run the whole flow in the free sandbox, review the evidence each query returns with your compliance team and move to production once they sign off.