Identity validation for LegalTech
Identify every party with an INE card or passport, a selfie and a liveness check. Cross-check CURP against RENAPO, RFC against the SAT and the ID card against the INE electoral roll. Screen for litigation and sanctions-list matches. Every query is recorded with its receipt and its date.
Every party is identified with a source and a date before signing
The signer is identified with an INE card or passport, a selfie and liveness. The judicial search returns case files with court, parties and dated rulings. Homonyms arrive flagged. Every query is stored in the file.
None of these tools issues a legal opinion. They return sources, dates and matches; the decision stays with your firm, recorded in the file.
Where it fits in your operation
The products behind this solution
Identity verification
INE card or passport plus a selfie: the selfie is matched against the photo on the document, with a liveness check. The verdict comes back as verified, partial or rejected.
Official CURP and RFC
CURP against RENAPO and RFC against the SAT. The response includes a field-by-field match against the data you already had.
Judicial records
Individuals and companies. Returns case files with court, state, plaintiff, defendant and dated rulings.
Sanctions and PEP lists
Nine categories of lists, all from public sources. Every hit carries a score, aliases, country and why it matched: exact, alias, fuzzy or phonetic.
Digital footprint (OSINT)
News, profiles and public mentions of the counterparty, each with a date and a sentiment label.
Document audit trail
SHA-256 of the original and signed PDF, plus an append-only log with actor, IP and user-agent per event.
How it works
The file is built in four steps, with a source, a date and a receipt per query.
Create the party
Individual or company. In a company we search its legal name and its trade name in a single query.
One record per party
Identify the signer
One private link per person, valid for 24 hours. The signer uploads an ID and a selfie; the selfie is matched against the photo on the document, with a liveness check.
Signed webhook notice
Cross-check the sources
RENAPO, SAT, the INE electoral roll, sanctions lists and the Judicial Bulletin. With common surnames the judicial search takes up to a minute; the rest respond in seconds.
RENAPO · SAT · INE · Judicial Bulletin
Close the file
The risk score aggregates the checks already run on the party. Each signal arrives labelled, with its source, in the same response.
Aggregated file score
What the LFPIORPI asks of law firms and notaries.
Mexican AML law reaches law firms and public notaries when they carry out certain acts on a client's behalf, even though the CNBV does not supervise them. Review falls on the evidence behind each identification: its source and its date.
The legal references on this page — here and in the FAQ — are informational and are not legal advice. Whether your firm performs a Vulnerable Activity is for your compliance team to determine. Singula provides the identification inputs and the timestamped evidence of each query: what was checked, when, with what result and — on the identity link — from which device, IP and time.
- 01
Vulnerable Activity
Mexico's AML law (LFPIORPI) lists independent professional services and notarial services in its article 17. The obligation starts when you identify the client, before the act takes place.
- 02
Client identification file
Build the file for the client and, where applicable, the beneficial owner: government ID, CURP, RFC and address, each field with its supporting evidence. Singula covers the identity side and its timestamped evidence; fields such as address, occupation or the beneficial-owner declaration are collected by your firm.
- 03
Five-year retention
Article 18 requires keeping the information and its supporting records for five years from the date of the act, unless the laws of the relevant state set a different term. Every Singula query is recorded with its date, its source and its receipt.
- 04
Filings with the SAT
Filings go through the SAT portal, which routes them to the Financial Intelligence Unit. Each item in the file keeps the source and the date of the query that produced it.
- 05
Biometric data
Face and liveness data are sensitive personal data: under article 8 of Mexico's current data protection law, the subject's consent must be express and in writing, alongside a privacy notice stating what the data is used for. That notice and that consent are the firm's or the notary's responsibility: Singula does not collect them for you.
One customer, every query
The party is created once and the queries run against it: identity, CURP, RFC, sanctions lists and judicial records. Async ones call back with a signed webhook; the risk score reads what already ran.
# 1 · Request the counterparty's identity verification
curl -X POST https://api.singula.mx/app/identity-verification/customer/cus_lzk9m4ab3f/create \
-H "Authorization: Bearer sk_live_..."
→ { "verification_url": "https://app.singula.mx/v/vt_8f2c4d",
"expires_at": "2026-07-29T14:22:08Z" } // link is valid for 24 h
# 2 · While they upload their ID, run due diligence on the same customer
curl https://api.singula.mx/app/judicial/customer/cus_lzk9m4ab3f -H "Authorization: Bearer sk_live_..."
curl https://api.singula.mx/app/blacklist/customer/cus_lzk9m4ab3f -H "Authorization: Bearer sk_live_..."
# 3 · Webhook once they finish the identity flow
{ "event": "identity.completed", "request_id": "68f1c4a29b7e5d0012af33c1", "status": "success" }
# 4 · The file itself: the engine aggregates what you already ran (no charge)
curl https://api.singula.mx/app/risk/customer/cus_lzk9m4ab3f -H "Authorization: Bearer sk_live_..."
→ {
"score": 45, // starts at 50 · lower = lower risk
"risk_level": "medium",
"confidence": 57, // 4 of the 7 relevant tools
"tools_run": ["identityVerification", "validateCurp",
"checkBlacklist", "getJudicialRecordsOfPerson"],
"signals": [
{ "label": "CURP validated against RENAPO · high match", "risk_points": -15 },
{ "label": "No hits on sanctions lists", "risk_points": -10 },
{ "label": "Judicial records · high risk", "risk_points": 20 }
],
"coverage_gaps": ["validateRfc", "getPersonIntelligence"]
}Frequently asked questions
No. What we return is an index of the Judicial Bulletin with published case files: court, state, category, plaintiff, defendant and dated rulings. It tells you who to review in depth. Where the act calls for an official certificate, the court or the relevant authority issues it.
No. PEPs, state-owned entities and adverse media mentions are reported as informational and carry zero weight: they show up in full in the response but do not move the score. Being a PEP is not illegal and is not a bar in itself; what due diligence you apply in that case is for your compliance team to decide.
Yes. The customer is created as a company and the judicial search runs on its legal name and its trade name, in a single query. The twelve-character RFC is derived with the public algorithm, and validating it against the SAT is a separate call. Biometric verification applies to the signing representative, not to the entity.
Not yet. The documents module computes the SHA-256 of the original and signed PDF and keeps an append-only log with actor, IP and user-agent for every event. The NOM-151 preservation certificate is issued by a certification service provider authorised by the Ministry of Economy; Singula's integration with one is in progress and will be announced when it is available.
Other solutions
Build the file before the signature
The sandbox runs the whole flow with test data and at no cost. To move to production, you swap the key.