CURP: The Complete Guide to Mexico’s National Identity Number for Businesses

If you are building a fintech, insurance, or any regulated service in Mexico, you need to understand the CURP (Clave Única de Registro de Población). This 18-character alphanumeric identifier is the backbone of identity verification for Mexican citizens and residents. This guide explains what a CURP is, how to validate it programmatically, and how to leverage it for KYC, AML, and data enrichment via API.

What is CURP and why is it crucial for Mexican identity verification?

The CURP (Clave Única de Registro de Población) is a unique identity number assigned to every Mexican citizen and resident by the government’s Registro Nacional de Población (RENAPO). It is used across all official documents: passports, driver’s licenses, voter ID cards, tax records, and social security. For businesses, the CURP is the key to verifying a person’s identity against government databases.

The structure of a CURP

A CURP consists of 18 characters that encode demographic information. The format is:

This structure allows you to extract basic demographic data (name, birth date, gender, state) directly from the CURP string. However, for official verification, you must query RENAPO in real time to confirm the CURP is valid and matches the person.

Official sources: RENAPO and government databases

RENAPO is the sole issuer of CURPs. The Mexican government provides an online consulta de CURP (official CURP lookup) where individuals can check their own number. For businesses, relying on web scraping that page is not reliable or scalable. Instead, you need an API that connects directly to RENAPO’s database. API Pull’s CURP API provides exactly that: a real-time connection to the official registro de población, returning validation status and demographic data.

How CURP drives KYC and AML compliance

Regulated institutions in Mexico—such as fintechs, insurance companies, and banks—are required by the Comisión Nacional Bancaria y de Valores (CNBV) to perform identity verification and anti-money laundering (AML) checks. The CURP is the central identifier for these processes.

Using CURP for customer onboarding

When a new customer signs up, you can collect their CURP and optionally their full name, date of birth, and other data. Sending a CURP to the RENAPO API returns a confirmation of whether the CURP is active and matches the provided data. This is a critical step in the KYC (Know Your Customer) workflow. The CURP Compliance API is designed for this exact use case—it returns a signed response that proves the data has not been tampered with, satisfying CNBV audit requirements.

AML screening with CURP data

Once you have a verified CURP, you can cross-reference it against AML lists. The Mexican government maintains the SAT 69-B list (published by the Servicio de Administración Tributaria) of individuals and entities with tax irregularities. Additionally, international sanctions lists like OFAC (Office of Foreign Assets Control) and the UN consolidated list must be screened. API Pull’s AML API Mexico covers these, and because the CURP is a unique identifier, you can automate the screening without fuzzy matching. The AML check can also flag fraud signals such as velocity checks—if the same CURP is used across multiple applications in a short time, it may indicate synthetic identity fraud. The CURP Anti-Fraud API adds these velocity checks and cross-client data anomalies.

Integrating CURP validation into your application

Integrating CURP validation is straightforward: you send a request with the CURP and optionally name/date of birth, and receive a JSON response with validation status and demographic data.

What you send and what you get back

From a developer’s perspective, you make an HTTP request to a REST endpoint. You send the CURP (and optionally additional fields). The response includes:

• Validation status: whether the CURP is active, inactive, or invalid.
• Demographic data: full name, birth date, gender, nationality, state of birth, and more.
• Verification hash: a signed token that proves the response came from RENAPO and hasn’t been altered.
• Timestamp: the exact time of the query.

For the exact parameters and response fields, consult the official API Pull documentation. Do not guess endpoint paths; the documentation provides the definitive schema.

Real-time verification vs. batch processing

Most onboarding flows require real-time verification—under 500ms is common. API Pull’s RENAPO connection is optimized for that. But if you need to process thousands of existing customers, you can use the batch endpoint, which accepts up to 100 CURPs in a single request and returns results asynchronously via webhooks. This is useful for legacy data cleansing or periodic re-verification.

Sandbox environment

Before going live, you can test integration using a sandbox environment with synthetic CURP values. This allows you to simulate different scenarios: valid, invalid, inactive, and mismatched data. The sandbox is free and requires no contract.

Beyond validation: data enrichment with CURP

A validated CURP can unlock a wealth of enriched data that helps you understand your customers better and automate processes.

Demographic and geographic data (AGEB, locality)

RENAPO returns not only the basic identity data but also geographic information tied to the person’s registered address. This includes the AGEB (Área Geoestadística Básica), which is a census tract used by INEGI. You can use this for fraud analytics—if the address provided by the user does not match the AGEB, it raises a red flag. The CURP Demographic API returns this data, allowing you to segment users by state, municipality, and locality.

Employment and social security data (NSS, AFORE)

For HR and payroll platforms, the CURP can be used to retrieve the NSS (Número de Seguridad Social)—the Mexican social security number. This is essential for IMSS (Instituto Mexicano del Seguro Social) registration of employees. API Pull’s NSS API queries the social security database from the CURP, returning the NSS and associated AFORE (retirement account) information. This streamlines employee onboarding and ensures compliance with labor regulations.

When CURP is the wrong tool for identity verification

While CURP is powerful, it is not a silver bullet. Here are its limitations.

Limitations of CURP for foreign nationals

CURP is only issued to Mexican citizens and legal residents. Foreign nationals who are not registered in Mexico cannot be verified via CURP. If your business serves tourists, expats, or cross-border workers, you need alternative methods such as passport verification, professional licenses, or biometric matching.

Privacy concerns and data minimization

CURP contains personal data that, if mishandled, can lead to privacy violations. The Ley Federal de Protección de Datos Personales in Mexico requires that you collect only the data necessary for the purpose. You should not store CURP indefinitely. Use verification hashes (signed responses) to prove you checked the data without storing the raw CURP. The CURP Birth Data API allows you to extract only the birth data you need, minimizing risk.

Alternative verification methods

If CURP is not available or appropriate, consider:

• Passport or professional license verification via document scanning APIs.
• Biometric verification (facial recognition) combined with a live photo.
• Bank account validation (e.g., CLABE) for financial services.

Ensuring compliance with audit trails and signed responses

Regulated institutions must prove to regulators like CNBV that they performed proper identity verification. This requires tamper-proof audit trails.

Verification hashes and tamper-proof data

API Pull returns a verification hash (also called a signed response) with every successful CURP validation. This hash is a cryptographic token that can be re-computed at any time to verify the response was not altered after receipt. You store this hash as part of your audit log; if a regulator asks, you can present the hash and the original response to prove compliance.

Audit logs for regulatory submissions

Your audit log should include:

• Timestamp of the query.
• The CURP requested (hashed or masked for privacy).
• The verification hash.
• The response status.
• The user session or transaction ID.

API Pull’s CURP Compliance API is specifically designed for regulated institutions, providing responses that meet CNBV standards.

Next steps: testing CURP integration in sandbox

Ready to integrate CURP validation? Start with the free sandbox environment:

1. Sign up for a free account at API Pull.
2. Get your API key from the dashboard.
3. Explore the documentation at https://apipull.com/docs for the exact endpoint and request format.
4. Test with synthetic CURP values provided in the sandbox. Simulate valid, invalid, and mismatched scenarios.
5. Switch to production when you’re satisfied. The sandbox uses the same codebase, so migration is seamless.

No hard sell—just try it. The sandbox is free, and you can verify the data quality before committing to a plan.

Frequently Asked Questions

What is the difference between CURP and RFC?

The CURP is a population registry identifier, while the RFC (Registro Federal de Contribuyentes) is a tax identifier. Both are used for identity verification, but the RFC is tied to tax obligations. Many businesses verify both during onboarding.

Can I validate a CURP without a name?

Yes, you can send just the CURP. The API will return the demographic data associated with that CURP, including the full name. You can then compare it to the name the user provided. However, sending the name and DOB increases accuracy and reduces false positives.

Is it legal to store CURP data?

Yes, but you must comply with Mexican data protection laws. Minimize storage, use encryption, and retain only as long as necessary. API Pull’s signed responses allow you to prove verification without storing the raw CURP data.

How fast is the API?

Real-time queries typically complete in under 500ms, suitable for mobile and web flows. Batch processing is asynchronous and can handle up to 100 CURPs per request.

Internal Link Suggestions

• CURP API
• CURP Compliance API
• CURP Anti-Fraud API