RENAPO CURP: A Developer’s Guide to Mexico’s Identity Registry
RENAPO CURP is the cornerstone of identity verification in Mexico. The Registro Nacional de Población (RENAPO) is the government agency responsible for issuing and maintaining the Clave Única de Registro de Población (CURP), a unique alphanumeric code for every Mexican citizen and resident. For developers building applications that require identity verification—whether for fintech onboarding, employment verification, or compliance—accessing RENAPO CURP data via an API is essential for real-time, authoritative validation.
RENAPO and CURP: The Foundation of Mexican Identity Verification
What is RENAPO?
RENAPO (Registro Nacional de Población) is the official federal registry of the Mexican population. It operates under the Secretaría de Gobernación and maintains the master database of all CURP records. This database includes demographic data such as full name, date of birth, gender, place of birth, and address. RENAPO is the sole authoritative source for CURP validation in Mexico—any verification against this registry is considered definitive.
How CURP is generated and validated
The CURP is an 18-character alphanumeric code derived from a person’s name, date of birth, gender, and state of birth, along with a checksum digit. RENAPO assigns each person a unique CURP that remains constant for life. Validation involves checking the format, verifying the checksum, and comparing the provided data against the official RENAPO database. Manual validation through government websites (like consulta CURP en línea) is possible but slow and unscalable for automated systems.
Why Developers Need a RENAPO-CURP API
Manual vs. API-based verification
Manual CURP verification requires a human to visit the government site, enter the CURP, and manually copy the response. This process is error-prone, slow, and impossible to incorporate into automated workflows. An API-based approach lets your application send a CURP to RENAPO directly and receive a validated response in under 500 milliseconds. This is critical for real-time decisions in user onboarding, loan origination, or insurance policy issuance.
Common use cases
- Fintech KYC and AML: Financial institutions must verify identity under CNBV anti-money laundering (AML) regulations. A RENAPO CURP API provides the authoritative identity check, often combined with screening against SAT 69-B and PEP lists.
- Employment verification: Staffing agencies use CURP verification to confirm a worker’s identity for IMSS registration and AFORE (retirement account) setup.
- Insurance policy issuance: Insurers verify the policyholder’s identity and age before issuing coverage.
- Age verification: Digital entertainment platforms use CURP data to confirm a user’s age and demographic segmentation.
For a deeper look at compliance use cases, see our CURP Compliance API resource.
How the RENAPO CURP API Works: Integration Overview
What you send and what you get back
From a developer’s perspective, you send a CURP (and optionally additional fields like name or date of birth) to the API endpoint. The API returns a JSON response with:
| Field | Description | Example |
|---|---|---|
validation_status |
Indicates whether the CURP is valid against RENAPO | "valid" or "invalid" |
full_name |
Full name registered with RENAPO | "JUAN PEREZ LOPEZ" |
date_of_birth |
Date of birth in YYYY-MM-DD format |
"1990-03-15" |
address |
Registered address, including AGEB (Basic Geo-Statistical Area) | "Calle 123, Col. Centro, CDMX, 06000" |
fraud_signals |
Indicators of suspicious activity (velocity, duplicate) | {"velocity": 0} |
Fraud detection signals like velocity checks and cross-client data help identify synthetic identities. The API also includes a verification hash or signed response for audit trails, meeting regulatory requirements.
Where it fits in an onboarding flow
A typical onboarding flow:
- User enters their CURP and other personal data.
- Your application sends the CURP to the RENAPO CURP API.
- The API validates the CURP and returns the associated demographic data.
- Your system compares the user-provided data with the API response. If they match, identity is verified; otherwise, the user is flagged for manual review.
- For additional compliance, the same API can trigger AML screening (e.g., against SAT 69-B).
Learn more about the integration details on our CURP Birth Data API page.
Compliance and Fraud Detection with RENAPO Data
AML screening and PEP checks
Regulated institutions must comply with CNBV’s AML framework (Ley para Prevenir e Identificar Operaciones con Recursos de Procedencia Ilícita). A RENAPO CURP API can be combined with AML screening (like our AML API Mexico) to check individuals against the SAT 69-B list, OFAC sanctions, and Politically Exposed Persons (PEP) databases. This ensures that onboarding meets both identity verification and anti-money laundering obligations.
Velocity checks and cross-client fraud signals
Fraudsters often submit multiple applications using different identities but from the same device or IP. The API can detect unusual velocity (e.g., many CURP queries from one source in a short time) and cross-client signals (e.g., the same CURP appearing in multiple applications with different names). These alerts help prevent synthetic identity fraud and account takeover.
Audit trails for regulated institutions
Every API response includes a cryptographic signature or verification hash that proves the data hasn’t been tampered with. This is crucial for audits by regulators like CNBV or the Mexican tax authority (SAT). Your application (AP) should store these responses for the required retention period.
When a RENAPO CURP API Is the Wrong Tool
A RENAPO CURP API is powerful, but it has limitations:
- Cannot verify biometrics: It does not match a live photo or fingerprint. For biometric verification, you need a separate facial recognition or fingerprint API.
- Not a real-time update from all government sources: While RENAPO is the primary registry, some updates (e.g., address changes) may take time to propagate. The API reflects the most current RENAPO snapshot, but it’s not a substitute for physical document inspection.
- Overkill for simple format checks: If you only need to validate that a CURP has the correct length and checksum, a simple server-side regex or checksum algorithm is sufficient. An API call is unnecessary.
For cases where physical document inspection is required, consider document scanning APIs. Otherwise, the RENAPO CURP API is the right tool for automated identity verification.
Choosing the Right RENAPO CURP API Provider
Key features to look for
- Real-time RENAPO connection: Ensure the provider has a direct integration with RENAPO, not a cached database.
- Bulk validation: For high-volume operations (e.g., payroll processing), a bulk endpoint that accepts up to 100 CURPs per request saves time.
- Sandbox environment: Test with synthetic CURP data before going live.
- Webhook notifications: For async processing, webhooks notify you when a validation is complete.
Compliance and data security
- Data privacy: The provider must comply with the Mexican Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP).
- Signed responses: Look for signed responses or verification hashes to prove data integrity.
- SLA guarantees: Many providers offer response time guarantees (e.g., under 500 ms for a single CURP lookup).
For a comprehensive overview, visit our API Hub and documentation.
Next Steps: Integrate RENAPO CURP Verification into Your Application
Ready to add authoritative CURP verification to your app? Sign up for API access, explore the sandbox environment with synthetic test cases, and read the official documentation. The sandbox lets you test the full workflow without making real API calls. Once you’re satisfied, integrate the endpoint into your onboarding flow and start verifying identities in real time.
For a deeper dive into CURP verification, check out our CURP API guide and the CURP Anti-Fraud API for fraud detection.