Amendment to the General Law on Enforced Disappearance of Persons, Disappearance Committed by Private Parties and the National Search System for Persons ("LDP"); obligation to interconnect with the Single Identity Platform ("PUI")

This platform functions as a primary source for permanent, real-time consultation, thereby requiring companies that provide financial, telecommunications, transportation, health, education, and/or courier services (the "Diverse Institutions") to interconnect their databases with the national registries, through web services that enable the validation of the CURP and the management of biometric data. This scheme has imposed on such companies a series of obligations that had to and/or must be fulfilled at various points in time following the reform. The Diverse Institutions must ensure that they are in compliance with this new regime, under penalty of sanctions. I. New obligations Pursuant to the guidelines and manuals applicable to the PUI2, the Diverse Institutions must comply with a series of obligations to guarantee interoperability with the PUI. The Diverse Institutions must accredit their identity by obtaining the institutional Llave MX for formal registration before the National Population Registry ("RENAPO"). Once their identity has been accredited, the Diverse Institutions must develop their own backend service with specific endpoints enabling them to receive official search requests, conduct queries in their databases using the CURP, and notify the authorities of matches to the PUI. Additionally, the regulatory framework requires that the interconnection infrastructure comply with strict requirements regarding cybersecurity, authentication, protocols, and the execution of security testing to rule out vulnerabilities before connectivity is authorized. II. Non-compliance and Risks The deadline for the Diverse Institutions to request their access to the PUI expired this past March 31, 2026. Therefore, Diverse Institutions that have not done so in due time and form are in non-compliance and, consequently, exposed to the possible imposition of a financial sanction by the authority. Pursuant to Article 43 Bis of the LDP and Article 114 Bis of the LGP3, private parties that hold databases and do not allow access or fail to keep the information updated shall be sanctioned by the Ministry of the Interior with fines ranging from 10,000 to 20,000 times the daily value of the UMA, which currently amounts to fines of approximately MXN $1,173,100 to MXN $2,347,400. III. Remediation Strategy and Phased Regularization Given that the compliance deadline has already lapsed, our service as a full-service Firm (with extensive experience in Compliance, Regulatory, Data Privacy, Corporate, and Administrative Litigation) focuses on designing a comprehensive work plan enabling the Diverse Institutions to identify the obligations arising from the legislation at hand in order to be in compliance therewith; to determine the human and technological resources they must have to achieve proper interconnection with the PUI; and to develop a strategy to address a potential administrative sanctioning proceeding for non-compliance, as applicable. The latter takes into account the potential benefits of spontaneous compliance. We hope this note is of use to you and, for further information or clarification of any matter, below is the contact information for our experts: Luis Burgueño, Partner: +52 (55) 5258-1003| lburgueno@vwys.com.mx Raymundo Soberanis, Partner: +52 (55) 5258-1059| rsoberanis@vwys.com.mx Gloria Martínez, Counsel: +52 (55) 5258-1014| gmartinez@vwys.com.mx Carlos Ugalde, Associate: +52 (55) 5258-1003| cugalde@vwys.com.mx

PDF