CRT Issues Rules for Linking Mobile Lines to CURP, Photo ID

Starting Jan. 9, 2026, every mobile phone line in Mexico must be linked to a specific individual or legal entity, under new rules issued by the Telecommunications Regulatory Commission (CRT). The regulator says the measure is intended to eliminate the anonymity that enables mobile service to be used to commit crimes, while keeping the required information safeguarded by operators under Mexico’s personal data protection framework.

The CRT approved the Guidelines for the Identification of Mobile Telephone Lines on Dec. 8, 2025, and the measure was published in the Official Gazette (DOF) on Dec. 9, entering into force the same day.

From Jan. 9, 2026, carriers will be required to activate and keep service active only for lines that are linked to a verified account holder, extending practices already used in postpaid service into the prepaid market.

To link a line for an individual, users must present a valid official photo ID and CURP. The guidelines recognize the voter ID (INE credential) and passport, and also define an official ID as a federal document that includes CURP and a photo. 

For companies, the line must be linked in person and requires documentation that includes the company’s RFC, plus identification and proof of authority for the legal representative.

While the guidelines set the enforcement mechanism through a phased calendar, starting with the rollout of carrier platforms and later the suspension of lines that remain unlinked, the practical timeline being communicated to customers by major operators is clearer:

• Telcel says customers who already have a line must complete linking by June 30, 2026.

• AT&T says customers who activated before Jan. 9, 2026 must link by June 30, 2026, and that starting July 1, 2026, unlinked lines will lose service until the process is completed.

• Movistar did the same and began on Jan. 9, also set to conclude on June 30.

The DOF rules also specify that when a line is disabled for not being linked, it can still be used for emergency and citizen-attention numbers (including 911, 089 and others) and to contact the operator’s customer service system. 

The regulation requires operators and mobile service resellers to provide both in-person and remote options for linking. Remote linking must include identity validation and a “proof of life” step, and carriers must provide dedicated platforms for (1) managing linking/unlinking and (2) consulting what lines are associated with a CURP or RFC.

The guidelines also include privacy guardrails:

• Operators are responsible for personal-data protection under Mexico’s private-sector data law

• Platforms must not store biometric data, photos, or copies of IDs

• Carriers cannot charge users for linking, unlinking, or consulting associated lines

To reduce bulk and potentially fraudulent acquisition of SIMs, the rules instruct providers to cap the number of mobile lines that can be linked to an individual at up to 10, with exceptions for legal entities and individuals with business activity (who must prove that status).