Mexico sets biometric bank rules with late-2026 compliance
1 JULY 2026, MEXICO CITY
Mexico set biometric bank rules through Annex 71, effective 1 July 2026, requiring banks to handle biometric data such as face and fingerprint with isolated encrypted storage. Compliance falls due around October or November 2026. The rules address how banks protect biometric data; they are not a post-quantum instrument and do not mandate quantum-resistant algorithms.
The focus is on encryption and isolation rather than specific algorithms. By requiring isolated encrypted storage, the rules raise the protection around biometric data without dictating which cryptography banks use. That leaves post-quantum obligations unchanged, so the rules neither require nor preclude quantum-resistant algorithms for the data they cover.
The nature of the data still connects to quantum concerns. Biometric data is highly sensitive and effectively permanent, since a person cannot change their fingerprint or face. That makes it a strong candidate for harvest-now-decrypt-later worries, where long-lived data recorded today could be decrypted later. The rules protect exactly the kind of data that benefits from quantum-resistant encryption over time.
Why it matters. Mexico's biometric rules tighten how banks store sensitive personal data, with compliance due in late 2026, but they stop short of requiring post-quantum cryptography. Because biometric data is permanent and highly sensitive, it is a prime target for harvest-now-decrypt-later. Banks meeting the encryption requirement can reasonably look ahead to quantum-resistant algorithms for this data, even though the rules do not yet demand them.