How to Validate CURP with an API

Validating a CURP (Clave Única de Registro de Población) is a critical step for identity verification in Mexico. By using an API to validate CURP in real time against the official RENAPO database, businesses can ensure the authenticity of the identity data provided by users. This guide explains how to validate CURP with an API, covering the structure of the clave, the integration process, and the key use cases in fintech, HR, and compliance.

What Does It Mean to Validate a CURP?

The CURP is an 18-character alphanumeric code assigned by RENAPO (Registro Nacional de Población) to every Mexican citizen and resident. Validating a CURP goes beyond checking its format: it confirms that the code exists in the official registry, matches the demographic data (name, birth date, gender, state of birth), and reflects the current status of the individual (active, deceased, or suspended).

CURP Structure and Checksum

Each posición de la clave única follows a strict pattern:

• First four letters: first letter of first surname, first vowel of first surname, first letter of second surname, first letter of given name.
• Next six digits: date of birth (YYMMDD).
• Next one letter: gender (H for male, M for female).
• Next two letters: state of birth (using INEGI codes).
• Next three letters: first consonants of first surname, second surname, and given name.
• Final two characters: a check digit and a verification digit (homoclave).

The check digit (dígito verificador) is a mathematical calculation that ensures the CURP is internally consistent. However, offline checksum validation alone is insufficient for identity verification—it does not query RENAPO and cannot detect cancelled or deceased records.

Real-Time vs Offline Validation

Real-time API validation queries the oficial RENAPO database via a provider like API Pull, returning the current status and full demographic data. This is the only method acceptable for regulated institutions.

Why Validate a CURP? Key Use Cases

Fintech Onboarding and KYC

Financial institutions in Mexico must comply with CNBV (Comisión Nacional Bancaria y de Valores) regulations to verify customer identity. The CURP is the primary identifier for natural persons. By validating the CURP against RENAPO, fintechs can confirm that the identity data provided by the applicant matches the official record. This is a foundational step in Know Your Customer (KYC) processes.

AML Compliance (Including AML Watchlists)

Anti-money laundering regulations require screening against official lists, such as the SAT 69-B list (blacklist), OFAC, and UN consolidated lists. The CURP serves as a unique identifier to match individuals against these aml watchlists. An API can simultaneously validate the CURP and screen the associated name against multiple watchlists, providing a complete compliance check.

HR and Employment Verification

Employers must verify the CURP of new hires for IMSS (Instituto Mexicano del Seguro Social) registration and NSS (Número de Seguridad Social) assignment. Validating the CURP ensures that the employee’s identity is correct before enrollment, reducing errors in payroll and benefits.

Age Verification for Digital Platforms

Digital entertainment platforms (streaming, gaming, social media) require age verification for restricted content. The CURP contains the birth date, and an API can return the date of birth to confirm the user meets the minimum age requirement. This is often combined with demographic data such as geographic area (AGEB) to personalize content.

How Programmatic CURP Validation Works

API Request and Response Overview

A typical CURP validation API expects a single parameter: the 18-character CURP string. The API then queries the RENAPO database in real time and returns a response containing:

• Full name (first name, surnames)
• Date of birth (day, month, year)
• Gender
• State of birth
• Current status (valid, invalid, deceased, suspended)
• Address (if available)
• Geographic area (AGEB) – this is the ageb entity from INEGI, used for demographic segmentation.

No specific endpoint paths or parameter names are provided here; refer to the official API documentation for the exact request format.

Data Points Returned

CURP Status Indicators

• Valid: The CURP exists and is active.
• Invalid: The CURP does not match any record in RENAPO.
• Deceased: The individual has been registered as deceased.
• Suspended: The CURP has been temporarily suspended (e.g., due to a legal process).

Demographic Enrichment

Beyond basic verification, some APIs return demographic data including the ageb (Área Geoestadística Básica) from INEGI. This allows businesses to segment users by geographic area for risk assessment, marketing, or compliance with local regulations.

Integrating CURP Validation into Your Application

Single CURP Validation Flow

For a one-off check (e.g., during user registration), send a POST request with the CURP to the API endpoint. The response is synchronous and typically arrives in under 500ms. Your application can then use the status and data to proceed with the onboarding flow.

Batch Validation for High Volume

If you need to validate multiple CURPs (e.g., for bulk employee onboarding or portfolio review), use a bulk endpoint that accepts up to 100 CURPs in a single request. This is much faster than individual calls and reduces network overhead.

Asynchronous Processing with Webhooks

For operations that do not require an immediate response (e.g., nightly compliance checks), you can submit CURPs via the API and receive results via a webhook. The API will process the batch and POST the results to your registered callback URL. This is ideal for high-volume, non-blocking workflows.

Handling Errors and Edge Cases

• Invalid format: Ensure the CURP is 18 characters and matches the regex pattern. Return a user-friendly error if not.
• Dead CURP: If the status is “Deceased,” the individual cannot be onboarded for most financial services.
• Network issues: Implement retry logic with exponential backoff. The API is designed for reliability, but transient failures can occur.

A sandbox environment is available for testing. Use synthetic test CURPs provided by the API provider to simulate different statuses and responses without affecting real data.

CURP Validation and Compliance: What You Need to Know

Regulatory Requirements for Financial Institutions

CNBV regulations require that identity verification be performed against an official government database. Validating the CURP via RENAPO meets this requirement. Additionally, the API should return a signed response or a verification hash that proves the data has not been tampered with after receipt—this is essential for audit trails.

Audit Trails and Signed Responses

For regulated institutions, each validation must be logged with a timestamp, the CURP validated, the response, and a unique transaction ID. Some APIs, like API Pull’s CURP Compliance API, provide signed responses that can be stored as evidence for regulatory audits.

Fraud Detection Signals

Advanced CURP validation APIs include fraud detection features:

• Velocity checks: Detect if the same CURP is being validated too many times in a short period (potential brute force or credential stuffing).
• Cross-client data: If the same CURP appears with different names across multiple clients, it may indicate synthetic identity fraud.

Afore and CURP: Why Validation Matters

To open an afore (retirement account), the CURP must be validated against RENAPO. The afore entity (Administradora de Fondos para el Retiro) requires a valid CURP to register the worker and associate their retirement savings. An incorrect or invalid CURP can delay or prevent account setup.

When CURP Validation Is the Wrong Tool

CURP Alone vs. Full Identity Verification

CURP validation confirms that the clave exists and matches the demographic data provided, but it cannot verify the identity of the person presenting the CURP. For example, a fraudster could use a stolen CURP with a fake ID. CURP validation alone does not include biometrics, document image verification, or liveness detection.

Scenarios Requiring Additional Documents

For high-risk onboarding (e.g., opening a bank account), you must also verify the INE (Instituto Nacional Electoral) credential or passport. These documents contain a photograph and signature that can be compared against the person in front of you. CURP validation is a complement, not a replacement.

Complex Fraud Cases: Synthetic Identity, Stolen CURP

Synthetic identity fraud involves combining real data (like a valid CURP) with fake information to create a new identity. CURP validation will return “valid” because the CURP is genuine, but the fraudster is not the real person. To detect this, you need additional checks such as cross-referencing with credit bureaus, device fingerprinting, or behavioral analysis.

Next Steps: Start Validating CURPs with Our API

Ready to integrate CURP validation into your application? API Pull offers a free sandbox environment where you can test our CURP API with synthetic test cases. Our documentation provides detailed endpoint references, code examples, and best practices.

• Explore the CURP API: Learn about the data fields returned, including demographic and geographic enrichment.
• Check compliance features: The CURP Compliance API is designed for regulated institutions with audit trails and signed responses.
• Prevent fraud: Our CURP Anti-Fraud API includes velocity checks and cross-client signals.

Sign up for an API key today and start validating CURPs in minutes. No credit card required.