CURP Number Lookup: A Developer’s Guide to Implementation and Integration
A CURP number lookup is the process of querying the official RENAPO database to retrieve verified identity data for a Mexican individual. This guide explains how to implement such a lookup via API, covering integration, use cases, compliance, and fraud prevention. Whether you’re building a fintech onboarding flow, an employment verification system, or a digital platform requiring age checks, understanding the mechanics of CURP lookup is essential for reliable, real-time identity verification.
What Is a CURP Number Lookup?
CURP stands for Clave Única de Registro de Población — the unique population registry code assigned to every Mexican resident. A CURP number lookup is not merely a format validation; it queries the live RENAPO database to confirm that the CURP exists and retrieve the associated personal data (complete name, date of birth, gender, and place of registration). This distinction is critical: format validation can be done locally, but only a real-time lookup against the official source guarantees that the CURP is active and belongs to the person claiming it.
Format Validation vs. Real-Time RENAPO Verification
A simple format check ensures the 18-character code follows the CURP algorithm (e.g., correct initial letters, date digits, and homoclave). However, fraudsters can generate valid-format CURPs that are not registered. Real-time RENAPO verification returns a response signed by the government, providing an audit trail that regulators require. For regulated institutions, this signed response is the difference between a compliance pass and a violation.
Why Use an API for CURP Lookup?
Manually consulting the government portal (consulta CURP en línea) is fine for occasional checks, but automated systems need an API for speed, scalability, and auditability. An API lets you integrate CURP lookup into onboarding flows, batch processing, and fraud detection pipelines. Providers like API Pull offer endpoints that return enriched data—including demographic info and fraud signals—in under 500ms.
How CURP Lookup Works in Practice
The Request: What You Send
To perform a CURP number lookup, you send the CURP string (18 characters, case-insensitive) to the API endpoint. Optionally, you may include the individual’s name and date of birth to enable cross-validation. The API then queries RENAPO in real time.
The Response: What You Get Back
The response typically includes the following fields:
| Field | Description | Example |
|---|---|---|
curp |
The queried CURP | HEGG560427MVZRRL04 |
name |
Full legal name | GARCIA GARCIA HECTOR |
gender |
Gender code | H (male) or M (female) |
date_of_birth |
Date of birth in ISO format | 1956-04-27 |
state_of_birth |
State code and name | 16 (Michoacán) |
municipality |
Municipality of registration | Morelia |
verification_status |
Confirmed active or inactive | active |
signature |
Digital signature from RENAPO | hexstring |
Some providers also return additional fields like locality, postal code, and even census-area data (AGEB) for geographic enrichment.
Error Handling and Authentication
Authentication is typically via API key passed in the header. Common error codes include:
401– Invalid or missing API key400– Malformed CURP (format validation failed)404– CURP not found in RENAPO429– Rate limit exceeded500– Internal server error (retry recommended)
Always handle these gracefully in your application, and consider using exponential backoff for transient errors.
Use Cases for CURP Number Lookup
Fintech Onboarding and Lending Compliance
Fintechs use CURP lookup to verify the identity of new users during account opening. The response feeds directly into KYC workflows, and the signed response serves as proof of verification for regulators. Combined with AML screening (anti-money laundering) against lists like SAT 69-B, CURP lookup helps prevent fraud and ensure compliance with CNBV guidelines. For retirement account (AFORE) verification, the CURP can be used to link a user to their existing account.
Employment Verification and IMSS Registration
When hiring, employers need to register employees with the Mexican Social Security Institute (IMSS). The CURP is the key to looking up the NSS (Social Security Number). Instead of manually entering data, an API can convert CURP to NSS automatically. See CURP to NSS API for details. This eliminates manual entry errors and speeds up HR processes.
Age Verification for Digital Platforms
Platforms selling age-restricted products (alcohol, tobacco, adult content) or offering age-gated services (gaming, gambling) can use CURP lookup to verify that the user is of legal age. The API returns the date of birth, which can be compared against the current date without storing the full date if privacy is a concern. This is faster than asking users to upload a photo of their INE (voter ID) or passport.
Compliance and Fraud Prevention with CURP Lookup
AML Screening and PEP Checks
CURP lookup itself does not screen against sanctions lists, but it is a prerequisite for AML workflows. By first verifying the identity with CURP, you can then run the person’s name and date of birth against PEP (Politically Exposed Persons) and blacklists. Many providers bundle CURP verification with AML screening, returning a combined result. For example, API Pull’s AML API Mexico covers SAT 69-B, OFAC, and UN consolidated lists.
Fraud Detection Signals from CURP Data
CURP lookup can reveal fraud signals such as:
- Velocity checks: If the same CURP is queried dozens of times in a short period, it may indicate a brute-force attack.
- Cross-client data: If the same CURP appears in multiple accounts with different names, it’s a red flag for synthetic identity fraud.
- Demographic mismatch: If the state of birth reported in the CURP differs from the IP location or user-provided address, it may warrant additional verification.
For more on fraud prevention, see CURP Anti-Fraud API.
Enriching CURP Data with Demographic and Geographic Information
From State to AGEB: Geographic Granularity
Beyond basic identity fields, some CURP APIs return locality, municipality, and even AGEB (Área Geoestadística Básica) — a census-level area used by INEGI. This granularity allows you to:
- Assess risk by analyzing the socioeconomic profile of the applicant’s neighborhood.
- Target services based on population density and income levels.
- Plan ATM locations or branch networks for underbanked populations.
The AGEB code can be used to join with INEGI census data, providing rich demographic context without requiring the user to share extra data.
Using Enriched Data for Risk Scoring and Marketing
A fintech lending platform can use the CURP’s state and municipality to adjust interest rates or approve loans based on local economic indicators. Similarly, an insurance company might offer microinsurance products tailored to specific regions. The enriched data helps personalize the user experience while maintaining compliance.
When CURP Number Lookup Is the Wrong Tool
Not a Credit Check or Biometric Verification
CURP lookup returns only demographic and identity data. It does not include credit history, financial information, or biometrics (fingerprint, facial recognition). For underwriting decisions, you need a separate credit bureau check. For high-security scenarios, biometric verification (e.g., liveness detection) is required.
Not a Substitute for Official ID Documents (INE, Passport)
While CURP lookup confirms the identity exists in the population registry, it cannot replace physical inspection of a government-issued ID. For example, opening a bank account often requires the user to present their INE card in person or via video call. CURP lookup is a strong first step, but not the final verification for high-risk transactions.
Not Suitable for ACH Payments (ACH)
ACH payments in Mexico use the CLABE or account number, not the CURP. CURP lookup does not provide account details. Although ACH is not relevant to CURP, it’s worth noting that the CURP is not a financial identifier and should not be used for payment processing.
Getting Started with CURP Lookup via API
Sandbox Environment and Test Cases
Most providers offer a sandbox environment with synthetic test CURPs. For example, you can use test CURPs like HEGG560427MVZRRL04 (a common test case) to simulate responses. The sandbox returns deterministic data so you can verify your integration without hitting the live database. This is essential for development and QA.
Bulk Endpoints and Webhook Notifications
For high-volume operations (e.g., onboarding thousands of employees), look for a bulk endpoint that allows submitting up to 100 CURPs in a single request. Providers may also support webhooks for async processing—you send a batch, and they notify you when results are ready. This avoids timeouts and improves throughput.
Try It Today
Ready to integrate CURP number lookup into your application? Visit API Pull’s documentation to get started with a free trial. You’ll have access to a sandbox, sample code in Node.js and Python, and support for compliance-grade signed responses. No credit card required.
Frequently Asked Questions
Q: What is the difference between a CURP lookup and a CURP validation? A: A CURP validation checks the format and algorithm locally. A CURP lookup queries the RENAPO database in real time, confirming the CURP exists and returning the associated personal data. For compliance, you need the lookup.
Q: Can I use CURP lookup to get someone’s NSS? A: Yes, using a CURP to NSS API. The CURP is linked to the NSS in the IMSS database. See CURP to NSS API for details.
Q: Is CURP lookup enough for AML compliance? A: It is a key component. You first verify the identity with CURP, then screen the individual against PEP and sanctions lists using an AML API. Many providers bundle both services.
Q: How fast is a typical CURP lookup? A: Most APIs respond in under 500ms, but response times can vary depending on network and provider load. Always check the provider’s SLA.
Q: What should I do if the API returns an error? A: Check the error code. For 404 (not found), the CURP may be invalid or unregistered. For 429, implement rate limiting. For 500, retry after a short delay.
Internal Resources
- CURP Person Lookup API for Dev Teams — Node.js integration example
- RFC by CURP API — Lookup RFC from CURP
- API Pull Home — Explore all Mexico-specific APIs