Electronic signatures in Mexico

The laws

• The Código de Comercio, title "Del Comercio Electrónico" (articles 89 to 114), governs electronic signatures in commercial matters throughout Mexico. Its article 49 sets how long merchants keep contracts.
• The Código Civil Federal covers federal civil matters; each state has its own civil code.
• NOM-151-SCFI-2016, published in the Diario Oficial de la Federación on March 30, 2017, sets how merchants conserve data messages.
• The Ley de Firma Electrónica Avanzada (dealings with the federal public administration) and article 17-D of the Código Fiscal de la Federación (tax filings, with the SAT's e.firma) cover the public sector.
• The Código Nacional de Procedimientos Civiles y Familiares (CNPCF), with new rules on electronic evidence, comes into force by declarations of each congress, and no later than April 1, 2027 (second transitory article).

What the Código de Comercio says

• Electronic means "o cualquier otra tecnología" may be used in commercial acts and their formation, under the principle of technological neutrality (article 89).
• Information may not be denied legal effect, validity or enforceability solely because it is in a data message, and such messages have the same legal effects as printed documents, provided they follow the Code and the corresponding rules (article 89 bis).
• Where the law requires writing, a data message suffices if its information stays intact and accessible; where it also requires the parties' signature, the message must be attributable to them (article 93).
• The Code may not be applied to exclude or deprive of legal effect any method of creating an electronic signature (article 96).
• Where the law requires, or the parties agree on, a signature, an electronic signature "que resulte apropiada para los fines" (appropriate for the purpose) suffices (article 97).

For civil contracts, the Código Civil Federal reaches the same place: consent can be expressed by electronic means (article 1803), no prior agreement is needed to contract electronically (article 1811), and written-form and signature requirements are met electronically when the information is attributable to the parties and accessible later (article 1834 bis).

Firma Electrónica, FEA and the e.firma

Tier	What it requires	Effect
Firma Electrónica (article 89)	Electronic data in, attached to or logically associated with a data message, used "para identificar al Firmante en relación con el Mensaje de Datos e indicar que el Firmante aprueba la información"	"produce los mismos efectos jurídicos que la firma autógrafa, siendo admisible como prueba en juicio" (the same legal effects as a handwritten signature, admissible as evidence)
Firma Electrónica Avanzada o Fiable (article 97)	At least: the signature creation data correspond exclusively to the signer, they were under the signer's exclusive control when signing, and any later change to the signature or to the message is detectable	Considered reliable. Anyone may show reliability in another way, or show that a signature isn't reliable (article 97, last paragraph)
Certificate-backed signatures	A certificate from a certification service provider accredited by the Secretaría de Economía (articles 100 to 113), or the SAT's e.firma	Required in dealings under the Ley de Firma Electrónica Avanzada and, unless another rule applies, for tax filings (Código Fiscal de la Federación article 17-D), with the same effects as a handwritten signature

Who sent it: attribution

A data message is presumed to come from the sender if the sender sent it, or if it was sent "[u]sando medios de identificación, tales como claves o contraseñas del Emisor" (article 90). A message is also presumed to come from the sender, and the recipient may act on it, when the recipient properly applied a procedure agreed with the sender beforehand to confirm that it came from them (article 90 bis). In practice, a contract that states how it will be signed gives both parties that agreed procedure.

Keeping contracts: article 49 and NOM-151

Merchants must keep, for at least ten years, the originals of the documents, including data messages, that record contracts and commitments (article 49). A data message must have stayed intact from when it was first generated in final form and remain accessible, following the Official Mexican Standard the Secretaría de Economía issues: NOM-151-SCFI-2016.

The NOM applies to merchants that conserve data messages under the Code (section 2). Conservation is evidenced by a constancia de conservación, issued by a certification service provider accredited for that purpose (section 6.2): one or more digital time stamps in the RFC 3161 format over the file's fingerprint (Appendix A.4), valid for at least ten years (A.8.4.1). The provider receives only the fingerprint, never the document (A.2.4).

Documents excluded or with their own rules

• Acts before a notary. Where the law requires an act to be granted before a notary or other public attester (fedatario público), the parties can use data messages to set the exact terms, but the notary still grants the instrument under its own law (Código de Comercio article 93; Código Civil Federal article 1834 bis).
• Real estate. Under the Código Civil Federal, a sale of real estate appraised above 365 times the daily minimum wage of the former Distrito Federal must be in a public deed (article 2320); below that, it may be a private document signed before two witnesses whose signatures are ratified before a notary, a judge or the Public Property Registry (article 2317). State civil codes set their own rules.
• Powers of attorney must be in a public deed, or a letter signed before two witnesses with ratified signatures, when the mandate is general or exceeds 1,000 times the minimum wage, among other cases (article 2555).
• Wills. A public open will is granted before a notary (article 1511), and a holographic will is handwritten by the testator and deposited with the Archivo General de Notarías (article 1550).

Proving an electronic signature

In commercial proceedings, data messages are admissible (article 1205), and to weigh them "se estimará primordialmente la fiabilidad del método en que haya sido generada, archivada, comunicada o conservada" (the reliability of the method by which the information was generated, archived, communicated or conserved comes first, article 1298-A). The CNPCF repeats that test, adding whether the content can be attributed to the persons bound (articles 348 and 349), and it says information "contenidos o almacenados en una cadena de bloques pública hacen prueba plena" (stored in a public blockchain makes full proof) unless there is reliable evidence that the records were breached or tampered with, or aren't reliable (article 350).

How Attest fits ordinary business agreements

Attest signatures are Firmas Electrónicas under article 89, suited to everyday commercial contracts such as service agreements, statements of work, NDAs and supplier agreements. Attest doesn't claim the Firma Electrónica Avanzada o Fiable tier, isn't an accredited certification service provider and isn't the e.firma, and it doesn't issue NOM-151 constancias. Its evidence speaks to what the Code looks at:

What the Code looks at	What Attest records
Identifying the signer and their approval (article 89)	Each signature is made with a passkey registered to the signer's email address, and the passkey signs a statement that begins "I have reviewed and I sign", naming the document by its fingerprint. A passkey is a cryptographic key only the signer controls, unlocked with Face ID, Touch ID, Windows Hello or the device PIN. Attest confirms control of the email address and the passkey, not a government ID
Reliability of the method (article 1298-A)	The passkey must confirm the signer is present and verified, Attest checks each signature against its public key, and the evidence uses open standards (WebAuthn and SHA-256) anyone can re-check
Intact and accessible (articles 49 and 93)	The statement includes the SHA-256 fingerprint of the exact document and of the signer's entries, and the signed state is anchored on the Horizen public blockchain. Change one byte and verification fails. Every party downloads the same sealed PDF, with the full evidence, the original document and a standalone verifier attached inside

A fingerprint (SHA-256 hash) is a short code calculated from a file's contents that changes if a single byte changes. The open-source verifier inside the copy runs in any browser without any Attest service and checks each signer's passkey signature, the original document, the pages you see and Attest's anchored record on Horizen.

Where the CNPCF applies, its article 350 covers what is stored on a public blockchain, which for Attest is a fingerprint and its time. That is evidence that the signed record existed, unchanged, at that time, not proof of who signed, and how courts apply article 350 to an anchored fingerprint is untested; see is a blockchain-anchored signature legally valid?.

If you are a merchant keeping the contract under article 49, the conservative course is to also request a NOM-151 constancia for the signed copy from an accredited provider: the provider receives only the file's fingerprint, so the document stays private. For acts that need a notary, a public deed or the e.firma, use that route.

Every document is end-to-end encrypted, so Attest can't read it. Signers need no account and never pay, and anyone can verify a signed copy for free at attest.datahubz.com/verify. Your first 2 documents are free, in total, then the Signing plan is $5 a month for 20 documents.