CLABE Validation: How to Verify a Mexican Supplier
Mexico does something no other market in this series does: the tax authority publishes a list of the suppliers who will cost you money. If a company you have paid appears on the Article 69-B list, the invoices it issued you stop having any tax effect — not from the date of publication, but retroactively — and your deduction and VAT credit go with them. You then have thirty days to prove the transaction was real. The list is free, public, and updated constantly. Almost no buyer outside Mexico checks it — and it is only one of two Mexican rules that make a supplier's paperwork your tax problem.
Sources: Código Fiscal de la Federación, Article 69-B; SAT listados globales published in the Diario Oficial de la Federación.
The account layer: CLABE and SPEI
Mexican domestic payments run on SPEI, the interbank electronic payment system operated by Banco de México. Transfers settle in seconds, and there has been no daily cut-off since 2004.
The account identifier is the CLABE — Clave Bancaria Estandarizada — a standardised eighteen-digit number. Mexico does not use IBAN; an international wire uses the bank's SWIFT code with the CLABE as the account identifier.
Unlike Indian account numbers, a CLABE is genuinely checkable without contacting anyone. The final digit is computed from the preceding seventeen using a weighting sequence of 3, 7 and 1 defined by Banxico, so a mistyped digit fails arithmetically. The first three digits identify the institution, so you can confirm the bank the supplier claims to use.
A CLABE is eighteen digits and identifies an account. A card number is sixteen digits and identifies a piece of plastic. Suppliers confuse them regularly, and a card number will not receive a SPEI transfer. Separately, Mexico has no national payee-name check — no equivalent of European VoP, UK CoP or India's penny drop. A validated CLABE tells you the number is well-formed. It does not tell you whose account it is.
The company layer: reading the RFC
Every Mexican taxpayer has an RFC, the Registro Federal de Contribuyentes. Its length tells you immediately what kind of counterparty you are dealing with.
A company RFC is twelve characters: three letters drawn from the registered name, six digits for the date of constitution in year-month-day order, and a three-character homoclave whose final character is a check digit. An individual's RFC is thirteen, with four letters and a date of birth.
Two practical consequences. Receiving a thirteen-character RFC from what you believe is a company means you are contracting with an individual, which changes your withholding obligations. And the embedded date lets you sanity-check the counterparty: an RFC showing constitution three months ago, from a supplier claiming twenty years of trading, is a contradiction visible before you query anything.
Validating against SAT
SAT offers two distinct services, and the difference matters.
| Service | You supply | You get back |
|---|---|---|
| Búsqueda de contribuyente | The RFC | The registered fiscal name associated with it. |
| Validación de contribuyente | RFC + fiscal name + postal code | A binary answer: the three match SAT's records, or they do not. |
The second is the stronger control, and it is the closest thing Mexico has to a payee-name check — not against a bank account, but against the tax register. Two cautions apply. The comparison is exact, so a name entered in a different order or with different accents can fail a legitimate supplier. And the postal code is the one on the fiscal domicile, not the branch or commercial address.
The CSF is the SAT-issued certificate showing the supplier's exact registered name, RFC, fiscal address and tax regime. Taking the name and postal code from that document rather than from an email signature removes almost all of the false failures in the validation above. It should be a standard onboarding request for any Mexican supplier.
Article 69-B: the list that decides whether you keep your deduction
This is the reason Mexican supplier verification is a financial control rather than good practice.
Article 69-B of the Código Fiscal de la Federación gives SAT a procedure for taxpayers it believes are issuing invoices for transactions that never happened — typically companies with no assets, no employees and no operational capacity to deliver what they invoice. The vocabulary is worth learning because it is used constantly in Mexican finance:
- EFOS — empresas que facturan operaciones simuladas, the companies issuing the invoices.
- EDOS — empresas que deducen operaciones simuladas, the companies that received those invoices and claimed them. If you buy from an EFOS, you are an EDOS.
How the procedure runs
SAT publishes a presunto (presumed) list, giving the supplier fifteen business days to rebut the presumption with evidence. If it fails, or does not respond, SAT issues a definitive resolution and publishes the supplier on the definitivo list in the Diario Oficial de la Federación and on its own portal.
Publication on the definitive list has an effect that surprises foreign buyers. The invoices issued by that supplier are treated as producing no tax effect, and as never having produced one. The wording is retroactive: it reaches invoices you claimed in earlier periods, not merely future ones.
From publication, you have thirty days either to demonstrate that you genuinely acquired the goods or received the services, or to correct your position through complementary declarations. The burden of proof sits with you.
The exposure applies even where you received the goods, paid the contracted price through banking channels, and had no knowledge of any irregularity at your supplier. What is tested is the materiality of the transaction — whether you can evidence that it really happened — not whether you behaved reasonably.
What it costs
| Consequence | Effect |
|---|---|
| Deductions rejected | The expense is disallowed, raising taxable income and the ISR payable. |
| VAT credit lost | The IVA on those invoices is no longer creditable, with a direct cash impact. |
| Updates and surcharges | Applied to the reassessed tax from the original period. |
| Fines | Up to 100% of the tax omitted. |
| Criminal exposure | In serious cases the authorities may pursue simulated-transaction offences. |
How to actually use the list
The lists are published free, in the Diario Oficial and on the SAT portal, and are refreshed regularly — in practice weekly. They are downloadable, which is the important part: this is a file you can reconcile against your vendor master rather than a page you search one supplier at a time.
Three checks are worth building in. Screen every new supplier against both the presunto and definitivo lists before onboarding. Re-screen the existing base on each update, because a supplier you cleared last quarter can appear this week. And when a supplier does appear, freeze the tax effects of its invoices while you assemble the materiality file — contracts, purchase orders, delivery evidence, payment records, transport documents — rather than waiting to see whether SAT raises it.
One point of relief: while the thirty-day window following publication is the deadline named in the statute, Mexican taxpayer-defence guidance recognises further opportunities to demonstrate materiality later in the process. Missing the window is serious, not necessarily fatal.
The second exposure: REPSE and specialised services
Article 69-B is about invoices for things that never happened. The second rule is about a category of thing that does happen constantly: outsourced labour.
Mexico's 2021 subcontracting reform banned general personnel outsourcing and created the REPSE — the Registro de Prestadoras de Servicios Especializados u Obras Especializadas, maintained by the labour ministry, STPS. A company providing specialised services or works, and placing its own workers at your site, must hold a current REPSE registration.
The consequence for the buyer is the familiar shape. Under article 27 fraction V of the Income Tax Law and article 5 fraction II of the VAT Law, if you contract specialised services from a provider without valid REPSE registration, you cannot deduct the expense and you cannot credit the VAT. Fines under the Federal Labour Law run from 2,000 to 50,000 times the UMA, and the buyer is jointly liable for contributions owed in respect of the workers who performed the service.
A lapsed REPSE registration is, in practice, the same as no registration: the provider cannot legally invoice the service and you lose the deduction and the credit. STPS has moved to periodic reviews with the register connected to SAT, IMSS and Infonavit, so a provider can fall out of compliance between your onboarding check and your next invoice. This is a status to monitor, not a certificate to file once.
What the buyer has to collect, and when
REPSE is unusual in that the evidence burden is recurring. Verifying the registration at onboarding is the start of the obligation, not the end of it.
| When | What you must obtain |
|---|---|
| Before contracting | Proof of current REPSE registration, kept on file, plus a written contract specifying the object of the service and the approximate number of workers involved. |
| Each period, for the VAT credit | Payroll CFDIs for the workers used, the ISR withholding declarations and proof of payment, IMSS and Infonavit contribution receipts, and the VAT declaration for the period invoiced. |
| Deadline | Generally by the last day of the month following payment. Miss it and you are expected to file a complementary declaration reducing the amounts you credited. |
One scope point decides whether any of this applies. Specialised services must not form part of the contracting company's own corporate object or predominant economic activity. Where they do, the arrangement is not specialised subcontracting at all, and the payments can lack tax effect regardless of the provider's registration.
The opinión de cumplimiento under article 32-D is SAT's assessment of whether a taxpayer is current on its obligations, issued as positive or negative. It is a standard requirement in Mexican procurement and part of ongoing REPSE compliance. Requesting a current positive opinion alongside the REPSE certificate gives you two independent, dated confirmations that the supplier is in good standing.
Verifying the invoice itself
Mexican invoices are CFDIs — digital tax receipts certified by an authorised provider and registered with SAT. Each carries a folio fiscal, the UUID identifying it.
SAT operates a free public verification portal: submit the folio fiscal, the issuer's RFC and the receiver's RFC, and it returns the document's status and which authorised provider certified it. For a first payment to a new supplier, that closes the loop between the invoice, the tax ID and the entity in a way few countries allow.
What a CLABE check will not catch
Validating a CLABE confirms the number is well-formed and identifies the bank. With no national payee-name service, it does not confirm whose account it is.
More importantly in Mexico, it says nothing about the tax consequences of paying that supplier. The account can be perfect while the company behind it sits on the 69-B presumed list, has an RFC that does not match the name on the invoice, is issuing CFDIs that will lose their effect retroactively, or is supplying you with specialised services on a lapsed REPSE registration. There are several company red flags a bank account match alone will not catch, and Mexico is the market where they carry the clearest price tag.
One integration, instead of one per country
Mexico's SAT tools are free and genuinely good. They just share no format, cadence or identifier scheme with the next market you pay into.
MonitorPay covers 49+ markets through one API — payee name matching, plus company status, directors, shareholders and ownership from 200+ government registries. Bulk, API or platform. Every check logged. We do not move money.
A practical verification workflow
For a new Mexican supplier, or a change to an existing one, a defensible sequence looks like this:
- Validate the CLABE. Eighteen digits, check digit verified, bank code consistent with the institution the supplier names. Reject sixteen-digit card numbers.
- Request the Constancia de Situación Fiscal. It gives you the exact registered name, RFC, fiscal address and tax regime, in SAT's own wording.
- Read the RFC. Twelve characters is a company, thirteen an individual. Check the embedded constitution date against what the supplier claims.
- Validate RFC, name and postal code together against SAT. Use the CSF wording exactly, and the fiscal-domicile postal code.
- Screen against the 69-B lists. Both presunto and definitivo, before the first payment.
- Check REPSE, if the supplier provides specialised services or works. Confirm the registration is current, keep a copy, and hold a written contract naming the service and the approximate headcount. Then collect the payroll, withholding, IMSS and VAT evidence each period.
- Request the opinión de cumplimiento. SAT's article 32-D assessment, positive or negative, dated.
- Verify the CFDI. Folio fiscal plus both RFCs on the SAT portal, at least for the first invoice.
- Build the materiality file as you go. Contracts, purchase orders, delivery evidence, transport records and proof of payment through banking channels. Assembling it after a listing is far harder than keeping it.
- Re-screen on every list update. A supplier cleared at onboarding can be listed later, and the effect reaches backwards.
- Re-verify on any bank-detail change. With no payee-name check, a change request is the point of highest exposure.
Bulk, API, or the online platform
Three ways in: bulk file checks for onboarding runs and supplier-base reviews, the REST API for verification inside your payment workflow, or the online platform for one-off checks with full audit logs.
Frequently asked questions
How do I verify a Mexican supplier's bank account?
Validate the CLABE: eighteen digits, with the final digit computed from the preceding seventeen using Banxico's weighting algorithm, and the first three identifying the bank. That confirms the number is well-formed and which institution holds it, but Mexico has no national payee-name check, so it does not confirm whose account it is.
The substantive work is on the company side: request the Constancia de Situación Fiscal, validate the RFC together with the registered name and fiscal postal code against SAT, and screen the supplier against the Article 69-B lists before you pay.
What is a CLABE and how is it structured?
The CLABE is Mexico's standardised bank account number, used for SPEI transfers. It has eighteen digits in four blocks: three for the financial institution, three for the plaza or city where the account was opened, eleven for the account number itself, and one final check digit calculated from the rest using weights of 3, 7 and 1.
Do not confuse it with a card number, which has sixteen digits and identifies a card rather than an account. A card number will not receive a SPEI transfer.
Does Mexico have a payee name check like Verification of Payee?
No. There is no Mexican equivalent of European Verification of Payee, UK Confirmation of Payee or India's penny drop. No national service will confirm that the name you are paying matches the holder of a given CLABE.
The nearest equivalent operates at the tax level rather than the banking level: SAT's taxpayer validation confirms whether an RFC, registered name and fiscal postal code match its records. It ties a name to a tax ID, not to a bank account, but it is the strongest name-matching control the market offers.
What is the difference between a 12 and 13 character RFC?
Twelve characters means a company: three letters from the registered name, six digits for the date of constitution, and a three-character homoclave ending in a check digit. Thirteen characters means an individual: four letters from the surnames and given name, six digits for the date of birth, and the homoclave.
If you believe you are contracting with a company and receive a thirteen-character RFC, you are dealing with an individual, which changes your withholding obligations. The embedded date is also a free sanity check against a supplier's claimed trading history.
What is the Constancia de Situación Fiscal and why should I ask for it?
The CSF is a certificate issued by SAT showing a taxpayer's exact registered name, RFC, fiscal address and tax regime. It should be a standard onboarding request for any Mexican supplier.
The practical reason is that SAT's validation service compares data exactly. A name taken from an email signature, entered in a different order or with different accents, can fail validation for an entirely legitimate supplier. Taking the wording and the postal code from the CSF removes most of those false failures. Note that the postal code required is the one on the fiscal domicile, not a branch or commercial address.
What is the Article 69-B list, and what are EFOS and EDOS?
Article 69-B of the Código Fiscal de la Federación lets SAT publish taxpayers it presumes are issuing invoices for transactions that never took place, typically companies with no assets, employees or operational capacity to deliver what they bill. Those issuers are known as EFOS, empresas que facturan operaciones simuladas.
EDOS — empresas que deducen operaciones simuladas — are the companies that received those invoices and gave them tax effect. If you buy from a listed supplier, you are an EDOS, and the consequences reach you rather than staying with the issuer.
What happens if my Mexican supplier appears on the 69-B list?
Once a supplier is published on the definitive list, the invoices it issued are treated as producing no tax effect and as never having produced one. The wording is retroactive, so it reaches CFDIs you claimed in earlier periods, not only future ones.
You then have thirty days from publication either to demonstrate that you genuinely acquired the goods or received the services, or to correct your position through complementary declarations. The practical consequences of failing are rejected deductions, loss of the IVA credit, updates and surcharges on the reassessed tax, fines of up to 100% of the tax omitted, and in serious cases criminal exposure.
Am I protected if I paid in good faith and actually received the goods?
Not automatically. The exposure applies even where you received the goods, paid the contracted amount through banking channels, and had no knowledge of any irregularity at the supplier. What is tested is the materiality of the transaction — whether you can evidence that it really happened — rather than whether you behaved reasonably.
That is why the practical defence is documentary and built in advance: contracts, purchase orders, delivery and transport evidence, and proof of payment through banking channels. Assembling that file after a listing is considerably harder than maintaining it as you go.
How often is the 69-B list updated, and how should I check it?
SAT publishes the listings in the Diario Oficial de la Federación and on its own portal, refreshed regularly — in practice weekly. Both the presumed and definitive lists are free and downloadable.
Because they are files rather than single-lookup pages, the right approach is to reconcile them against your vendor master rather than checking suppliers one at a time. Screen new suppliers before onboarding, and re-screen the existing base on each update: a supplier cleared last quarter can appear this week, and the effect reaches backwards over invoices you have already claimed.
What is REPSE and why does it matter to me as a buyer?
REPSE is the register of specialised service and works providers maintained by Mexico's labour ministry, created by the 2021 subcontracting reform. Any company that provides specialised services or works and places its own workers at your site must hold a current registration.
It matters because the penalty falls on you. Under article 27 fraction V of the Income Tax Law and article 5 fraction II of the VAT Law, contracting specialised services from an unregistered provider means you cannot deduct the expense or credit the VAT. Fines under the Federal Labour Law run from 2,000 to 50,000 times the UMA, and you are jointly liable for contributions owed in respect of the workers used.
Is checking REPSE once at onboarding enough?
No, and this is the most common mistake. REPSE registrations expire, and a lapsed registration has the same practical effect as none: the provider cannot legally invoice the service and you lose the deduction and the credit. STPS conducts periodic reviews with the register connected to SAT, IMSS and Infonavit, so a provider can fall out of compliance between your onboarding check and your next invoice.
The evidence burden is also recurring rather than one-off. To support the VAT credit you are expected to obtain, each period, the payroll CFDIs for the workers used, the ISR withholding declarations and proof of payment, the IMSS and Infonavit receipts, and the VAT declaration for the period invoiced — generally by the last day of the month following payment.
What is the opinión de cumplimiento and should I ask for one?
It is SAT's assessment under article 32-D of whether a taxpayer is up to date with its obligations, issued as either positive or negative. It is a standard requirement in Mexican procurement and forms part of ongoing REPSE compliance for specialised service providers.
Requesting a current positive opinion alongside the Constancia de Situación Fiscal is worth doing for any supplier of size. Between them you get the registered identity and a dated confirmation of good standing, from the same authority that would later challenge your deduction.
How do I verify a Mexican CFDI invoice?
Use SAT's free public verification portal. Submit the folio fiscal — the UUID identifying the document — together with the issuer's RFC and the receiver's RFC, and the portal returns the document's status and which authorised provider certified it.
It is worth doing at least for a first invoice from a new supplier, because it closes the loop between the invoice, the tax ID and the entity in a way most countries do not permit a counterparty to do.
Does Mexico use IBAN for international payments?
No. Mexico's account standard is the CLABE, used domestically for SPEI transfers. An international wire to a Mexican supplier uses the receiving bank's SWIFT or BIC code with the CLABE as the account identifier.
That means the eighteen-digit CLABE is the number to validate regardless of whether you are paying domestically or from abroad, which is simpler than markets that maintain separate domestic and international account formats.
Does a valid CLABE mean a Mexican supplier is legitimate?
No. A valid CLABE confirms the number is correctly formed and identifies the issuing bank. With no national payee-name check, it does not confirm the account belongs to the company you intend to pay.
Nor does it say anything about the tax consequences of paying. The account can be entirely valid while the supplier behind it sits on the 69-B presumed list, has an RFC that does not match the invoice, or is issuing CFDIs that will lose their effect retroactively. Account validation and company verification answer different questions, and in Mexico the second has a direct price attached.
