How to Verify Business Addresses and Company Status in Mexico

According to Trading Economics, 83,950 new businesses were registered in Mexico in 2024 alone. 

For your procurement and risk teams, this represents a significant supplier opportunity…but at the same time, an equally large data validation challenge. 

Company names may vary across sources. Addresses become outdated and legal entities can suspend operations without changes reaching internal systems. 

This guide explains how to verify businesses in Mexico, which official sources to consult, and how to scale verification across vendor databases. 

Validating the RFC

The addition of 83.950 Mexican businesses in 2024 does more than expand Mexico’s supplier ecosystem. 

It also increases the number of similar, abbreviated, and inconsistently recorded company names that procurement teams must distinguish. 

This is where Mexico’s Registro Federal de Contribuyentes (RFC) becomes essential. 

More than just a tax number, it’s the primary cross-system identifier connecting a legal entity to Servicio de Administración Tributaria (SAT) filings, Comprobante Fiscal Digital por Internet (CFDI) invoices, banking processes, and contract and customs activity. 

A valid RFC gives enterprises a consistent key for matching a counterparty’s legal name, tax profile, and domicilio fiscal across documents and records. 

Confirm the RFC Is Active

The first step in Mexican company verification is to confirm that the supplied RFC exists in SAT’s records. 

Mexico’s public “Verifica si estás registrado en el RFC” tool allows your teams to enter an RFC and check whether it is registered. 

A Mexican legal entity normally has a 12-character RFC, while an individual’s RFC contains 13 characters.

But what does a match actually prove?

It confirms that the RFC is registered in SAT’s systems, but it doesn’t establish that the company is actively trading or compliant with every tax obligation. Nor does it verify the company’s shareholders, full business address, or the broader legal status of a Mexican company. 

The SAT validator also works as a verification tool rather than a company discovery database. Teams must already possess the RFC before they can check it; they cannot search for a corporate RFC using only a trading name or razón social.

SAT permits validation by RFC, or by Clave Única de Registro de Población (CURP) for individuals, but Mexico does not provide a public, name-searchable database of corporate RFCs. As mentioned in the org-id.guide MX-RFC reference, access to taxpayer information is limited by Mexico’s tax secrecy rules. 

So how should your team obtain the identifier?

They should request it directly from the counterparty during Mexican supplier onboarding. In Mexican B2B relationships, the RFC is normally exchanged through a contract, invoice, CFDI, or another official tax document. Requesting it upfront is therefore part of standard vendor data collection. 

Once the RFC has been obtained and validated, however, the verification process is not complete.

SAT RFC verification confirms federal tax registration, while a Registro Público de Comercio (RPC) Mexico search answers a different question. The RPC records corporate formations and subsequent commercial acts rather than tax registration.

In other words, the RFC helps confirm the taxpayer identity behind the supplier, while the RPC helps confirm the legal entity and its commercial record.

Used together, the two checks provide a stronger basis for verifying a company in Mexico than either source can provide on its own.

Check the Status Code

Once an RFC has been confirmed, the next step is to determine whether the taxpayer is Activo, Suspendido, or Cancelado (with the last status often described operationally as Baja). 

This provides a quicker health check than format validation alone. A cancelled RFC is an immediate onboarding red flag because the entity may no longer invoice or contract under that identifier.

So, what does each status mean in practice?

Before interpreting the status, however, the RFC should also pass a structural check. 

Legal entities use a 12-character RFC: three derived from the company name, six encoding the incorporation date, and a three-character homoclave. 

This fixed format helps systems flag incorrect lengths, impossible dates, or missing characters before queuing SAT.

The reason behind a cancelled status also matters. A Baja result does not always point to fraud or misconduct; it may reflect a legitimate event such as a merger. 

SAT has a specific procedure for cancelling the RFC of an absorbed company following a merger, which requires documentation including its annual return and a positive compliance opinion.

For a global company like you, this means a cancelled RFC should pause onboarding and trigger a review of the underlying corporate event. If the supplier was absorbed through a merger, contracts, CFDI records, and payment details must be transferred to the surviving legal entity before the relationship continues.

Verifying Through the State Commercial Registry

Company registration in Mexico follows a split model.

The Commercial Code provides the federal framework, but the Public Registries of Commerce across Mexico’s 32 federal entities handle the filings themselves. 

Each state RPC office records incorporations, mergers, powers and other commercial acts filed in its jurisdiction. The Secretaría de Economía provides the shared digital infrastructure, but the underlying registration work remains decentralised. 

Search SIGER 2.0 for the RPC Folio

SIGER 2.0 is the closest Mexico has to a central portal for commercial registration data. 

It helps your team connect a company to its legal name, legal form, inscription status, and folio mercantil electrónico. 

The folio is the important part. 

It acts as the company’s persistent commercial registry file. Incorporation records, power of attorney, and other registrable acts are added to it over time. 

That makes the folio more useful than a simple name match. 

As Chris Taggart, founder of legal entity database OpenCorporates, says,

Contracts and signing authority sit with specific legal entities, not with the brands under which they trade. This is precisely the information SIGER is designed to anchor. 

Mexico’s RPC confirms that SIGER records commercial acts involving merchants under Articles 18, 19, and 21 of the Commercial Code. 

But there is a limitation. 

Because each state office is responsible for updating its own records, SIGER’s completeness and freshness depend on how consistently those filings are digitised and uploaded. 

Therefore, a missing or outdated result does not automatically mean the company is unregistered. It may simply mean the state-level record has not yet reached the central portal. 

Suppose a packaging supplier claims to be incorporated in Nuevo León. 

The procurement team should search its exact legal name in SIGER 2.0, identify the corresponding RPC folio, and compare the state of registration and legal form against the supplier’s incorporation documents.

It should then review the folio history for later amendments, changes in powers, mergers, or other corporate acts.

The goal is not just to prove that a company once existed.

It is to confirm that the legal entity presented during onboarding still matches the company on record.

Fall Back to the State RPC Office Directly

In the case when a company is missing from SIGER 2.0, or its record appears incomplete, contact the relevant state RPC office directly. 

The reason is structural. 

SIGER provides the shared federal search layer, but state registries receive, review, and qualify corporate filings locally. Changes involving addresses, directors, powers of attorney, or constitutional documents may therefore appear in the state file before they become visible through a public SIGER search. 

In that situation, do not rely on a screenshot or informal copy. 

Request a certified document linked to the company’s folio mercantil electrónico. The SIGER’s registry manual explains that a certified copy confirms the RPC registration of the acts identified in the request. 

The Notario Público also plays a central, but different, role. 

The notary does not maintain the commercial registry. Instead, they create, authenticate, and certify legal instruments such as the acta constitutiva, which records the company’s name, purpose, capital, shareholders, administrators, and signing powers. The notary also verifies identities and legal compliance before the document is filed with the relevant RPC office. 

That distinction matters during diligence. 

A notarised instrument or RPC-certified copy carries more evidentiary weight than an ordinary document, but it should still be matched against the company’s folio mercantil electrónico, RFC, and current operating address.

The reason is simple: each source provides only part of the picture. RFC records confirm tax identity, whereas SIGER and state RPC documents show commercial registration. Notarial instruments provide the legal basis of corporate acts. 

In a nutshell, going directly to the state RPC office cuts through the red tape when SIGER is inconclusive. But the strongest decision comes from reconciling the certified registry evidence with the supplier’s tax, legal, and operational data. 

Verifying at Scale With Structured Data

Manual Mexican company verification works for a handful of suppliers. It does not work for thousands. 

INEGI counted almost 5.47 million economic units in 2023, following an average annual growth of 2.6% since 2008. 

Against a business universe of that size, checking SAT and state RPC records company by company is not a sustainable enterprise workflow. 

The problem is not just speed. Manual two-system verification (RFC + state RPC) creates three operational gaps. 

First, static checks produce stale risk profiles. SIGER aggregates records uploaded by individual state delegations, but coverage and freshness vary by jurisdiction. A supplier may have changed its address or operating status after the last manual review. 

Second, repeated portal searches create onboarding bottlenecks. Analysts must move between SAT, SIGER, and state RPC channels for every vendor, which slows mass onboarding. 

Third, manual search and data entry increases entity-matching risk. Exact razón social values, postal codes, and registration identifiers must be compared character by character. Minor differences can create duplicates or connect records to the wrong legal entity. 

Together, these gaps weaken the organization’s third-party risk management program by leaving procurement and compliance teams with unreliable vendor profiles. 

The solution is a comprehensive, AI-driven supplier information solution. 

That’s what Veridion’s TPRM data provides. It addresses these issues through entity resolution. It matches fragmented names, addresses, and registration identifiers to canonical company profiles, combining registry data with real-world operating signals. 

And thanks to its weekly-refreshed data, your team can detect changes without rerunning every RFC and RPD search manually. 

The value is measurable. 

A third-party risk platform integrated Veridion’s Match & Enrich API to create one continuously refreshed foundation for supplier screening. Veridion reports that combining legal and digital data increased matching accuracy from 68% with legal-only data to 97% with the fused dataset.

Records were delivered at response times of approximately 1.5 seconds, enabling the platform’s risk modules to assess current supplier identities, locations, ownership, and operational signals.

For a multinational with a large Mexican supplier base, the same approach can match RFCs, razón social, registration IDs, and business addresses in bulk.

Structured data does not replace SAT or RPC evidence. 

It automates supplier matching at speed, clears reliable records quickly, and sends only incomplete or conflicting profiles for manual review. 

Conclusion

Verifying a business in Mexico used to mean checking an RFC, searching SIGER 2.0, and contacting a state RPC office manually whenever the records did not line up. 

That approach is not scalable for large organizations.

The smart solution? An automated workflow that connects federal tax data, state commercial records, legal names, and business addresses into one continuously refreshed view. 

That reduces stale risk profiles, catches mismatches earlier, and keeps supplier onboarding moving without weakening due diligence.