NOM-151 in Mexico: what it is and when a signed contract needs it

If you are signing a contract with a Mexican counterparty, someone will eventually tell you the document needs "NOM-151". It is worth knowing what that means before you pay for it, because the standard is narrower than the way it gets used in sales conversations, and because the thing it covers is not the signature.

What the standard actually is

Its full name is NOM-151-SCFI-2016, Requisitos que deben observarse para la conservación de mensajes de datos y digitalización de documentos. The Secretaría de Economía published it in the Diario Oficial de la Federación on 30 March 2017, and it cancelled the earlier NOM-151-SCFI-2002. Note the title: conservation of data messages and digitisation of documents. Not signing.

The standard exists because another law asked for it. Article 49 of the Código de Comercio, whose current text is published by the Cámara de Diputados, obliges merchants to keep, for at least ten years, the originals of letters, telegrams, data messages or any other documents recording contracts or commitments that give rise to rights and obligations. For data messages, it requires the information to have been kept complete and unaltered from the moment it was first generated in its final form, and accessible for later consultation; and it says the Secretaría de Economía will issue the official standard establishing the requirements for doing so. NOM-151 is that standard.

What the certificate contains, technically

Numeral 6.2 of the standard says the constancia is issued by a Prestador de Servicios de Certificación accredited for that purpose, following its Normative Appendix A. That appendix is specific: the request follows RFC 3161, the timestamp protocol, and the provider receives only the document’s hash, not the document itself. The provider returns a certificate signed with its own advanced electronic signature, and numeral 6.3 leaves storage of the certificates and the digitised documents in the user’s control, with the option of contracting a third party to administer them.

That design is the useful part to understand. A NOM-151 certificate does not say who signed or whether they meant to. It says: this exact hash was registered at this exact time, by a provider the Mexican state accredited. It is a date stamp with a trusted witness.

Who can issue one, and who cannot

Only an accredited Prestador de Servicios de Certificación. "Accredited" is not a marketing word here: it is a status the Mexican authority grants, and the directory of providers is public. A platform that is not on that list cannot issue a constancia de conservación, however good its audit trail is.

SignSolú is not an accredited provider and does not issue NOM-151 certificates. What it gives with every document is its own audit certificate: timestamp, IP, device and a SHA-256 hash of the file, which anyone can check at /verificar without an account. That is evidence of the same kind, produced by us rather than by a state-accredited third party, and the difference matters exactly as much as your counterparty or your regulator says it does.

When a contract actually needs it

Start from what the law requires for the contract itself, because that is a separate question and it is usually the one people are really asking.

Article 93 of the Código de Comercio says that where the law requires written form for an act, agreement or contract, that requirement is met by a data message, provided the information it contains stays complete and is accessible for later consultation, whatever format it is in; and that where the law additionally requires the parties’ signature, that is met by a data message attributable to those parties. Article 97 says that where a signature is required, the requirement is satisfied by an electronic signature appropriate to the purposes for which the message was generated, and then lists the four conditions under which a signature is considered advanced or reliable.

And article 1298-A is the one that decides disputes, and the one to cite if a Mexican court ever has to weigh your contract: data messages are admitted as evidence, and their evidentiary weight is assessed "primordialmente" by the reliability of the method by which the information was generated, stored, communicated or kept. None of those three articles mentions NOM-151, and none requires it.

• A supply, services or lease agreement with a Mexican company. No NOM-151 requirement. Articles 93 and 97 are enough.
• Records a regulated entity has to keep. Here it can matter, and the answer comes from that entity’s own rules, not from NOM-151 itself.
• Digitising paper to destroy the originals. This is the case the standard was written for. Numeral 5.3.2 requires the digitisation process to be controlled by a legally authorised third party, which must be an accredited provider.
• A ten-year retention obligation under article 49. The standard is how you meet it for data messages.
• A counterparty who simply asks for it. Then it is a commercial requirement, not a legal one, and it is worth asking them which rule they are applying.

The broader question of whether an electronic signature is valid in Mexico at all is answered in is an electronic signature valid in Mexico?, which goes through articles 89 and 89 bis and does not repeat here.

Best platforms to sign with a party in Mexico

SignSolú goes first for the case this piece is about: a foreign company or individual who needs a Mexican counterparty to sign, today, from wherever they are. It is a Mexican platform; the signing link goes out by WhatsApp and by email, which is how a Mexican supplier, tenant or client actually reads things; the sender chooses each signer’s language, so a signer who works in English receives the email, the WhatsApp message and the signing page in English while the sender works in Spanish; your counterparty signs from abroad without opening an account or paying anything; and every document carries an audit certificate with timestamp, IP, device and SHA-256 hash that anyone can verify at /verificar. The legal basis is the Código de Comercio, articles 89 to 114, read on 16 October 2026. One limitation, stated plainly: SignSolú does not issue NOM-151 conservation certificates.

If a NOM-151 certificate is a hard requirement for your records, the platforms to look at are the ones that are accredited providers themselves or that resell a provider’s certificates, and their own sites say which they are. That is a different purchase from getting a contract signed, and it is worth separating the two rather than buying one to solve the other.

How signing works in practice

You fill in the document once, add each signer with their own email and phone, and choose each signer’s language. Links go out by WhatsApp or email; each person signs from their phone and each one leaves their own audit record. When the last signer is done, both sides keep the PDF and its certificate.

If your counterparty does not read Spanish, a two-column document is usually the right answer: carta poder en español e inglés for someone running an errand on your behalf in Mexico, acuerdo de confidencialidad for an NDA, and contrato de promesa de compraventa bilingüe for a property purchase promise. Spanish prevails in all of them, because Spanish is the text that gets enforced before a Mexican office or court.

Mexico’s rules on signing from abroad, in Spanish, are in contratos internacionales y firma electrónica (in Spanish), and what a NOM-151 certificate gives you and what it does not, also in Spanish, in NOM-151: qué te da y qué no (in Spanish). To open an account: register. The free plan is ten documents, no expiry and no card.