Mexico RFC Validator

RFC (Registro Federal de Contribuyentes): Mexico's tax identifier

The RFC (Registro Federal de Contribuyentes) is the unique tax identifier issued in Mexico by the SAT (Servicio de Administracion Tributaria). Every individual or legal entity subject to ISR (Impuesto Sobre la Renta), IVA (Impuesto al Valor Agregado) or any SAT regime must obtain one. The RFC also appears on every CFDI (Comprobante Fiscal Digital por Internet), the electronic invoice mandated nationwide since 2014 and currently at version 4.0.

For Brazilian companies expanding into Mexico — Mercado Livre, Stone, Magazine Luiza, Globant, Locaweb and dozens of fintechs — the RFC is the equivalent of CPF + CNPJ rolled into one alphanumeric code derived deterministically from name and date. Roughly 90 million RFCs are active in Mexico, covering virtually every adult and every registered company.

Unlike CPF (Brazil) or RUT (Chile), the RFC is partially semantic: the first 10 (PF) or 9 (PM) characters are derived from public attributes — name and date — while the final 3-character homoclave is computed by SAT to disambiguate homonyms.

Format: 13 characters for individuals, 12 for companies

There are two RFC variants:

• Persona Fisica (PF): 13 characters — 4 letters from the holder's name + 6 digits AAMMDD birth date + 3-character homoclave. Example: VECJ880326XXX for Juan Velazquez Cordova born 1988-03-26.
• Persona Moral (PM): 12 characters — 3 letters from the company name + 6 digits AAMMDD incorporation date + 3-character homoclave. Example: ABC120101XYZ.

The letter block follows strict rules: for PF the first letter is the first character of the first apellido (paterno), the second is the first internal vowel of the same apellido, the third is the first letter of the second apellido (materno), and the fourth is the first letter of the first nombre. A dictionary of "palabras obligatorias" (BUEI, CACA, COGE, etc.) is replaced with X to avoid offensive RFCs.

The homoclave and the SAT check digit

The 3-character homoclave is split into two parts:

• Characters 11-12 (PF) or 10-11 (PM): a base-34 hash of the full official name, computed via a SAT-published table.
• Character 13 (PF) or 12 (PM): a modulo 11 check digit using a numeric table that maps each character (0-9, A-Z, plus the space) to an integer.

The check-digit table assigns: 0=0, 1=1, ..., 9=9, A=10, B=11, ..., N=23, &=24, O=25, ..., Z=37, space=37, plus a special "Y/Z" terminal value. The first 12 characters are multiplied by descending weights from 13 down to 2, summed, and reduced modulo 11. If resto == 10, the check digit is the letter A; otherwise it is the decimal digit.

// Pseudocode for the SAT mod 11 check digit
const VAL = { '0':0, /* ... */, 'A':10, 'B':11, /* ... */, '&':24, 'O':25, /* ... */, 'Z':37, ' ':37 };
function rfcCheckDigit(first12) {
  let s = 0;
  for (let i = 0; i < 12; i++) s += VAL[first12[i]] * (13 - i);
  const r = s % 11;
  const dv = 11 - r;
  if (dv === 11) return '0';
  if (dv === 10) return 'A';
  return String(dv);
}

Because the homoclave depends on the official birth certificate name (with all its accents, multiple given names and order), reproducing it deterministically from third-party data is impossible — only the SAT can issue the canonical RFC. Validators like this one can confirm the structure and check digit, but cannot prove the homoclave matches the holder.

RFC, CURP and e.firma: three separate identifiers

A frequent source of confusion in onboarding flows:

• RFC — fiscal identifier issued by SAT. 12 or 13 chars. Used for invoicing, ISR, IVA, payroll.
• CURP — civil identifier issued by RENAPO. 18 chars, derived from name + birth date + gender + state of birth. Used for school enrollment, civil registry, INE voter card.
• e.firma (FIEL) — digital signature certificate issued by SAT. Tied to RFC + private key + .cer file. Required to sign CFDIs and most SAT declarations.

The CURP and RFC for an individual share the first 10 characters (4 name letters + 6 birth date digits). The remaining characters differ: CURP appends gender, state and 2 disambiguation chars; RFC appends the 3-char homoclave.

Where the RFC is mandatory in Mexico

• Issuing or receiving any CFDI 4.0 (Comprobante Fiscal Digital por Internet).
• Declaring ISR, IVA and IEPS.
• Registering employees with IMSS and Infonavit.
• Opening a bank account or signing up for SAT's "Mi Cuenta".
• Importing or exporting through the SAT Aduanas system.
• Onboarding on Mercado Libre, Amazon Mexico, Rappi or Didi as a vendor.
• Buying real estate, vehicles or registering trademarks at the IMPI.
• Receiving severance, scholarships or government welfare.

Validation libraries and integration tips

Mature open-source libraries include rfc-validator, rfc-facil and mexican-rfc on npm, plus python-stdnum's stdnum.mx.rfc. SAT exposes the Constancia de Situacion Fiscal portal which returns the official RFC status given the holder credentials; there is no anonymous lookup API. Brazilian developers integrating CFDIs typically rely on PACs (Proveedores Autorizados de Certificacion) such as Solucion Factible, Edicom or Diverza, which handle the e.firma signing and SAT submission.

Validate the structural pattern first (regex) and only then run the check-digit routine. Always uppercase the input — the SAT considers vecj880326 and VECJ880326 identical, but most regexes do not.

FAQ

Why are there two RFC lengths?

Persona Fisica RFCs are 13 characters because they use 4 letters from the holder's first name + paternal + maternal surnames. Persona Moral RFCs are 12 characters because companies have a single name from which only 3 letters are extracted.

What exactly is the homoclave?

It is a 3-character suffix that SAT assigns to disambiguate two holders born on the same date with the same name letters. The first two characters are a hash of the official full name; the third is a mod 11 check digit. Only SAT knows the canonical hash table.

Can a foreign individual obtain an RFC?

Yes, with temporary or permanent residency, a CURP and a Mexican domicile. Foreigners with no residency can obtain a generic XEXX010101000 (PF) or XAXX010101000 (PM) RFC, used by SAT to issue CFDIs to unidentified foreign counterparties.

Does this validator query SAT?

No. The structural and check-digit verification runs locally in your browser. To confirm the RFC is active and matches the holder, use the official "Constancia de Situacion Fiscal" service at sat.gob.mx.

Is the RFC enough to issue a CFDI?

No. You also need an active e.firma certificate, a SAT-authorized PAC and the CFDI 4.0 XML schema. The RFC only identifies the issuer and the receiver.