What's the NOM-151 and why does it matter in digital contracts?

Imagine your company signing a credit contract with a client, all in digital and paper-free. The electronic signature is there, the document exists and the parties have accepted it. Nevertheless, months later the client challenges the agreement before a judge arguing that they did not sign that version, or that the date is wrong. How do you prove that the document was true, that it was not modified and that it was signed exactly when they say it was signed? That's where the document was signed. NOM-151-SCFI-2016 ceases to be bureaucracy and becomes his best legal argument.

What's the NOM-151-SCFI-2016?

The NOM-151-SCFI-2016, with an official title Requirements to be met for data message maintenance and document digitizationIt entered into force in 2017 and lays down the technical and legal specifications to be met by any organization that wants to give evidence to its electronic documents and signatures in Mexico.

The heart of the norm is simple but powerful: every document or data message that purports to have legal validity should have a time stamp certified issued by a Certification Service Provider (PSC) Without that seal, the date and integrity of the document are, from a legal perspective, mere statements without verifiable technical support.

The norm applies both to documents originally generated in digital and to digitalised physical documents, making them the reference framework for practically any paper-free documentary process in the country.

How does the certified time stamp work?

The technical process behind the seal NOM-151 It's strict and designed to be mathematically irrefutable.

1. Hash generation SHA-256. Once the document is ready to be sealed, the system generates a unique fingerprint using the SHA-256 cryptographic algorithm. That fingerprint is a string of characters that represents the document's contents as a single form: any change, as a minimum, produces a completely different fingerprint.
2. The PSC Stamp the time seal. The hash is sent to an SE authorized certification service provider. PSC record the exact time at a time server synchronized with official sources and link that time data to the document's hash with a cryptographic secure form.
3. The stamp is attached to the document. The time seal token is incorporated into the document's file so that any auditor or authority can independently verify both the integrity of the content and the exact time at which it was sealed.
4. Any subsequent modifications are detectable. If anyone disrupts the document after sealed, even if it's a blank space, the result hash will not match that of the PSC The damage was automatically exposed with no additional forensic analysis or expert examination required.

Why does it matter about digital contracts?

Having NOM-151 certification on your digital contracts is not an additional formality; it is the difference between a document that withstands legal scrutiny and one that can easily be challenged. These are the four main reasons:

• Probatory status. The Commercial Code (Articles 89 to 114) and the Federal Civil Code recognize data messages as valid evidence at trial, as long as they meet the maintenance requirements established by NOM-151A contract without a seal can be admitted as an indication but rarely as full evidence.
• Resistance to challenges. Most challenges to digital contracts are based on two arguments: "I did not sign that" or "that document was modified." NOM-151 He missees both of them at the same place: Proof who signed and at what time, and guarantees that his contents have been unchanged since.
• Regulatory compliance with CNBV, SAT and other authorities. Multiple Mexican regulators expressly demand or recommend certification NOM-151 as a standard for keeping digital archives. Ignorance of them may mean monitoring of audits, administrative sanctions or the nullity of legal acts.
• A permanent and auditable file. The rule also defines long term custody requirements. NOM-151 can be checked five, ten or twenty years later with the same certainty as the day of its creation, and this is necessary for credit portfolios, lease contracts, insurance policies and any document with prolonged validity.

What sectors do they need? NOM-151 Do we have to?

Although the rule is applicable to any entity that retains data messages, there are sectors where its compliance is especially critical or accompanied by specific regulatory obligations:

• Financial institutions monitored by CNBV. Loan and factorage banks have to preserve contracts, statements and client files with standards that CNBV directly to NOM-151Non-compliance can result in high-level sanctions and even the revocation of authorisations.
• Fintech and financial technology institutions (FTT). The Fintech Act and its supplementary provisions require collective financing platforms and electronic payment fund institutions to maintain digital archives with the requirements of NOM-151as most of their operations are 100% digital and with no physical presence.
• Loan of real estate and vehicles. Long term lease contracts involve important amounts and extended periods. NOM-151 It's the only technical guarantee that the contract that's shown before a judge is identical to that that that the parties have signed.
• Credit and financing contracts. From personal credit to corporate financing, any debt instrument in digital format should be capable of showing date and content authenticity. NOM-151the creditor takes a considerable legal risk.
• Sales of high-value goods. Cars, machinery, computation equipment and other capital goods are increasingly sold with completely digital contracts. NOM-151 ensures that the evidence of the transaction is legally sound.
• Security sector. Electronic policies and insurance addendas have to be preserved under the standards of the rule so that they are fully valid with the CNSF and in case of a claim or dispute.

Signature with NOM-151 vs. signature without NOM-151

The difference between these two options is a matter of form and a matter of law.

as the comparison shows, the sign without NOM-151 may be valid in low-risk transactions but in credit contracts, leases, financial services or any relevant law, the absence of a certified stamp is a risk that serious organisations simply cannot accept.

How to get a signature with certification NOM-151?

The good news is that with the right platform, the process is completely transparent for signatories. JAAK, complete flow occurs in minutes and without friction:

1. Loading of the document. The person responsible uploads the contract or document to the JAAKThe system accepts PDF and other standard formats and automatically converts them to the required format for the certification process.
2. Signators get a secure league. Each person to sign gets a unique and non-transferable link by email or SMS. He doesn't have to install an application or have an earlier digital certificate.
3. Sign with biometric check. The signatory conduct the authentication process by facial recognition and validation of an official identity document (INE/ IFE, passport, etc), which guarantees that whoever sign is who they say they are.
4. The PSC generates time seal NOM-151. At the exact time of completion of the last sign, the Certification Service Provider integrated into the platform automatically prints the time seal onto the document's hash. That step takes place in seconds and is completely invisible to the end user.
5. Generation of the auditable record. JAAK produces a complete file that includes the signed document, the NOM-151 seal, the biometric authentication records, the evidence of acceptance by each party and the digital chain of custody. This file can be downloaded, stored and presented as evidence at any time.

The result is a document that concurrently complies with NOM-151-SCFI-2016 with the requirements of CNBV for digital files and with best international advanced electronic signature practice.