Signatory Identity and Digital Proof

The Heart of the Problem

An electronic signature has value only if you can prove who applied it. A simple click on "I accept" says nothing reliable about identity.

Identification Techniques

Email of Trust

Unique link sent. Only the mailbox holder can click. Foundation of simple signature (SES).

OTP via SMS

Single-use code sent to the number. Combined with email, it's the standard for advanced signature (AES).

Video KYC

Verification by videoconference: identity document, liveness test, OCR. Used for QES and regulated sectors.

Qualified Certificate

Personal cryptographic certificate issued by a QTSP. Highest level, required for QES.

National Digital Identity

FranceConnect+, itsme (Belgium), SPID (Italy). EUDIW wallets will extend this option.

Levels of Assurance (LoA)

eIDAS defines three levels:

• Low: simple email → SES

• Substantial: dual factor → AES

• High: strict verification → QES

GDPR Issues

Identification collects personal data. GDPR requires:

• Minimisation (collect only what is necessary)

• Documented retention period

• Right of access and erasure

• Legal basis (contract execution, article 6.1.b)

Biometric data (video KYC) are sensitive — explicit consent required.

KYC and Regulated Sectors

Banks, insurance, crypto, real estate brokers are subject to AML-CFT. KYC requires:

• Identity document verification with OCR

• Liveness test (dynamic selfie)

• Cross-check with sanctions databases (PEP, OFAC)

• Sometimes human operator by video

Errors to Avoid

• Relying on email alone for sensitive contracts

• Storing identity documents indefinitely

• Not documenting the legal basis

• Collecting more than necessary

Use Case: Opening a Neo-bank Account

• Entry of information (name, address, profession)

• Upload identity document + proof of residence

• Liveness test: dynamic selfie

• Contract signature in AES with SMS OTP

Within 10 minutes, account opened with "substantial" identification acceptable to ACPR.

How Certyneo Helps You

Certyneo natively offers email + SMS OTP identification (AES). For cases requiring enhanced KYC, video KYC integration is available: document verification, liveness test, sanctions cross-check.

KYC data are hosted in the EU, encrypted, with documented periods in accordance with GDPR.

Discover the Certyneo electronic signature solution

FAQ

Is email alone sufficient for a valid signature?

Technically yes for SES. For a document with stakes, prefer AES with SMS OTP.

Does GDPR prohibit storage of identity documents?

No, it regulates it. Legal basis, limited duration, enhanced security for sensitive data.

Can FranceConnect+ be used?

Yes, recognised as "substantial" level for AES or even QES.

Is video KYC mandatory for insurance?

Not as such, but ACPR expects enhanced identification.

Sign with an identity from another EU country?

Yes, mutual recognition of eIDAS (itsme, SPID, nPA).

Conclusion

Identification is the weakest link in the proof chain. Take care of it according to the stakes, and your signature will be solid.

Try Certyneo to send, sign and track your documents online simply, quickly and securely.