This article provides a complete guide on how to integrate QES Verification into your verification flows.

Step 1: Implementation setup

To get started with Qualified Electronic Signature (QES) Verification:

1. Contact your Customer Success Manager to receive login credentials for a new Sumsub account, which has been specifically set up for the QES Verification solution.
2. Generate an app token to start using the Sumsub API.
3. Set up webhooks to get verification results. To manage QES verification results, you will need to configure and use the applicantReviewed webhook.
4. Get started with the SDK implementation, as described in the web SDK integration article and the mobile SDK integration article.

Step 2: Adjust the user flow

On your new Sumsub Client Dasboard account, you will have access to a pre-configured workflow that consists of two levels:

• The first level is designated for identity verification.
• The second level is configured for document signing.

This approach ensures that the signing process will only begin once the identity verification has been successfully completed.

Upload documents for applicant signing

In the Sumsub Dashboard, open the dedicated verification level with the E-sign step and upload the documents for signing. Specify the following parameters during the process:

• The number of documents that should be signed.
• Whether the signature should be visually displayed in the document.
• The document page(s) where the signature(s) should be placed.
• The exact position of the signature within the page.
• The size of the displayed signature.

By default, each signature displayed within the client document(s) will contain the following information:

• Name of the signer.
• Legal basis for Qualified Signature creation.
• Date of the Qualified Signature creation.

📘

Note

Both the signature size and positions are specified in PDF units. For example, the A4 page size of 210mm x 297mm = 595 x 842 PDF units.

Configure Email and Phone Verification

Email and Phone verification is required both for regulatory compliance and document signing purposes.

There are two primary options how this can be completed:

1. Clients may choose to verify their users' email and phone number at the initial registration steps and pass this information over to Sumsub via the API. To do so, create an applicant in advance and share the email and phone attributes in the request body.
   cURL

   curl -X POST \
     'https://api.sumsub.com/resources/applicants?levelName=QES-IDV' \
     -H 'Content-Type: application/json' \
     -d '{
             "externalUserId": "someUniqueUserId",
             "email": "erika@test.com",
             "phone": "+4912389032156"
         }'
   

2. Alternatively, Sumsub can handle these steps for you. To do so, include Email and Phone verification steps in your flow.

Enable AML Screening and Monitoring

AML Screening and Monitoring helps you check your customers against the following watchlists during the onboarding:

• Sanctions
• PEPs
• Adverse Media
• Regulatory Exposure
• Law Enforcement Actions
• State-owned Enterprises

Document exchange and signature placement

1. Signature placement configuration:
   • Define the position on the document where the Qualified Signature should appear (e.g., bottom-right corner of the final page).
   • You can configure this via the Sumsub Dashboard.
2. Document types and multi-document signing:
   • Sumsub supports signing multiple documents in a single session. Signed documents are returned to the client through both:
     • Results Panel on the Sumsub Client Dashboard.
     • Dedicated API endpoint for signed document downloads.

Step 3: Verify identity via Web and Mobile SDKs

Use our Web and Mobile SDK frameworks to conduct QES Verification code-free:

1. Generate an access token associated with the userId (externalUserId) and levelName used for identity verification.
2. Launch the SDK and conduct identity verification.
3. Receive and handle verification results.

🚧

Important

QES verification is supported only in the WebSDK 2.0 and MobileSDK starting from version 1.33.0 or higher.

Step 4: Listen to webhooks

Once verification is complete, the results are automatically delivered with the applicantReviewed webhook.

This webhook contains the reviewResult object that includes the reviewAnswer field, indicating the verification status. If it is GREEN, it means QES Verification successfully completed, and you can get QES Verification results. If it is RED, the applicant has not passed verification; the reviewRejectType is set to RETRY or FINAL:

• FINAL — indicates a final applicant rejection.
• RETRY — applicants are allowed to resubmit their documents and repeat verification.

Step 5: Get verification results

You can get QES Verification results in either of the following ways:

• Using the Sumsub Dashboard
• Using the Sumsub API

Get verification results in Dashboard

To view the results of QES Verification in the Dashboard:

1. Navigate to the Applicants page and open the profile that you need.
2. Scroll down to the Qualified Electronic Signature section and review the results.

Get verification results via API

To get the results of QES Verification via the API, use this method, as the following example demonstrates.

Request

curl -X GET \
  'https://api.sumsub.com/resources/checks/latest?type=E_SIGN&applicantId={applicantId}'

Response

The response will include detailed personal information that was verified to issue a Qualified Signature and basic details about the signed documents.

{
  "checks": [
    {
      "answer": "GREEN",
      "checkType": "E_SIGN",
      "createdAt": "2024-11-12 10:28:06",
      "id": "1cdf9711-4d50-4659-b82a-a12c330dc797",
      "inputDoc": {
        "idDocType": "PASSPORT",
        "country": "DEU",
        "firstName": "MUSTERMANN",
        "lastName": "ERIKA",
        "validUntil": "2027-02-28",
        "number": "C01XYCCG9",
        "dob": "1964-08-12",
        "email": "erika@test.com",
        "phone": "+4912389032156"
      },
      "esignCheckInfo": {
        "unsignedDocuments": [
          {
            "id": "1672018978",
            "imageId": 1672018978,
            "name": "Terms And Conditions.pdf"
          }
        ],
        "signedDocuments": [
          {
            "id": "1672018978",
            "imageId": 1919960264,  // Use this ID to receive signed document
            "name": "Terms And Conditions.pdf",
            "signedAt": "2024-11-12 10:28:37"
          }
        ]
      }
    }
  ]
}

The complete scope of possible applicant output data as a result of successful verification includes:

📘

Note

Unless requested specifically by the client for AML purposes, the standard solution output will be limited to (1) Applicant personal data, required to issue the QES, (2) Signed client document(s), and (3) Payment transaction details (applicable exclusively to the Penny Drop Verification flow). This is done to ensure the 'data minimization' principle under Art. 5 (c) of the GDPR and article 4(1)(c) of Regulation (EU) 2018/1725. From a compliance standpoint, the user verification is conducted specifically on the basis of a Qualified Electronic Signature, Therefore, there is no legitimate purpose for our clients to process Identity Document or Biometric applicant data.

Step 6: Receive signed documents

After receiving the QES Verification results, you can obtain the signed documents.

The signedDocuments array from the response will include the following information:

• id — unique identifier of the signed document in the Sumsub system.
• imageId — unique identifier that is used to obtain the signed document.
• name — document title that was specified during the document upload in the level settings.
• signedAt — date and time when the document was signed.

Note that there can be several objects in the signedDocuments array.

Each signed document will be issued an imageId. Submit this ID to the get signed documents API method in order to retrieve the document.

The response will contain a binary content representing the signed document. The Content-Type response header precisely describes the response mime-type:

HTTP/1.1 200 OK
Date: Wed, 13 Nov 2024 10:44:38 GMT
Content-Type: application/pdf
Content-Length: 239371
Connection: keep-alive
x-correlation-id: 85e3033ee12d196b8400322e03e47b36
Content-Encoding: identity
content-disposition: attachment; filename=Terms+And+Conditions.pdf
 
<Binary content representing the signed document>