Sumsub's QES Verification is a Qualified Electronic Signature-based remote onboarding and document signing solution that meets the highest identification standards in the European region. It is recognized as a compliant method for customer verification under the national AML/CDD requirements in all 30 member states of the European Economic Area (EEA). Moreover, the solution facilitates instant high-value and high-risk document signing with the legal power of a handwritten signature that is formally accepted on an international level.

Since QES Verification is consistent with the electronic trust service requirements established under the eIDAS framework, which has been incorporated into national AML/CDD law by EEA countries, businesses are not required to individually comply with jurisdiction-specific identification standards, including those of BaFin in Germany, ANSSI in France, SEPBLAC in Spain, or ADR in Romania.

The solution works by combining Sumsub's certified Identity Verification modules together with the Document Signing service enabled by a Qualified Trust Service Provider (QTSP). To complete the onboarding journey using a QES, the customer simply needs to verify their identity and seamlessly sign the relevant documents using a One-time Password delivered via SMS to their verified phone number.

Overall, QES Verification is an excellent choice for user onboarding and electronic document signing that not only helps organizations achieve regulatory compliance on an international basis, but also enables fast and effortless verification for their customers.

Use cases

QES Verification satisfies two primary use cases for Sumsub clients.

Solution benefits

• Compliance. Ensures full compliance with national AML/CTF regulations for customer onboarding in all 30 member states of the European Economic Area (EEA) as well as the United Kingdom and Ukraine.
• Scalability. Enables businesses to onboard customers on a pan-European level without having to comply with country-specific identification standards, such as those of BaFin in Germany, ANSSI in France, SEPBLAC in Spain, and ADR in Romania.
• Conversion. Improves the speed and user experience of identification and document signing in comparison to traditional verification methods accepted in Europe, leading to a direct increase in both customer conversion and approval rates.
• Legal recognition. Delivers the same legal power for document signing as a handwritten signature, making it effortless for businesses to remotely execute legally binding transactions and agreements.
• Fraud prevention. Offers the highest level of onboarding and operational security by ensuring the integrity of the signed document, authenticity of the customer data, and non-repudiation of the signing process.
• Seamless integration. Delivers an effortless product implementation experience for Sumsub clients via our lightweight MobileSDK and WebSDK frameworks.
• Audit trail. Provides a structured QES Validation Report for each verified signature, enabling clients to demonstrate regulatory compliance to auditors, counterparties, and supervisory authorities at any point in time.

How QES Verification works

QES Verification supports two flexible onboarding flows that differ in when the signature request is created. The selected flow determines both the end-user experience and service billing methodology:

• Single-level flow (Pre-verification) — recommended. The applicant signs the documents in the same session, before the identity verification is approved, so fewer applicants drop off along the way.
• Two-level flow (Post-verification) — the applicant signs the documents only after the identity verification is approved. This prevents extra signing requests and billing events.

Single-level flow (Pre-verification) Recommended

The applicant reviews and signs the documents before the final identity verification decision. Advanced security checks and the manual Operator review run in the background. As soon as the applicant's identity is verified, the Qualified Electronic Signature is issued. The whole journey takes a single, uninterrupted session, which maximizes conversion. If the applicant must resubmit their identity document, a new verification session starts automatically.

Common solution scenarios (Single-level flow)

The applicant journey depends on the results of the automated and manual security checks, as shown in the scenarios below.

Standard

When all automated as well as manual security checks are successful, the standard journey will take place.

Manual data input

When the system cannot reliably read the data from the identity document, the applicant is asked to review and edit the extracted data manually.

Selfie re-capture

When the system cannot confirm that the applicant's selfie matches the photo on their identity document, the applicant is asked to take the selfie again.

Identity document re-capture

When the system cannot confirm the authenticity of the identity document, the applicant is asked to capture the document again.

Two-level flow (Post-verification)

The applicant reviews and signs the documents only after the final identity verification decision, including the advanced security checks and the manual Operator review. The journey has three stages: Identity Verification, Operator Review, and Document Signing. Only fully verified applicants proceed to signing, so no extra signing requests are created.

Common solution scenarios (Two-level flow)

The applicant journey depends on the results of the automated and manual security checks, as shown in the scenarios below.

Standard

When all automated as well as manual security checks are successful, the standard journey will take place.

Manual data input

When the system cannot reliably read the data from the identity document, the applicant is asked to review and edit the extracted data manually.

Selfie re-capture

When the system cannot confirm that the applicant's selfie matches the photo on their identity document, the applicant is asked to take the selfie again.

Identity document re-capture

When the system cannot confirm the authenticity of the identity document, the applicant is asked to capture the document again.

Verification setups

QES Verification can be implemented either:

1. As a standalone solution, or
2. With Penny Drop Verification for an onboarding flow that is compliant under Germany's BaFin regulations.

General QES Verification flow

Step-by-step product journey:

1. ID Verification. Applicant captures their identity document, and the system verifies it via our Seamless ID Capture module.
2. Liveness check. Applicant confirms their identity document ownership and real-time presence.
3. Phone and Email Verification. Applicant submits and verifies their phone number and email address via OTP. This step can be omitted if the Sumsub client shares the verified phone number and email address data via the API before starting the onboarding.
4. Terms and conditions. Applicant agrees to the qualified certificate issuing terms and conditions.
5. Document review. Applicant reviews the relevant documents uploaded for signing by the Sumsub client.
6. OTP Authentication. One-time Password (OTP) is sent to the applicant's verified phone number and automatically filled in to confirm real-time signing.
7. Verification review. System checks the verification data and evidence, followed by a manual review.
8. Document Signing. Document is signed with a Qualified Signature and sent back to the client both via the API and the Dashboard.

Penny Drop Verification flow

Step-by-step product journey:

1. ID Verification. Applicant captures their identity document, and the system verifies it via our Seamless ID Capture module.
2. Liveness check. System collects biometric data to confirm the applicant's identity document ownership and real-time presence.
3. Phone and Email Verification. Applicant submits and verifies their phone number and email address via OTP. This step can be omitted if the Sumsub client shares the verified phone number and email address data via the API before starting the onboarding.
4. Country and bank account selection. Applicant identifies their onboarding country and bank from which the transfer will be conducted.
5. Consent review. Applicant provides consent for personal data sharing and authorizes the transaction.
6. Bank account login. Applicant logs into their online banking account via Strong Customer Authentication (SCA).
7. Payment confirmation. Applicant authorizes a nominal payment, typically of 0.10 EUR, from their account. The transferred amount can be returned.
8. Real-time presence and account ownership validation. Relevant applicant identity and account data are retrieved to confirm the applicant's real-time presence. Additionally, the system cross-checks the information to ensure a complete identity match and validate the account ownership.
9. Terms and conditions. Applicant agrees to the qualified certificate issuing terms and conditions.
10. Document review. Applicant reviews the relevant documents uploaded for signing by the Sumsub client.
11. OTP Authentication. One-time Password (OTP) is sent to the applicant's verified phone number and automatically filled in to confirm real-time signing.
12. Verification review. System checks the verification data and evidence, followed by a manual review.
13. Document Signing. Document is signed with a Qualified Signature and sent back to the client both via the API and the Dashboard.

Supported jurisdictions

QES Verification is supported in the following jurisdictions that have adopted the eIDAS regulation into their national law for trust services and electronic signatures. That includes all 30 member states of the European Economic Area (EEA) as well as the United Kingdom and Ukraine:

Supported identity documents

Sumsub's QES Verification supports all official identity documents that are recognized for remote customer verification under the eIDAS framework and the ETSI TS 119 461 technical standard. Depending on the jurisdiction, these may include National Identity Cards, Passports, Driving Licenses, and Residence Permits. Overall, the solution offers around 98% adult population coverage in each applicable country. Explore our Supported identity documents page for a full breakdown.

To qualify as authoritative evidence for remote identity proofing, an identity document must satisfy the following criteria:

• The document is recognized as official identification evidence by the issuing country or authority.
• The document is issued according to a process that is comparable to that of Passports or National Identity Cards.
• The document contains at least three security features, including at least two optically variable elements (for example, holograms, kinegrams, or other OVDs) and at least one physical feature.
• The document contains a printed facial photograph of the holder.

As optically variable features can only be viewed at a specific angle under proper lighting, during the Seamless ID Capture process, the applicant is asked to tilt the identity document back and forth so that the camera can record it in motion from multiple angles. A screenshot, paper copy, or forged identity document cannot reproduce these qualities.

Passports are required to contain the optically variable security features within the main page of the document to ensure that they can be captured and validated as part of the identification process.

The Public Register of Authentic Travel and Identity Documents Online (PRADO) establishes an official directory of authoritative identity documents of countries participating in this joint framework. The registry is not extensive, and national law enforcement and government agency guidelines may require assessment to understand if a particular document can be accepted for identification purposes.

QES Validation Report

Upon completion of the QES Verification, Sumsub can issue a Signature Validation Report, which demonstrates the authenticity and validity of the generated Qualified Electronic Signature according to the eIDAS digital certificate creation standards. The validation tool uses the European Commission’s official DSS library. A unique cryptographic hash stored in the tamper-evident audit log protects the integrity of each report. The client can verify the authenticity of each report on demand through the Sumsub platform.

The report captures the following information:

• Conformity level of the signature (B, T, LT, or LTA) according to the ETSI EN 319 102-1 standard.
• Validity status of the digital certificate against the EU List of Trusted Lists (LOTL).
• Cryptographic integrity status of the signed document.
• Timestamp of the signature validation process.
• Extended certificate subject attributes, as certified by the issuing QTSP, including:
  • Legal name
  • Date of birth
  • Nationality
  • Personal identification attributes

Once the service is enabled, Sumsub generates a Signature Validation Report for each signed document.

Supported SMS OTP countries

The OTP authentication step ensures that the same individual who verified their phone number during the initial onboarding steps signs the documents in real time. Either the client or Sumsub's Phone Verification service can verify the applicant's phone number.

For the complete list of countries where the SMS One-time Password (OTP) for document signing can be delivered, see Supported countries for QES OTP delivery.

Supported languages

The QES Verification solution currently supports the following languages:

Compliance overview

Sumsub's Qualified Electronic Signature ensures several crucial elements, which give it the same legal power as a handwritten signature:

• Integrity — no modifications to the document or its content can be made once the signature has been issued.
• Authenticity — the signature is based on a qualified certificate, which serves as proof of the signer’s identity.
• Non-repudiation — the signer cannot deny having completed the signing process themselves.

For these reasons, QES Verification adheres to the highest identification standards under the eIDAS framework (Regulation (EU) 2024/1183), which outlines the use of electronic identification and trust services and is considered equivalent to in-person customer onboarding. As a result, the solution is recognized as a compliant identification method by national AML/CTF regulatory requirements in all 30 member states of the European Economic Area (EEA) as well as the United Kingdom and Ukraine.

To further support clients’ regulatory compliance, Sumsub can issue a QES Validation Report that may be relied upon for audit, regulatory review, and dispute resolution purposes. Sumsub maintains report retention and integrity through its tamper-evident audit log, in accordance with the European Banking Authority (EBA) Guidelines on Remote Customer Onboarding (EBA/GL/2022/15).

Setup and configuration

The provided QES Verification solution scheme demonstrates the following:

• Overall solution functionality
• Required and optional steps of the end-user journey
• Integration architecture between Sumsub, our clients, and the Qualified Trust Service Provider (QTSP)

Get started with QES Verification integration

The QES Verification solution is currently supported via the following Sumsub frameworks:

• WebSDK
• MobileSDK

Refer to the complete technical integration guide to get started with the implementation process of QES Verification.

QES Verification FAQ

Find the most frequently asked questions about Qualified Electronic Signature (QES) Verification.