Signing with a Qualified Electronic Signature (QES)

This guide provides a step-by-step explanation of the process for verifying your identity and digitally signing a document using a Qualified Electronic Signature (QES) to completion.

What is a Qualified Electronic Signature?

A Qualified Electronic Signature (QES) is the highest level of electronic signature recognised under EU law. It's backed by a digital certificate issued in your name by a regulated authority called a Qualified Trust Service Provider (QTSP) — in this case, InfoCert.

When you sign using QES, your identity is verified first, and then your signature is cryptographically linked to both your identity and the document you're signing. This means the document cannot be altered after signing without the change being detected.

QES is accepted as a valid form of identity verification and contract signing in all EU member states, without any additional paperwork.

What you'll need

Before you start, make sure you have the following:

• A valid identity document — passport, national ID card, or residence permit. The document must not be expired.
• A phone number you have access to — you'll receive a one-time code (OTP) by SMS during the signing step.
• A device with a working camera — you'll need to scan your document and take a short selfie for the liveness check.
• Good lighting — find a well-lit space before you begin. Poor lighting is the most common reason a liveness check fails.
• A few minutes — the full process typically takes 3–7 minutes.

Here's what will happen during your verification and signing session:

1. Scan your identity document

   • You'll be asked to photograph the front side of your identity document. In some cases, you may also be asked to photograph the back side.
   • Your personal data will be scanned by the system automatically. Should the scan be unsuccessful, you'll be asked to clarify the details.

2. Complete the liveness check

   • To confirm your physical presence, you will be asked to look at the camera and slowly move your head as instructed. This is an automated process, not a live video call, and no human is monitoring you in real time.
   • Please remove your glasses if possible, ensure your face is well-lit, and follow the on-screen prompts.

3. Verify your phone number (if required)

   • You may be asked to verify your phone number or email address by entering a one-time code sent to you. This step may already be completed by the app or website you're using.

4. Accept the certificate issuing terms

   • InfoCert will create a digital certificate in your name. You must accept the terms and conditions from InfoCert, a regulated EU authority, to proceed.
   • This is a mandatory step; your signature cannot be issued without your acceptance.

5. Review and sign the document

   • The document(s) you need to sign will be displayed for your review. Please take a moment to read them . Once you are ready, a one-time code will be automatically sent via SMS to your phone number.
   • Enter the code to confirm your signature. The document is now signed with a Qualified Electronic Signature in your name.

6. Verification is reviewed and completed

   • Your verification data undergoes a review process, typically completed in a few minutes, either automatically or by a Sumsub operator.
   • Once confirmed, you will be notified via the app or website. The signed document is then delivered to the organization you are signing with.

Your Identity and Your Data

We understand that going through an identity verification process raises questions about what happens to your personal data. Here's what you should know.

What information is collected

• The data on your identity document: your name, date of birth, document number and nationality.
• A biometric photo from your document and a liveness selfie
• Your phone number and email address (if provided during the verification)

Who processes your data

Your data is processed by Sumsub on behalf of the organisation you are signing with. The qualified certificate in your name is issued by InfoCert, a certified EU trust service provider, which processes your identity data to fulfil its function.

How your data is protected

• All data is transmitted over encrypted connections.
• Sumsub does not sell your personal data to third parties.
• Data retention periods are governed by the agreement between Sumsub and the organisation you're signing with, as well as by applicable law.

👁️‍🗨️Something Went Wrong?

Here are the most common issues and how to fix them quickly.

📩 I didn't receive the SMS code

• Wait 60 seconds, then tap "Resend code".
• Verify that the phone number displayed on the screen is correct.
• If you're in an area with poor signal, move to a better location and try again.
• Some carriers may delay or block short-code messages — try restarting your phone or using a different network connection.

📷 The liveness check keeps failing

• Make sure you are in a well-lit room, facing a light source. Avoid having a bright window or a different light source behind you.
• Remove glasses, hats, or anything covering your face.
• Hold your device at eye level and follow the on-screen movements slowly and steadily.
• Keep your device still and only move your head.

🪪 My document is not being recognised

• Place your document on a dark, flat surface with no reflections or glare.
• Make sure all four corners are visible in the frame.
• Avoid photographing through a plastic sleeve or laminate cover.
• If your document is damaged or heavily worn, contact the issuing authority for a replacement before proceeding.

📋 I'm being asked to accept terms from InfoCert — who are they?

InfoCert is an EU-certified Qualified Trust Service Provider (QTSP). They issue the digital certificate that makes your electronic signature legally valid under EU law. Accepting their terms is required for the signature to be issued.

⏳ My verification is stuck or pending for a long time

Most verifications are completed within a few minutes. Occasionally, a manual review by a Sumsub operator is required, which can take up to a few hours. You will be notified automatically when the review is complete. If you have not received a notification after 24 hours, contact the organisation you're signing with.

❌ My verification was rejected

You should receive a notification explaining the reason for rejection. Common reasons include: a document that has expired, a mismatch between your face and your document photo, or an inability to confirm your identity from the information provided. Contact the organisation you're signing with — they will advise on next steps.

🔐 I'm concerned about sharing my ID and biometric data online

Sumsub is a trusted identity verification platform used by regulated financial institutions across the EU. Your data is processed under strict GDPR requirements. The biometric liveness check does not store a video recording — it is used only to confirm your real-time presence. For full details, see Sumsub's Privacy Policy at sumsub.com/privacy-notice.

👁️‍🗨️FAQ

Is this the same as a regular email signature or e-signature?

No. A Qualified Electronic Signature (QES) is the highest legal level of electronic signature in the EU. Unlike a simple typed name or a standard e-signature, a QES is backed by a digital certificate issued in your name by a regulated authority, and it carries the same legal weight as a handwritten signature.

Do I need an existing digital certificate or special device?

No. A new certificate is created in your name during the verification process. You don't need any prior certificate, digital ID, smart card, or USB token. Everything happens through the app or website you're using.

What documents are accepted?

Passports, national ID cards, and residence permits from a wide range of countries are accepted. The document must be valid and not expired.

Can I sign from my phone?

Yes. The process works on smartphones, tablets, and computers with a camera. Make sure your browser or app is up to date for the best experience.

Will I receive a copy of the signed document?

Whether you receive a copy of the signed document depends on the organisation you're signing with. Please contact them directly if you need a copy for your records.

What is the SMS code for? Is it safe?

The SMS code (OTP — One-Time Password) is sent to your verified phone number to confirm that you are actively authorising the signing action. It works similarly to two-factor authentication used by banks. Never share this code with anyone — no Sumsub employee or support agent will ever ask for it.

Can I undo or cancel the signature after signing?

Once a Qualified Electronic Signature has been applied, it cannot be undone — just like a handwritten signature on a paper contract. If you have concerns about what you signed, contact the organisation that asked you to sign the document.

I'm not in the EU. Can I still complete this process?

You may be able to complete the process depending on your document type and the requirements of the organisation you're signing with. QES is legally recognised in all EEA member states, the UK, and Ukraine. If you are outside this area, contact the organisation directly to confirm whether QES verification applies to your situation.