Aroosa Virk
London, United Kingdom, 24 June 2026— Verifying who a customer is addresses only half of regulated onboarding.
The other half, carrying that verified identity through to a legally binding signature that can withstand regulatory scrutiny, audit, or legal challenge, has often been handled in separate system.
Under the eIDAS Regulation, a Qualified Electronic Signature (QES), the only electronic signature with the same legal effect as a handwritten one across all 27 EU member states, under Article 25, draws its validity from the identity verification behind the Qualified Certificate.
Verification and signing are, in effect, a single evidentiary chain. When they run in separate systems from separate vendors, the chain breaks at the seam: the proof that a signature belongs to a genuinely verified person weakens, audit trails fragment, and fraud finds an opening.
To close this gap, Shufti, a global identity verification and AML compliance provider, has partnered with Evrotrust, a Qualified Trust Service Provider on the EU Trusted List, to enable a single onboarding journey.
Shufti handles identity verification, onboarding orchestration, and compliance controls; Evrotrust issues the Qualified Certificate and performs the qualified signing, available wherever QES is recognised under eIDAS. This allows businesses to carry a verified identity through to a legally binding, eIDAS-qualified signature in one auditable flow.
“The future of digital trust will be built through collaboration. Our collaboration with Shufti reflects a shared vision for the future of digital trust, one where security, compliance, and user experience go hand in hand. Together, we are creating a stronger foundation for businesses across Europe to grow with confidence,” said Konstantin Bezuhanov, CEO at Evrotrust.
How Requirements Differ Across Regulated Sectors
The relevance of qualified signing varies by sector.
Banking & lending: High-value agreements such as loans or mortgages often involve additional verification or signing steps depending on risk policy and jurisdictional requirements. Under eIDAS (Regulation (EU) No 910/2014), Qualified Electronic Signatures (QES) provide legal equivalence to handwritten signatures where implemented.
Insurance: Long-term products such as life and pension policies rely on strong evidence of customer consent and signature integrity, particularly in cases where agreements are later challenged or disputed.
Investment & wealth: Mandates and authorisations require a verifiable link between the identified client and the instruction or agreement under regulated advisory and execution frameworks.
Across fintech, payments, healthcare, real estate, and legal services, the underlying requirement is similar: a durable, verifiable link between identity and signature.
From Verified Identity To Qualified Signature
Shufti verifies the customer through document and biometric checks, NFC-enabled document reads, or national eID schemes. The verified details pass securely to Evrotrust, which issues the Qualified Certificate and signs a cryptographic hash of the document. The resulting signature is then embedded back into the file.
Only a hash of the document is ever sent for signing, so the document itself can stay entirely within the organisation’s own environment.
The signature is embedded in PAdES-LTV file with long-term validation, keeping it verifiable for up to 20 years, while the supporting evidence package is retained for 10 years per signed document.
Under eIDAS Article 25, the signature is automatically recognised across the EU and the wider EEA, so its legal standing holds in every member state without separate validation, even where the underlying transaction carries its own local rules.
A single verified session can carry the signer through several documents at once, not just one.
The organisation keeps full evidence package and audit trail, while the signer receives the finished signed document.
The whole flow runs through a single API across web and mobile.
Because verification and signing share single record, a challenged agreement can be evidenced from one trail rather than reconciled across two systems.
“This partnership reflects how we’re building Shufti, one platform that handles identity, AML, and fraud, now extended to qualified electronic signatures through Evrotrust,” said Roger Redfearn-Tyrzyk, Chief Commercial Officer at Shufti. “Bringing QES into the platform gives regulated businesses a single trusted journey from onboarding through to legally binding signature, and lets us enable eID and EUDI wallets paired with qualified signing for fully compliant eIDAS 2.0 journeys.”
Built for What’s Coming Under eIDAS 2.0 and AMLR
The partnership comes amid changes to Europe’s digital identity and compliance framework.
From 10 July 2027, the EU’s Anti-Money Laundering Regulation (AMLR) is set to make Qualified Electronic Signatures, notified eIDs, and the EU Digital Identity Wallet primary methods for compliant onboarding, with remote video identification moving to a fallback role.
A parallel change applies to ETSI TS 119 461, the standard for identity proofing. Verification currently operates under v1, which is eIDAS-compliant. From 19 August 2027, v2.1.1 takes effect and introduces a higher tier, the Extended Level of Identity Proofing (LoIP). Shufti has stated it is on a roadmap to v2.1.1 certification ahead of that deadline, positioning it for eID and EUDI Wallet-based onboarding.
Redfearn-Tyrzyk further added: “Because we own our core technology, we adapt to regulatory change at speed, from the incoming AMLR single rulebook to evolving eIDAS requirements, far faster than legacy providers can. We’re proud to extend Shufti’s verification to Evrotrust’s clients and to bring qualified signing to ours.”
As EU Digital Identity Wallets are introduced, organisations are still expected to require orchestration around onboarding, compliance checks, fraud prevention, auditability, and signing. Under the incoming rules, qualified signatures become a required element of that process rather than replacement for it.
Organisations exploring QES-enabled onboarding can learn more at www.shufti.com or speak with the Shufti team.
About Shufti
Shufti is a global identity verification and AML compliance provider, helping businesses onboard customers and meet their regulatory obligations across 240+ countries and territories. Built entirely in-house, its platform spans document verification, biometric verification, age verification, AML screening, deepfake detection, fraud prevention, and VideoIdent, with solutions tailored to regulated European markets.
Shufti’s passive liveness detection is certified to iBeta Level 3 (ISO/IEC 30107-3) with a 0% error rate, and platform is certified to ISO 27001 and SOC 2 Type II, and fully GDPR compliant.
