Shufti has added qualified electronic signature (QES) capabilities to its identity-verification platform through a partnership with Evrotrust, allowing regulated businesses to move from customer verification to document signing in one hosted workflow.
Shufti handles identity proofing, onboarding orchestration and compliance controls. Evrotrust, a Bulgarian qualified trust service provider, issues a one-time qualified certificate tied to the verified signer and applies the qualified signature. Bulgaria’s Communications Regulation Commission lists Evrotrust Technologies on the country’s Trusted List of qualified providers.
Under Article 25 of the European Union’s eIDAS Regulation, a QES has the equivalent legal effect of a handwritten signature. A qualified signature based on a qualified certificate issued in one EU member state must also be recognized as a qualified signature in the other member states.
A business initiates the Shufti service through an API and directs the signer to a hosted flow that can run in a browser or an in-app web view. Shufti verifies the person using document and facial biometric checks, an NFC read of a chip-enabled identity document, or a supported eIDAS-notified national eID. Evrotrust then issues the certificate for that signing event.
Businesses can upload a PDF for Shufti to hash and return with an embedded PAdES signature, or compute the document hash themselves and send only the hash for signing. The second option keeps the underlying document inside the organization’s environment. The service returns the signed document or detached signature together with the certificate, identity-proofing evidence and an audit trail.
The integration targets agreements used in banking, lending, insurance, investment, healthcare, real estate and legal services. It extends Shufti’s onboarding platform beyond identity and anti-money laundering checks into document execution. Shufti has also been embedding identity checks into regulated digital workflows and obtained iBeta Level 3 certification for passive liveness detection.
The EU Anti-Money Laundering Regulation that applies from July 10, 2027 identifies eIDAS electronic identification at substantial or high assurance and relevant qualified trust services as methods for verifying customer identity. A separate implementing regulation will apply ETSI TS 119 461 V2.1.1 to identity proofing for qualified certificates from August 19, 2027. Shufti says it plans to pursue certification against the updated standard.
Sources: Shufti, Shufti Developers, EUR-Lex, Bulgarian Communications Regulation Commission
–
By the ID Tech Editorial Team
