A Qualified Electronic Signature (QES) is the strongest type of electronic signature recognised under EU law, carrying the same legal weight as a handwritten signature under eIDAS. Qualified Electronic Signatures are valid across all EU member states, making them an excellent way to facilitate legally-binding digital documents. 

Before a QES can be issued, the signer's identity must be verified by a Qualified Trust Service Provider (QTSP). The resulting signature is cryptographically linked to that verified identity, meaning the signer cannot later deny having signed. 

A short history of QES 

Electronic signatures are not as new as you might think. They have been part of European law since 1999, when the EU first established that there needed to be a way to create legally binding digital documents. However, the early frameworks allowed member states to govern and implement the process, leading to inconsistency in terms of adoption and cross-border recognition.   

This issue was addressed in 2014 with the eIDAS Regulation. This created a single system, backed by the QTSP framework, that gave institutions a clear standard to rely on. A decade later, eIDAS 2.0 further cemented the regulation and tightened the standards. From 10 July 2027, QES will be one of only three methods that satisfies AMLR's remote identification requirements. 

How QES works 

The process of creating a QES involves three integrated steps: 

1. Identity verification. Before a QES can be issued, the signer's identity needs to be verified by a QTSP — an organisation certified to facilitate legally binding transactions. This typically involves document verification, liveness checks, and sanctions screenings. If a certain amount of time has passed since the original verification, additional checks might need to be performed when signing.  

2. Certificate issuance. Once the signer’s identity is confirmed, the QTSP issues a qualified electronic certificate containing verified identity attributes belonging to the signer. This certificate is cryptographically linked to the document in question, ensuring that both the identity of the signer and the integrity of the document can be verified at any time.  

3. Signature confirmation. The signer reviews and approves the document, accepts the QTSP's legal conditions, and confirms the signature (usually via a one-time passcode). The signed document is then sealed with a timestamp and tamper-detection technology, creating a record that cannot be altered without detection. 

QES vs. other electronic signature types 

Other electronic signatures exist within the EU, but some hold more legal weight than others. The type of document being signed generally dictates the level of legal stringency your document should adhere to.  

Here are the three levels that that are recognised by EU law: 

Simple Electronic Signature (SES). This is the most basic level of signature that’s still legally binding. It often uses a scanned image of signature or a "click to accept" button. No identity verification is required here.  

Advanced Electronic Signature (AES).  This type of signature is uniquely linked to the signer and capable of detecting changes to the document in question. However, it does not require QTSP-issued certification. Higher assurance than SES but not equivalent to a handwritten signature under EU law. 

Qualified Electronic Signature (QES). The highest level. Requires QTSP-issued certification, is based on a Qualified Certificate for Electronic Signatures (QCert), and must be created using a Qualified Electronic Signature Creation Device (QSCD). Under Article 25(2) of the eIDAS Regulation, QES has the equivalent legal effect of a handwritten signature across all EU member states. 

Where is QES used? 

From opening a bank account to signing mortgage agreements — wherever legal certainty is paramount, QES is the ideal choice. Here are some key processes where it is most commonly used.  

• Opening bank accounts: confirming the identity of a new customer for banks or other financial services online 

• Loan and mortgage agreements: executing high-value, legally binding contracts remotely 

• Credit agreements: issuing loans or credit under legally enforceable terms 

• Investment documentation: signing disclosures and agreements in regulated investment contexts 

• Corporate authorisations: establishing signatory authority for business accounts 

QES under AMLR 

From 10 July 2027, the Anti-Money Laundering Regulation (AMLR) introduces a clear hierarchy for remote customer identification across all EU member states. QES is recognised as one of the highest-assurance compliant methods, alongside notified national eID systems and the EU Digital Identity (EUDI) Wallet. 

This makes QES the most immediately practical path to AMLR compliance. Unlike the EUDI Wallet, which is still rolling out across member states, QES is available at scale right now and works across all EU markets. Institutions that have not yet built eIDAS-compliant identification into their onboarding flows have until July 2027 to do so. 

QES and the EUDI Wallet 

The EUDI Wallet, rolling out across EU member states through 2026 and 2027, introduces a new path to QES creation. Rather than relying on a separate SMS-based confirmation step, the wallet stores government-verified identity credentials and a private cryptographic key in a secure cryptographic device. When a customer signs with QES via the EUDI Wallet, identity verification and signature creation happen in a single step.

How Fourthline delivers QES 

Fourthline's platform supports all three AMLR-compliant identification methods — QES, national eID, and EUDI Wallet — within a single layer. As Europe's leading QES provider and official BVA authorisation as a German eID service provider, Fourthline is built to help financial institutions meet AMLR requirements without rebuilding their onboarding sytems from scratch. Get in touch to learn more.  

FAQs 

Is a QES legally valid in all EU member states? 

Yes. Under Article 25(2) of the eIDAS Regulation, a Qualified Electronic Signature is the legal effect of a handwritten signature across the EU. It is the only level of electronic signature that carries this guarantee automatically, without the need for bilateral recognition agreements. For financial institutions operating across multiple European markets, this cross-border legal certainty is one of QES's most significant practical advantages. 

What is the difference between QES and a standard e-signature? 

A standard electronic signature, such as a typed name, a scanned image, or a "click to accept" button, carries minimal legal weight and provides no cryptographic proof of identity or document integrity. A Qualified Electronic Signature requires verified identity via a QTSP, uses a cryptographic key stored on a secure device, and produces a tamper-evident, timestamped record that is court-admissible. 

Can QES be used without completing a full KYC flow first? 

Yes. Fourthline offers QES as a standalone product for customers whose identity has already been verified. In this case, the QES flow begins with a series of eligibility checks to confirm the customer's KYC record is still valid: document validity, sanctions status, device model consistency, and geolocation. If the original KYC case is more than 24 hours old, certain checks are automatically re-run to ensure the signature is issued on the basis of current, accurate identity data.