E-Signatures for Regulated Firms: QES, AES, and SES — When Each Is Valid

Why E-Signature Levels Matter for Regulated Businesses

Electronic signatures are now routine for business. Most regulated firms — law firms, financial advisors, wealth managers, insurers — use some form of digital signing for client onboarding, engagement letters, and agreements. But "digital signing" is not a single thing. Under EU Regulation 910/2014 (eIDAS), electronic signatures exist on a hierarchy of three trust levels, each with different legal effects and evidentiary weight.

Using the wrong level for a given use case creates real legal risk. In 2024–2025, several contract disputes in UK and continental European courts turned on whether an electronic signature met the threshold required by applicable law or sector regulation. In two cases involving financial advisory engagement letters, courts found that click-to-sign email signatures — Simple Electronic Signatures — were insufficient for contracts subject to MiFID II written agreement requirements.

For regulated firms, the question is not "can I use e-signatures?" — the answer is almost always yes. The question is "which level of signature does this specific document, in this specific legal context, require?"

The Three Levels of Electronic Signature Under eIDAS

Legal Effect: What Each Tier Gives You

Which Level Does Your Document Require?

The most common question: "What level of e-signature do I actually need for this?" The answer depends on three factors: applicable national law for the document type, sector-specific regulation, and your firm's own evidentiary risk appetite.

Documents requiring QES by law

Some document types require a qualified electronic signature (or wet signature) because national law mandates written form with legal equivalency. Examples across EU Member States:

• Real estate sale contracts and title transfers (most Member States)
• Testamentary dispositions and notarial instruments
• Consumer credit agreements exceeding specific thresholds in certain jurisdictions
• Employment termination agreements in some Member States
• Certain company formation and share transfer documentation
• Court submissions and regulatory filings requiring verified signatures

Documents where AES is typically sufficient for regulated firms

• Client engagement letters and terms of business (law firms, financial advisors)
• Service agreements and SaaS contracts above standard commercial thresholds
• MiFID II suitability and appropriateness acknowledgements
• Non-disclosure agreements
• Data Processing Agreements under GDPR Article 28
• GDPR consent forms for high-risk processing where genuine consent must be proven
• Insurance policy documents
• Loan documentation (non-mortgage)
• KYC/CDD declarations in digital onboarding workflows

Documents where SES is generally acceptable

• Internal approvals, workflow sign-offs, and meeting minutes
• Low-value purchase orders and supplier acknowledgements
• Policy acknowledgements and employee handbook confirmations
• Marketing consent (though documented consent mechanisms must still be GDPR-compliant)
• Standard terms acceptance for B2C services without enhanced regulatory overlay

E-Signatures in Specific Regulated Contexts

Legal (law firms and notaries)

Law firms use e-signatures across the spectrum. For routine correspondence and internal approvals, SES is fine. For engagement letters and client service agreements, AES provides adequate non-repudiation for dispute purposes. For conveyancing, corporate transactions, and documents that will be used in court or regulatory proceedings, the applicable substantive law of the governing jurisdiction determines whether QES is required. Notarial acts in most EU jurisdictions must be executed before a notary in person or with QES — this cannot be downgraded.

Financial services (MiFID, insurance, banking)

Financial services generate high volumes of e-signed documentation. Client-facing firms should use AES as the baseline for anything above internal workflow approvals. The principal risk is dispute resolution: if a client disputes a suitability assessment acknowledgement or a contract term, an AES with a clear audit trail (identity verification method, timestamp, IP, document hash) provides a robust evidentiary record. SES provides almost no protection in a dispute where the client claims they did not agree to a term or did not understand a risk disclosure.

Healthcare

Patient consent for medical treatment raises complex questions. Informed consent is a clinical and legal requirement, not purely contractual. In most EU jurisdictions, documented verbal consent recorded by the clinician is legally sufficient for routine care. For research participation, clinical trials, and processing of special category health data under GDPR Article 9, written consent with a clear, verifiable audit trail is required. AES is generally appropriate; QES may be required for specific consent types in certain national systems.

HR and employment

Most employment documentation — offer letters, policy acknowledgements, non-disclosure agreements — can use AES. Employment contracts in the EU typically require written form (pen-and-paper or electronic equivalent). QES is safest for employment termination documents in jurisdictions with strict written form requirements. Note that employee consent under GDPR has specific limitations (see the GDPR for HR guide in our blog).

What a Compliant E-Signature Audit Trail Looks Like

The audit trail is often more important than the signature mechanism itself. In the event of a dispute, your ability to prove what was signed, by whom, when, and what verification was done is what courts and regulators assess. A compliant AES audit trail should include:

• Full document hash before and after signing (proving no tampering)
• Timestamp from a trusted timestamping service (not just the signing platform's server clock)
• Identity verification method used (email OTP, SMS OTP, identity document scan, eID)
• IP address and device fingerprint of the signatory
• Audit log of all events: document sent, opened, signed, downloaded
• Certificate of completion from the platform provider
• Long-term archival in a format that remains verifiable after certificate expiry (PAdES or XAdES with archival timestamps)

Choosing an E-Signature Provider: Key Questions

1. Is the provider on the EU Trusted List (EUTL)? Only providers on the EUTL can issue QES. Verify at the official EUTL browser provided by the European Commission.
2. What signature levels does the platform actually support? Many providers advertise "legally binding" e-signatures that are technically SES or at best low-assurance AES. Ask for the eIDAS compliance documentation.
3. What identity verification methods are offered? Email OTP alone provides low assurance. SMS OTP is moderate. Government-issued ID scan with liveness check is high assurance.
4. What archival format is used? PAdES (PDF Advanced Electronic Signature) with LTV (Long-Term Validation) is the standard for long-term admissibility. XAdES for XML documents.
5. Where is signed document data stored? Under GDPR, the storage location of signed documents containing personal data is subject to the same transfer obligations as any other personal data. Ensure your provider offers compliant storage or appropriate SCCs.

Frequently Asked Questions

← Back to Blog