Qualified electronic signatures for cross-border fintech contracts

Use this sequence for each document template and any material departure from it.

1. Identify the instrument. An ordinary software subscription or services agreement takes one route. A deed, guarantee, power of attorney, security document, witnessed instrument, notarised act or regulated-product document may require another. A supplier agreement also differs from a payer's mandate; the analysis of SEPA direct debit software from Morocco addresses that separate payment workflow.
2. Identify the applicable rules. Record the chosen contract law, expected forum, each company's incorporation jurisdiction and the signers' locations. French or Irish customer location alone does not determine every issue. Rome I separates contract-law choice and formal validity from company-law and representative-authority questions. (Regulation (EC) No 593/2008, Articles 1(2)(f)–(g), 3, 11.)
3. Establish who can bind each company. Select the named representative and check the office, delegation or power of attorney that supports signing this document. If joint execution is required, build it into the workflow.
4. Select the required or agreed signature level. If no special form or agreed QES requirement applies, assess whether the ordinary electronic process provides sufficient evidence. If QES is selected, validate the actual output as QES. A customer request should be resolved expressly in the execution arrangements.
5. Resolve special formalities before release. Route documents requiring witnessing, sealing, notarisation, delivery as a deed or registration through the applicable procedure. A successful cryptographic check answers only part of that inquiry. (eIDAS, Article 2(3).)

The commercial owner should record which route was approved. Product teams then implement that decision in the template and signing sequence.

An ordinary electronic signature can include a signing action associated with the contract. A click or one-time passcode (OTP) may support that action, but a log showing that a code was sent does not establish who accepted which final terms. Electronic and non-qualified signatures cannot be denied legal effect or evidential admissibility solely because of that status. Their sufficiency remains subject to the applicable rules and evidence. (eIDAS, Articles 3(10), 25(1).)

An advanced electronic signature must be uniquely linked to the signer, identify them, use signing data under their sole control with high confidence, and reveal later changes. An OTP is not, by itself, proof that all those conditions are met. (eIDAS, Article 26.)

A QES combines an advanced signature, a qualified certificate and a qualified signature creation device. All three elements matter. A qualified certificate alone, a provider's brand or a completion certificate does not establish QES. The Court of Justice confirmed that cumulative test in Ekofrukt. (eIDAS, Article 3(12), Annexes I–II; CJEU, C-362/21, 20 October 2022, paragraphs 43–55.)

An electronic seal relates to a legal person. A qualified seal carries presumptions about the integrity and correct origin of the data. Those effects do not, by themselves, establish a director's personal signature, consent or authority. A seal can still contribute evidence, and a national corporate-seal execution route may be available. The parties must identify the applicable route rather than treat every meaning of “seal” as interchangeable. For a customer's QES request, use the authorised individual's QES and record their representative capacity. (eIDAS, Articles 3(24)–(27), 35; Irish Companies Act 2014, sections 43–43A.)

Even a valid QES remains capable of challenge under the relevant rules for handwritten signatures. It does not make fraud, authority or contract-validity disputes disappear. (CJEU, V.B. Trade, C-466/22, 29 February 2024, paragraphs 36–40.)

For an ordinary French-law contract, consent is generally sufficient for formation unless the law requires a particular form. Electronic writing has the same evidential force as paper when the originator is duly identifiable and the record is created and retained with integrity. An electronic signature must reliably identify its author and connect them with the act. (French Civil Code, Articles 1172, 1366–1367.)

QES brings the specified rebuttable presumption of reliability. In March 2026, the Cour de cassation rejected reasoning that presumed reliability without establishing that the signing process was qualified. Identity documents and an evidence certificate did not justify shifting that burden. The decision does not invalidate every non-QES agreement. (Decree No 2017-1416, Article 1; Cass. 3e civ., 5 March 2026, No 24-21.034, paragraphs 5–10.)

French online-contract rules also matter. Preserve the terms presented, allow the relevant review and correction steps, and record acceptance. Professional parties may agree specified derogations, but business status alone does not create every exemption. For guarantees or authentic acts, examine the additional instrument-specific requirements. (French Civil Code, Articles 1127-1–1127-3, 1174–1175, 2297.)

For an ordinary Irish agreement, the Electronic Commerce Act permits electronic contracting and a signature route with the recipient's consent, subject to its conditions and preserved requirements. Confirm the agreed method and retain the final terms and assent. (Electronic Commerce Act 2000, sections 12–13, 19, 24.)

Irish witnessing and seal-substitution provisions use the expression “advanced electronic signature, based on a qualified certificate”. They contain additional requirements, including recipient consent and the relevant document indications. Do not reduce them to an instruction to add any QES. Company-seal rules and deed execution also require their own analysis. The counterpart provision permits specified identical documents to carry the required signing and common-seal components collectively; it does not create a universal electronic-stamp shortcut. (Electronic Commerce Act 2000, sections 14, 16; Companies Act 2014, sections 43–43A; Land and Conveyancing Law Reform Act 2009, section 64.)

For each party, retain the exact legal name, registration details and company form. Identify the human signer and the capacity in which they sign. Then obtain the evidence appropriate to that authority route, such as an appointment, relevant constitutional provision, board approval or delegation covering the transaction.

For a French SAS (société par actions simplifiée), the president's representative position differs from an employee's “director” title. A SARL (société à responsabilité limitée) manager and an SA (société anonyme) director-general operate under different provisions. For an Irish private company limited by shares, distinguish board authority, the statutory registered-person mechanism and an authorised representative. A director's title alone does not establish every authority route. (French Commercial Code, Articles L227-6, L223-18, L225-56; Irish Companies Act 2014, sections 39–42.)

For the Moroccan supplier, check its own legal form and appointed representative. A SARL's manager, an SA's director-general and the representative of an SA using a management board (directoire) follow distinct statutory routes. Establish the actual office or delegation before configuring the signer. (Moroccan Law No 5-96, Articles 62–63; Law No 17-95, Articles 67, 74–75, 103.)

These checks should not become a claim that every internal approval defect automatically voids the external agreement. Applicable third-party protections, apparent authority and ratification can affect the result. The records should show the authority relied upon at execution and any limits relevant to the deal. (French Civil Code, Article 1156; French Commercial Code, Articles L227-6, L223-18, L225-56; Irish Companies Act 2014, section 40.)

A delegate should sign using their own identity and credentials in the authorised capacity. Sharing a director's private key, device or authentication account undermines that separation. Keep delegation scope and expiry visible to the signing workflow. (eIDAS, Article 26(c), Annex II.)

The QES conditions do not impose a general EU citizenship or residence requirement. The practical question is whether the selected qualified trust service provider can lawfully verify the signer and issue the appropriate certificate. Ask which identity documents, identification methods and signing locations it supports before committing the customer to a deadline. (eIDAS, Article 24, Annex I.)

An overseas individual using an EU-qualified service is different from a third-country provider asserting equivalent status. Article 14 of eIDAS requires the relevant EU recognition instrument for third-country trust services: an implementing act or an agreement under Article 218 of the Treaty on the Functioning of the European Union. Moroccan accreditation or a foreign certificate label does not, by itself, establish that route. (eIDAS, Article 14.)

Moroccan recognition needs its own check. Law No 43-20, Article 36, makes equivalent treatment of foreign qualified trust services depend on the specified multilateral or reciprocal bilateral recognition agreement. EU status therefore does not automatically establish Moroccan qualified status. If the document needs a Moroccan qualified-signature effect, establish the applicable recognition or domestic qualified-service route before signing.

Where Moroccan law supplies the form or evidence rule, the Code des obligations et contrats also matters. Electronic writing requires identification and integrity; the signature links the signer to the act and expresses consent. Check special-form exceptions before relying on that route. (Code des obligations et contrats, Articles 2-1, 417-1–417-3, as amended by Law No 43-20, Articles 76–77.)

The qualified-status distinction does not mean every other electronic contract fails in Morocco. Law No 43-20 protects simple and advanced signatures against rejection solely because they are electronic or non-qualified. The applicable form and evidence requirements still matter. (Law No 43-20, Articles 4–7.)

Map the supplier's own functions as well. Using another provider's service differs from supplying certificate issuance, signature validation or preservation. Moroccan law reserves qualified services to approved providers and requires prior declaration for other trust services. Integrating a provider does not establish that every function performed by the platform falls outside those rules. (Law No 43-20, Articles 2–3, 32–36.)

Keep certificate identification, AML onboarding and company authority distinct. Where AML duties apply, due diligence extends beyond the signer's identity to matters such as beneficial ownership, purpose and ongoing monitoring. The EU directive framework also addresses representatives' authority. A certificate or wallet does not automatically complete those checks. The analysis of using the EU Digital Identity Wallet for KYC develops the onboarding side. (Directive (EU) 2015/849, Article 13, as amended.)

Before selecting or changing the service, require a demonstrable answer to each point:

• Identify the actual certificate issuer and its specific qualified service in the relevant national trusted list. Check the service type and status history, including the relevant signing date. A familiar platform name is insufficient. (eIDAS, Articles 21(3), 22.)
• Establish the qualified certificate and qualified-device route. For remote signing, check the qualified service managing the remote creation device. The transitional derogation ended on 21 May 2026. (eIDAS, Articles 29a, 51(3).)
• Test the intended signer's identification route and the exact contract format. Confirm that the certificate's identity can be matched to the representative in the authority record.
• Validate a completed sample and each production signature. Capture qualification, integrity, certificate validity at signing, status information, device qualification and the validation result. Treat a failed or indeterminate result as unresolved. (eIDAS, Article 32.)
• Check that validation software consumes current trusted-list data and formats. The trusted-list changes in Decision (EU) 2025/2164 apply from 29 April 2026. A trusted-list browser helps inspect services; it does not itself validate the contract signature.
• Confirm export, retention, preservation, incident response and provider-exit arrangements. Obtain evidence in usable formats that the company can access independently of the signing dashboard. (eIDAS, Articles 24(2)(h)–(i), 33–34.)

The validation report should distinguish technical signature validity from qualified status. Record its date, software version, policy and result, and explain any unresolved warning before accepting the execution package. A qualified validation service is an available assurance option; eIDAS does not require every contracting business to purchase one. (eIDAS, Article 33.)

Legal should approve the document class, applicable form, representative capacity and any special execution procedure. Commercial operations should confirm the entity names, agreed signature method and final document set. Product should bind the signing action to that exact version and provide an intelligible opportunity to review it.

Before launch, settle the customer agreement and its incorporated documents, the execution arrangements, and the trust-provider contract. The provider arrangement should address identification responsibilities, supported output, evidence export, incidents and exit. Record the required data arrangements and retention schedule alongside them. Approve a route only after a sample produces the expected evidence and the responsible owner can retrieve it.

At execution, capture the signer's affirmative action, the version presented, relevant authentication events, sequence and completion time. Preserve enough evidence to connect the action with the contract without retaining reusable secrets. Give each party the completed record. French electronic bilateral instruments must meet the applicable durable-copy or access conditions; Irish electronic retention rules also require usable, reliable records. (French Civil Code, Article 1375; Electronic Commerce Act 2000, sections 17–18.)

The evidence package should contain:

• The complete signed document, incorporated schedules and all required counterparts.
• The entity and authority record, with the signer's identity and representative capacity.
• The original signature data or container, certificate chain and relevant service/device qualification evidence.
• Validation reports, revocation-status material and any qualified timestamps used.
• The terms-and-consent audit trail, delivery record, later amendments and incident history.

A qualified timestamp supports the accuracy of its date and time and the integrity of the data it binds. It does not supply missing authority or prove assent to terms that were never presented. Preserve the material needed to establish validity at signing; later certificate expiry alone does not decide whether an earlier signature was valid. Revocation, compromise and missing time evidence require specific investigation. (eIDAS, Articles 28(4)–(5), 32(1), 41–42.)

The records owner should set retention against the agreement, applicable claim periods, regulatory duties and legal holds. For longer horizons, plan preservation and renewal of validation evidence before cryptographic assurance becomes unreliable. Qualified preservation services can support that task. PDF long-term-validation profiles are technical preservation options, not additional legal signature levels. (eIDAS, Article 34.)

Retain necessary evidence securely and limit access. Avoid indefinite accumulation of passport images or onboarding files merely because they might be useful. Apply the relevant data-protection basis, minimisation, security and transfer requirements to the actual data flow. (GDPR, Articles 5–6, 17(3)(e), 32, 44–46, where applicable; Moroccan Law No 09-08, Article 3(1)(c), (e).)

If terms change after signing, preserve the original and execute the required amendment or replacement. Do not silently edit a signed PDF. If authority changes, update the approval record and obtain the necessary fresh authorisation. Neither a new timestamp nor revalidation supplies missing agreement.

If the provider fails or withdraws a service, preserve the existing evidence, export available records and use an approved replacement route for new execution. Avoid switching an agreed QES transaction to an OTP-only process without resolving the legal and contractual consequences. Test evidence export and recovery before relying on the service for live contracts.

Finally, choose the forum with the enforcement location in view. EU signature recognition is separate from recognition and execution of a judgment. Brussels I bis addresses qualifying court agreements and circulation of judgments between Member States; it does not provide automatic enforcement against Moroccan assets. Preserve a durable record of any applicable court agreement. Where assets are in Morocco, assess the foreign-judgment procedure and any applicable treaty under Moroccan procedural law. (Regulation (EU) No 1215/2012, Articles 25, 36, 39; Moroccan Law No 58.25, Articles 451–456, 640.)

Where the underlying service includes AI, AI supplier contracts for EU and UK enterprise sales addresses the customer terms and procurement evidence that should be settled before execution.