QES as the new gold standard for KYC

London, United Kingdom, 3 August 2026 – Shufti, a glocal platform that manages a Full Compliance Lifecycle Solution, from sign-up, onboarding, authentication, monitoring to remediation, has spent nearly a decade helping regulated businesses verify who their customers are, from the first identity check to the final audit trail. 

Earlier this year, Shufti partnered with Evrotrust, a leading Qualified Trust Service Provider listed on the EU Trusted List, to extend its identity-verification capabilities into qualified electronic signatures. Evrotrust provides regulated trust infrastructure that connects successfully verified identities with qualified certificates and QES, enabling platforms to introduce legally recognised digital signing without having to build their own qualified trust infrastructure.

The regulatory backdrop is also shifting. eIDAS 2.0 is already in force across the EU, with the European Digital Identity (EUDI) Wallet rollout approaching fast as member states are required to make wallets available by the end of 2026, and the technical standard ETSI TS 119 461 v2.1.1 raising the bar for identity proofing from 19 August 2027. Shufti’s flow is built to carry customers onto EUDI Wallet-based identity without disrupting their experience, so businesses adopting it now won’t need to rebuild later.

Following this strategic partnership, sproof has embedded the combined Shufti-Evrotrust identity layer into its modular, EU-hosted cloud platform. Designed with a clear focus on upcoming EUDI Wallet standards, the workflow supports advanced attribute attestation, allowing regulated entities to securely extract and verify identity attributes (such as full name, date of birth, and nationality) directly within the signing process. sproof has built its entire signing orchestration on top of that Shufti-Evrotrust foundation.

How the underlying identity-to-signature flow works?

• Starts with sproof preparing the document, defining the signing sequence, roles, and any required fields, before the signature stage begins.
• The signer verifies their identity through Shufti, using notified eIDs, document and biometric checks, or an NFC-enabled ID scan, completed in around 12 seconds with 99.7% biometric accuracy.
• The liveness detection behind that check is certified to iBeta ISO/IEC 30107-3 Level 3, a benchmark Shufti was the first European provider to achieve on both iOS and Android.
• Once verified, Shufti sends Evrotrust a cryptographic hash associated with the signing transaction, rather than the underlying document, keeping the file secure throughout.
• Evrotrust provides the qualified trust layer needed to issue the certificate and complete the QES, and sproof gets the document signed instantly, all within that same one-time session.
• For signers who opt for one-time QES, the certificate covers just that single signing session: it’s issued and used immediately, and isn’t stored or reused afterward.
• The resulting signature still carries lasting legal weight, valid across all 27 EU member states and the wider EEA under eIDAS Article 25, and remains verifiable for up to 10 years, the durability AMLR-compliant, audit-ready onboarding calls for.

Together, Shufti and Evrotrust provide the identity and qualified trust layers that allow platforms such as Sproof to integrate QES without developing regulated trust infrastructure from the ground up. Shufti establishes confidence in the signer’s identity, while Evrotrust translates that into an EU-qualified trust transaction.

The broader story lies in Sproof’s role as the central workflow orchestrator, operating strictly on European server infrastructure with zero US dependencies, guarding against foreign data access laws such as the US Cloud Act. That protection starts with Shufti’s identity verification happening within the same EU-hosted environment. By providing a “100% in Europe” seal of digital sovereignty, these partners together enable global enterprises to scale their onboarding across European borders while maintaining the highest regulatory and data protection standards.

Organizations exploring QES-enabled onboarding can learn more at https://shuftipro.com/qes/

Evrotrust’s certificates carry real technical weight, exactly the kind of durability regulators expect as AMLR raises the bar on audit-ready onboarding. Each signature is embedded in a PAdES-LTV file with long-term validation, giving platforms like sproof a certificate that holds up long after the signing session ends.

For almost 8 years, sproof has been Europe’s go-to for digital signatures and identity verification. As new regulations drive regulated industries forward across Europe, partnering with best-in-class providers means sproof’s customers, in Europe and beyond, can transition to this new era with as little friction as possible. Over the years, sproof has quantified ROI and effectiveness for customers across the region, and intends to keep doing so.

About Shufti

Shufti is a global identity verification and AML compliance provider, helping businesses onboard customers and meet their regulatory obligations across more than 240 countries and territories. Built entirely in-house, its platform spans document verification, biometric verification, age verification, AML screening, deepfake detection, fraud prevention, and VideoIdent, with solutions tailored to regulated European markets.

Shufti’s passive liveness detection is certified to iBeta Level 3 (ISO/IEC 30107-3) with a 0% error rate, and the platform is certified to ISO 27001 and SOC 2 Type II, and is fully GDPR compliant.