---
title: "Advanced Electronic Signature (FEA)"
description: "This document contains all the mandatory technical and organizational information required to ensure full compliance with the technical rules on advanced electronic signatures."
url: "https://docs.fabrick.com/en/payment-institution/onboarding-and-identity/fea/advanced-electronic-signature/"
language: "en"
---

# Advanced Electronic Signature (FEA)

## Introduction

### Purpose and scope

This document contains all the mandatory technical and organizational information required to ensure full compliance with the technical rules on advanced electronic signatures. The document is intended to be used together with the document “Modulo di adesione al servizio di FEA OTP” (FEA OTP Service Enrollment Form, hereinafter also the FEA Enrollment Form) and is the summary document describing the technical characteristics of the electronic signature service.

### Regulatory references

\[1] Regulation (EU) No 910/2014 (eIDAS) on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC;

\[2] Legislative Decree No. 82 of 7 March 2005 (Official Gazette No. 112 of 16 May 2005) – Digital Administration Code (Codice dell’Amministrazione Digitale), as subsequently amended and supplemented, hereinafter referred to as CAD;

\[3] Decree of the President of the Council of Ministers of 22 February 2013 (Official Gazette No. 117 of 21 May 2013) – Technical rules on the generation, affixing and verification of advanced, qualified and digital electronic signatures pursuant to articles 20, paragraph 3, 24, paragraph 4, 28, paragraph 3, 32, paragraph 3, letter b), 35, paragraph 2, 36, paragraph 2, and 71;

\[4] Decree of the President of the Council of Ministers of 13 November 2014 (Official Gazette No. 8 of 12 January 2015) - Technical rules on the creation, transmission, copying, duplication, reproduction and time validation of electronic documents, as well as on the creation and storage of the electronic documents of public administrations pursuant to articles 20, 22, 23-bis, 23-ter, 40, paragraph 1, 41, and 71, paragraph 1, of the Digital Administration Code referred to in Legislative Decree No. 82 of 2005;

\[5] Decree of the President of the Council of Ministers of 3 December 2013 (Official Gazette No. 59 of 12 March 2014) - Technical rules on storage systems pursuant to articles 20, paragraphs 3 and 5-bis, 23-ter, paragraph 4, 43, paragraphs 1 and 3, 44, 44-bis and 71, paragraph 1, of the Digital Administration Code referred to in Legislative Decree No. 82 of 2005.

\[6] Decree of the President of the Republic No. 445 of 28 December 2000 (Official Gazette No. 42 of 20 February 2001) – Consolidated text of the legislative and regulatory provisions on administrative documentation.

### Definitions

The definitions used in drafting this document are listed below. For the terms defined by the CAD and the DPCM, please refer to the definitions set out therein.

**Electronic signature certificate**: An electronic attestation which links electronic signature validation data to a natural person and confirms at least the name or the pseudonym of that person.

**Qualified electronic signature certificate**: An electronic signature certificate that is issued by a qualified trust service provider and meets the requirements laid down in Annex I of the eIDAS Regulation.

**Private key**: The element of the asymmetric key pair, used by the Signatory, by means of which the electronic signature is affixed to the electronic document. **Public key**: The element of the asymmetric key pair intended to be made public, by means of which the electronic signature affixed to the electronic document by the Signatory is verified.

**Validation** The process of verifying and confirming that a signature is valid. Storage The process of secure long-term archiving of electronic documents or image copies of analog documents, which ensures their integrity, security, unalterability, availability and the preservation of their legal value.

**Validation data** Data used to validate an electronic signature.

**Personal identification data** A set of data enabling the identity of a natural or legal person, or of a natural person representing a legal person, to be established.

**Electronic signature creation data**: The unique data used by the Signatory to create an electronic signature. **Electronic signature creation device**: Configured software or hardware used to create an electronic signature. **Electronic document**: Any content stored in electronic form, in particular text or sound, visual or audiovisual recording. **Provider**: The party that provides an Advanced Electronic Signature service pursuant to art. 55 of the DPCM of 22 February 2013. **Automatic signature**: A specific electronic signature procedure performed with the prior authorization of the signer, who retains exclusive control of their signature keys, without their specific and continuous supervision. **Digital signature**: A particular type of advanced electronic signature based on a qualified certificate and on a system of two related cryptographic keys, one public and one private, which allows the Signatory, by means of the private key, and the recipient, by means of the public key, respectively to make manifest and to verify the origin and integrity of an electronic document or of a set of electronic documents. **Electronic signature**: Data in electronic form which is attached to or logically associated with other data in electronic form and which is used by the Signatory to sign. **Advanced electronic signature**: An electronic signature which meets the requirements set out in article 26 of the eIDAS Regulation. **Qualified electronic signature**: An advanced electronic signature that is created by a qualified electronic signature creation device and which is based on a qualified certificate for electronic signatures. **Signatory** A natural person who creates an electronic signature. **Hash/Digest**: the sequence of binary symbols (bits) of predefined length generated by applying a suitable hash function to an electronic record (article 1, par. 1, letter h DPCM). **Hash function**: a mathematical function that generates a digest from an electronic record in such a way that it is in practice impossible, starting from the digest, to reconstruct the original electronic record or to generate identical digests from different electronic records (article 1, par. 1, letter g DPCM). **Electronic identification**: The process of using person identification data in electronic form uniquely representing either a natural or legal person, or a natural person representing a legal person. **Electronic identification means**: A material and/or immaterial unit containing person identification data and which is used for authentication for an online service. **Enrollment form**: A contractual document drawn up by the Provider that collects the customer's consents regarding the use of the electronic signature system, entered into by the customer once at the start of the relationship or at a later time. **OTP**: A One-Time Password is a password that is valid for a single transaction only. The OTP is generated and made available to the Signatory immediately before the electronic signature is affixed. It may be based on hardware devices or on software procedures. **Trust service provider**: A natural or a legal person who provides one or more trust services either as a qualified or as a non-qualified trust service provider. **Qualified trust service provider**: A trust service provider who provides one or more qualified trust services and is granted the qualified status by the supervisory body. **Trust service**: An electronic service normally provided for remuneration which consists of: the creation, verification and validation of electronic signatures, electronic seals or electronic time stamps, electronic registered delivery services and certificates related to those services; or the creation, verification and validation of certificates for website authentication; or the preservation of electronic signatures, seals or certificates related to those services. **Qualified trust service** A trust service that meets the applicable requirements laid down in the Regulation. **Signature tool**: A process for creating an advanced electronic signature that ensures the identification of the Signatory, the unique link between signature and document, as well as the authorship and integrity of the document itself. **Electronic time stamp**: Data in electronic form which binds other data in electronic form to a particular time and date, establishing evidence that the latter data existed at that time. **Qualified electronic time stamp**: An electronic time stamp which meets the requirements laid down in article 42 of the eIDAS Regulation.

## Parties

### Provider

The Provider is the party that offers Advanced Electronic Signature solutions for use in its dealings with third parties for institutional, corporate or commercial purposes, either developing them in-house or using solutions built by parties whose business activity is the development of advanced electronic signature solutions for Providers. The full details of the Provider are as follows:

Company name: Fabrick S.p.a. Registered office: Piazza Gaudenzio Sella, 1 - 13900 - Biella Phone number: 015 252 6511 Companies Register No.: BI - 202965 VAT No.: 02675650028 Website [https://www.fabrick.co](https://www.fabrick.co/)

### Developer

The Developer is the party whose business activity is the development of advanced electronic signature solutions for Providers. The full details of the Developer are as follows:

Company name: InfoCert – Società per azioni, a company subject to the management and coordination of TINEXTA S.p.A. Registered office: Piazza Sallustio n.9, 00187, Roma (RM) Operational headquarters: Via Marco e Marcelliano n.45, 00147, Roma (RM) Phone number: 06 836691 Companies Register No.: Tax Code 07945211006 VAT No.: 07945211006 Website: [www.infocert.it](http://www.infocert.it/)

InfoCert is the Trust Service Provider, the trusted third party that issues signature certificates and other signature tools, operating in accordance with the technical rules issued by the Supervisory Authority and as prescribed by Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC (also referred to as the eIDAS Regulation) and by Legislative Decree No. 82 of 7 March 2005 (Official Gazette No. 112 of 16 May 2005) – Digital Administration Code (also referred to as CAD), as subsequently amended and supplemented.

### User / signatory

The natural person who uses the Advanced Electronic Signature tool in order to enter into, amend or terminate contractual relationships with the Provider, and/or to carry out the related transactions and/or communications.

## General rules

### Obligations of the provider

With regard to the Advanced Electronic Signature process, the Provider must ensure that:

- The technical rules set out in the DPCM \[3] are complied with;

- The Signatory is identified in advance by means of a valid identity document;

- The Signatory is informed in advance of the exact terms and conditions governing the use of the FEA service, including any limitations of use;

- Activation of the FEA service is subject to the Signatory signing a declaration accepting the service conditions;

- A copy of the identity document and the declaration referred to in the previous point are retained for at least 20 years, ensuring their availability, integrity, legibility and authenticity;

- The Signatory can obtain, on request and free of charge, a copy of the declaration and all information on the solution;

- All the information required by the DPCM \[3], including this document, is published on its website;

- Where possible, a service is made available to the Signatory for withdrawing consent to the use of the Advanced Electronic Signature solution;

- A support service is provided to the Signatory;

- The Advanced Electronic Signature can be affixed only by the Signatory;

- The Signatory is fully aware of the document being signed, and it is not possible for their signature to be affixed to a document other than the one displayed;

- The signature affixed by the Signatory cannot be reused on a different electronic document

### Obligations of the developer

The Developer must ensure that:

- The technological solution developed allows the signature to be uniquely linked to the Signatory;

- The electronic document cannot be modified after the signature has been affixed.

### Obligations of the signatory

The Signatory must ensure:

- That the personal data provided to the Provider is truthful, accurate and complete;

- That a valid identity document is delivered to the Provider when signing the Enrollment Form;

- That they have read the documentation describing the FEA service before enrolling in the service.

### Insurance

Pursuant to article 57, paragraph 2, the Provider has taken out appropriate third-party liability insurance cover in order to protect the holders of the advanced electronic signature and third parties against any damage caused by inadequate technical solutions. The coverage limits are those set out in the DPCM \[3], namely an amount of no less than EUR 500,000.

## Identification and signing process

### Signatory identification

Pursuant to article 57, paragraph 1, letter a) of the DPCM \[3], the Providers of the FEA solution must reliably identify the Signatory by means of a valid identity document. The reliable identification of the Signatory of the document is carried out, in person or remotely, by the Provider, which may for this purpose make use of its own network of agents/collaborators or other authorized personnel. The identity of the Signatory is verified against a valid, unexpired identity document, as provided for by art. 35 of Decree of the President of the Republic No. 445 of 28 December 2000, a copy of which is acquired.

### Limits of use and scope of the solution

Pursuant to article 60 of the DPCM \[3] and as detailed in the Enrollment Form, the Advanced Electronic Signature may be used exclusively in the relationships between the Signatory and the Provider.

### Signing the enrollment form

The Enrollment Form, which includes both the declaration of enrollment in the Advanced Electronic Signature services and the consent to the processing of personal data, is signed by the Signatory with a so-called “simple” electronic signature.

### Signing the documentation

Once enrollment has been completed, the user can sign all documents proposed by the Provider in FEA mode with OTP. The signing procedure can be activated only by the Signatory through authentication with a One Time Password. The OTP is generated and made available to the Signatory immediately before the electronic signature is affixed. The signed documents are made available to the Signatory by the Provider.

## Technological solution used

### FEA with OTP

The Advanced Electronic Signature solution with OTP involves the following operational steps:

1. The Provider identifies the Signatory;
2. The Signatory accepts the conditions of the Advanced Electronic Signature service;
3. The Signatory views the contracts to be signed and accepts the signature reasons;
4. The Signatory authenticates to the Advanced Electronic Signature procedure;
5. The signature is inserted in the signature fields of the contracts using the private key of the non-qualified OneShot certificate issued to the Signatory;
6. The resulting document is time-stamped upon completion of the signing process;
7. The resulting document is sent by the Provider to a compliant storage service, together with the evidence collected during the enrollment process.

### Solution characteristics

Article 56 of the DPCM of 22.2.2013, entitled “Characteristics of advanced electronic signature solutions”, breaking down and making explicit the requirements already contained in the definition set out in art. 26 of European Regulation No 910/2014 (eIDAS), establishes the characteristics of FEA solutions. The characteristics of the technologies used, and how they make it possible to comply with the requirements of the above regulatory references, are described below:

**It is uniquely linked to the Signatory**

The signing procedure can be activated only by the Signatory by entering the One Time Password received on their mobile phone number. The mobile phone number is certified by the Provider and linked exclusively to the Signatory during the identification phase.

**It is capable of identifying the Signatory**

The non-qualified signature certificate contains the Signatory's personal identification data, collected by the Provider when verifying the Signatory's identity.

**It is created using electronic signature creation data that the Signatory can, with a high level of confidence, use under their sole control**

In the proposed solution, the following signature creation data are identified: 1) the OTP sent by SMS to authenticate the Signatory and 2) the private key of the non-qualified electronic certificate, which can be invoked only after the Signatory has been successfully authenticated.

**It is linked to the data signed therewith in such a way that any subsequent change in the data is detectable**

The use of cryptographic signature mechanisms ensures the integrity of the signed data.

**The Signatory can obtain evidence of what has been signed**

The signed contracts are made available to the Signatory by the Provider.

**Identification of the party referred to in art. 55, paragraph 2, letter a) DPCM 22.02.2013 (Provider)**

The references to the Provider are given in this Operations Manual and in the Enrollment Form made available to the Signatory.

**Absence of any element in the subject of the signature capable of altering the acts, facts or data represented therein**

The documents to be signed are produced in such a way as to ensure compliance with the requirements of the Digital Administration Code and of the DPCM of 13 November 2014 on the “creation, transmission, copying, duplication, reproduction and time validation of electronic documents” (no macros or functions).

**It is uniquely linked to the signed document** The customer's OTP authentication transaction and the insertion of the Signatory's electronic signatures into the signature field are unique events.

## Contacts

### Information on the FEA service

Any communication, request for support and complaint, including requests pursuant to art. 57 of the DPCM \[3], can be sent to the Provider using the contact details given in the service Enrollment Form. This document is published on the Provider's website at the address given in the service Enrollment Form.

### Document request procedure

The Signatory can obtain, at any time, a copy of all documentation relating to the Advanced Electronic Signature service or signed with it. In particular, it is possible to obtain a copy or duplicate of:

- the Enrollment Form signed upon enrollment in the service;

- the form of consent to the processing of personal data signed upon enrollment in the service;

- the identity document attached to the enrollment form;

- the documents signed with the FEA.

Documents must be requested directly from the Provider using the contact details given in the service Enrollment Form.