The electronic signature in Ecuador: what makes it valid

The electronic signature is today the key to nearly every business filing in Ecuador: incorporating a company, issuing an invoice, filing a court brief, signing a contract without meeting. And it is also where two different things get confused the most: the drawing of a signature over a PDF, which is nothing, and the signature made with a digital certificate, which a system can verify and which binds as much as pen and ink.

What an electronic signature is

The law defines it without leaning on technology. An electronic signature is "the data in electronic form recorded in a data message, attached to or logically associated with it, which can be used to identify the signature's holder in relation to the data message, and to indicate that the holder approves and acknowledges the information contained" in it.

Two ideas fit there. The first is identity: the signature says who the author is. The second is integrity: the signature stays bound to a specific content, so if the document changes afterwards, the signature stops squaring.

Ley de Comercio Electrónico, Firmas Electrónicas y Mensajes de Datos (Law 2002-67, Registro Oficial supplement 557, April 17, 2002), art. 13.

Why it is worth the same as handwritten

Because article 14 of that same law says so: the electronic signature "shall have equal validity and shall be granted the same legal effects as a handwritten signature in relation to data recorded in written documents, and shall be admitted as evidence in court".

That equivalence is not unconditional: article 15 sets five requirements.

• The signature is individual and exclusively linked to its holder.
• It allows verifying beyond doubt who placed it.
• Its creation and verification method is reliable, secure and unalterable.
• The data it is created with sits under the signer's exclusive control.
• It is controlled by the person it belongs to.

A scribble inserted into a PDF meets none of the five.

The certificate and the .p12 file

The electronic signature certificate is, in the law's words, "the data message certifying the link between an electronic signature and a specific person, through a verification process confirming their identity" (art. 20). It contains, among other requirements, the identification of the issuing authority, the holder's data and the method to verify their signature (art. 22).

What gets downloaded on purchase is usually a file with the .p12 extension (or .pfx): the certificate and its private key inside an encrypted container, protected by a password. In practice, that file is the signature: whoever holds it along with its password can sign in the holder's name. Guard it with the same care as the bank password. That is why the law requires the holder to act "with due diligence" and keep it under their control (art. 17).

Who can issue a valid certificate

Not just anyone. The law reserves issuance to the certification authorities: companies authorized by the State telecommunications body to issue certificates and render related services (art. 29). The 2002 rule named CONATEL, the old national telecommunications council; after the sector's reorganization ordered by the Ley Orgánica de Telecomunicaciones (Registro Oficial third supplement 439, February 18, 2015), which merged the old bodies into the new agency, accreditation is granted today by the Agencia de Regulación y Control de las Telecomunicaciones (ARCOTEL), which publishes on its portal the current list of accredited authorities and of the authorized distributors (the "linked third parties") selling certificates under their backing.

It is the check most people skip. A certificate issued by someone not on that registry can produce a spotless-looking PDF, and that signature still does not equal a handwritten one in Ecuador, nor will the SRI accept it for invoicing.

What it is used for, in practice

• Invoicing. Every electronic receipt is signed before transmission to the SRI; without a certificate there is no valid XML. Detailed in the electronic invoicing guide.
• Incorporating a company. The online filing of the S.A.S. and the other figures is signed electronically (see how a company is incorporated).
• Filings before the State. Court submissions, public procurement, corporate filings and a good share of the digital counters.
• Contracts and private documents. Agreements, minutes, authorizations: any document that used to require gathering signatures on paper.

Validity, revocation and extinction

The electronic signature, says article 18, has indefinite duration; what expires is the certificate backing it, issued for a set term and subject to revocation or suspension. Article 19 also lists the causes of extinction: the holder's will, their death or incapacity, and the dissolution or liquidation of the holding company. That last one matters to businesses: on dissolving, their signature is extinguished.

The operational consequence is prosaic but expensive: an expired certificate stops the invoicing. Note the expiry date the very day you buy it.

What to check before buying one

• That the issuer is accredited on the registry ARCOTEL publishes, or is a linked third party of an authority that is.
• The right holder. To invoice as a company you need the certificate of the person representing the company, with the associated RUC; an individual's certificate without that link does not serve that use.
• Format. The .p12 or .pfx file is what invoicing systems accept. Token certificates (a USB key) or cloud ones solve other scenarios, but do not always fit a server that invoices without human intervention.
• Validity and renewal. How long it lasts and how it renews without cutting the operation.

How a document gets signed

The procedure is always the same: the document is loaded, the certificate and its password are supplied, and the program embeds the signature in the file. What varies is the presentation: it can leave a visible stamp with the signer's data and a QR code, only the QR, or no mark at all: the so-called invisible signature, which stays inside the file without showing on the page.

That choice is cosmetic, not legal: validity depends on the certificate and on meeting article 15's requirements, not on a box showing in the corner. On the other side, when you receive a signed document, the thing to do is not to look at the box but to validate the signature: check who signed, with which certificate and whether the document changed afterwards.