Electronic Signatures and Trust Infrastructures (ESI); Policy and security requirements for trust service components providing identity proofing of trust service subjects

Note

ETSI technical specification setting the policy and security requirements for trust service components responsible for verifying the identity of subjects, at two levels (version 2.1.1).

Summary

Purpose

Technical specification ETSI TS 119 461 (version 2.1.1, February 2025) sets the requirements for identity proofing, that is, the verification of a person’s identity before a trust service is provided to them ETSI TS 119 461 V2.1.1, § 1 Scope ETSI TS 119 461 V2.1.1, History. Its scope begins as follows:

This component may be provided by the trust service provider itself or by a specialised identity proofing service provider (IPSP) acting as a subcontractor ETSI TS 119 461 V2.1.1, § 1 Scope. The specification defines two levels of identity proofing (LoIP), Baseline and Extended, and a means of moving from the first to the second when the Baseline level was reached with an electronic identification means of assurance level substantial ETSI TS 119 461 V2.1.1, § 1 Scope.

Who it applies to

• Qualified trust service providers that issue a qualified certificate or a qualified electronic attestation of attributes and must verify the identity and, if applicable, the attributes of the person Art. 24(1c) Art. 1.
• Providers of person identification data (PID) and the entities that carry out identity proofing on their behalf, during remote onboarding to the wallet; a recital of Implementing Regulation 2026/798 states that its requirements should be met by them laying down rules for the application of Regulation (EU) No 910/2014 of the European Parliament and of the Council as regards reference standards and specifications for the remote onboarding of users to the European Digital Identity Wallets by electronic identification means conforming to assurance level substantial in conjunction with additional remote onboarding procedures where the combination meets the requirements of assurance level high.

Key points

• Five steps: initiation, collection of attributes and evidence, validation, binding to the applicant, issuance of the proof ETSI TS 119 461 V2.1.1, § 8 Identity proofing service requirements.
• Use cases: a process complies if it follows at least one use case of clause 9 or of Annex C; the specification recommends an assessment by an independent, accredited body ETSI TS 119 461 V2.1.1, § 9.1 Introduction, compliance with the present document, general requirements for all use cases.
• Context: applicable legislation may impose a level, attributes, evidence or means of validation ETSI TS 119 461 V2.1.1, § 4.3 Identity proofing context.
• Annex C for qualified services: clause C.2 targets the original Regulation 910/2014, clause C.3 the amended Regulation, for qualified certificates and qualified attestations ETSI TS 119 461 V2.1.1, § 1 Scope ETSI TS 119 461 V2.1.1, Annex C (normative): Use cases for identity proofing for EU qualified trust services.
• Biometrics: binding to the applicant may rely on automated or manual face comparison ETSI TS 119 461 V2.1.1, § 8.4 Binding to applicant.

What the acts apply, and how

• Implementing Regulation 2025/1566 (qualified certificates and qualified attestations): the specification version 2.1.1 applies for the purpose of compliance with Annex C, clause C.3, subject to adaptations Reference standard for the verification of the identity and attributes of persons to whom a qualified certificate or qualified electronic attestation of attributes is to be issued. It applies from 19 August 2027 Art. 2. The adaptations date the reference to ETSI EN 319 401 (version 3.1.1); lay down a new condition when the verification also serves to issue authoritative evidence (process peer-reviewed or certified at assurance level high, or compliant with clauses C.3.1 to C.3.6); require, in the use case of other identification means, an accredited conformity assessment body, whose assessment results in a certificate of compliance with wording that differs between language versions (see below); regulate the FAR and FRR rates of automated processes; have certain document validation measures tested by an accredited laboratory or a national competent authority, where these are designated, by 19 August 2027 at the latest and then every two years; and refer the termination plan to the acts adopted for the cessation of activity Reference standard for the verification of the identity and attributes of persons to whom a qualified certificate or qualified electronic attestation of attributes is to be issued. The article of Regulation 910/2014 that empowers the Commission contains no sentence establishing a presumption Art. 24(1c).

  Wording that differs between language versions. For requirement QTS-C.3.4-06A, the English version of the annex reads:

The French version of the same passage uses “doit aboutir” (“must result”) instead Reference standard for the verification of the identity and attributes of persons to whom a qualified certificate or qualified electronic attestation of attributes is to be issued. The summary does not decide between the two.

• Implementing Regulation 2026/798 (remote onboarding to the wallet with an electronic identification means of assurance level substantial): conformity is assessed against the clauses listed, subject to the adaptations LIST OF REFERENCE STANDARDS AND SPECIFICATIONS. The clauses targeted are clauses 5 to 8, 9.1, 9.2.2, 9.2.3, 9.2.4 and 9.5 Section 1 – Applicable clauses; the other use cases (9.2.1 physical presence, 9.2.5 signature with a certificate, 9.3 legal person, 9.4 natural person representing a legal person) and Annex C are not included. Among the adaptations, a process must follow use case 9.5 for the Extended level, and the reference facial image is read from the chip of the document by near-field communication (NFC) Section 2 – Adaptations. This Regulation is self-standing: it does not amend Implementing Regulation 2025/1566 and is based on another article of Regulation 910/2014, without a presumption sentence Art. 1 Art. 5a(24).
• Implementing Regulation 2025/2162: its Annex II cites the specification, without a version, for several qualified services, including the issuance of qualified certificates and qualified electronic attestations of attributes; conformity assessment schemes include at least these standards, as applicable, with their year and version number Annex II Art. 6(3).

Important clauses

• ETSI TS 119 461 V2.1.1, § 1 Scope: scope and levels.
• ETSI TS 119 461 V2.1.1, § 8 Identity proofing service requirements: requirements per step.
• ETSI TS 119 461 V2.1.1, § 9.5 Use cases for additional identity proofing to enhance an identity proven by use of an eID from Baseline LoIP to Extended LoIP: enhancement to the Extended level, targeted by Implementing Regulation 2026/798.
• ETSI TS 119 461 V2.1.1, C.3 Use cases for issuing of qualified certificate or qualified electronic attestation of attributes according to Article 24.1, 24.1a, and 24.1b of the amended eIDAS regulation: use cases targeted by Implementing Regulation 2025/1566.

Links

• General foundation: ETSI EN 319 401 ETSI EN 319 401 V3.1.1.
• Issuance of certificates: ETSI EN 319 411-1 ETSI EN 319 411-1 V1.5.1 and EN 319 411-2 ETSI EN 319 411-2 V2.6.1.
• Learning path: step 4, trust services.

ETSI standard: the site reproduces only short extracts; the full text is available from ETSI ETSI TS 119 461 V2.1.1. Written by Asphalia.