Starting August 20, 2026 (11:00 PM, Chile time), the identity verification step used to issue Advanced Electronic Signature (FEA) certificates changes: the traditional question challenge is formally replaced by a digital verification based on a bank transfer. This article explains why the change was made, how the new mechanism works, and its legal and data-protection implications. The official communications from E-SIGN S.A. (the accredited Certification Service Provider behind Legale.io’s advanced remote signature) are available for download at the end of this article as supporting evidence.
1. Why the question challenge was replaced #
During the 2025 Annual Ordinary Inspection of E-SIGN carried out by the Accrediting Entity (which reports to the Undersecretariat of Economy and Smaller-Sized Companies, Subsecretaría de Economía y Empresas de Menor Tamaño), the regulator recommended reinforcing the process of reliable identity verification for the issuance of FEA certificates. Specifically, it recommended strengthening the complementary mechanisms used together with ClaveÚnica to validate the applicant’s identity, in order to:
- Mitigate fraud risks (question challenges rely on personal data that can be leaked or guessed);
- Raise the overall security and traceability standards of the enrollment process; and
- Ensure strict regulatory compliance.
In response to this requirement, and in accordance with Article 3 of Decree No. 24 (April 9, 2019) of the Ministry of Economy, Development and Tourism, E-SIGN implemented a new digital identity verification mechanism based on a bank transfer, which formally replaces the question challenge.
2. What changes in practice #
- New mechanism: digital identity verification through a bank transfer.
- Substitution: this method formally replaces the question challenge as the complementary verification used alongside ClaveÚnica.
- Objective: maximize security standards, mitigate fraud risks, and strengthen operational and regulatory traceability.
- Deadline for the change: August 20, 2026, 11:00 PM (Chile time).
3. How the bank transfer verification works #
The verification is performed through a bank transfer that the applicant makes directly from their own bank’s website or application. Khipu S.A. acts exclusively as the technology provider that confirms, against real banking information, that the transfer matches the generated charge, and notifies E-SIGN of the result of that validation through an API. Khipu does not take part in the internal, accounting, or financial reconciliation processes of either the applicant or E-SIGN.
4. Legal implications and regulatory backing #
The mechanism is fully backed at the regulatory level:
- E-SIGN is an accredited Certification Service Provider under Law No. 19,799 on Electronic Documents, Electronic Signatures, and Certification Services.
- The use of a bank transfer as a complementary method to verify the applicant’s identity for the issuance of FEA certificates was expressly validated by the Undersecretariat of Economy and Smaller-Sized Companies, the Accrediting Entity of the Advanced Electronic Signature system, in a formal communication to E-SIGN.
- That communication states that the procedure complies with Article 3 of Decree No. 24 of April 9, 2019, and is therefore fit to operate as a complementary digital identity verification mechanism.
This means certificates issued under the new mechanism keep the full legal validity and evidentiary weight that Chilean law grants to the Advanced Electronic Signature.
5. Protection of your banking data #
E-SIGN has formally placed on record that no banking credential or record of the applicant is stored by Khipu or by E-SIGN:
- Authentication takes place entirely within the applicant’s own bank environment. Online banking credentials are never entered on Khipu’s or E-SIGN’s systems.
- Khipu publicly declares that it does not keep users’ banking credentials or secondary passwords (source: Khipu — “Security for the payer”).
- All communications are encrypted over HTTPS, and each result notification is signed with HMAC-SHA256, which makes it possible to verify that the information was not altered in transit and that it actually comes from Khipu.
- E-SIGN receives, via API and webhooks, only the signed binary result of the validation (approved or rejected) and the minimum data needed to associate that result with the pending certificate request — no bank passwords, statements, or online banking access data.
- The E-SIGN–Khipu integration is permanently monitored and audited, and the platform undergoes penetration testing every six months.
6. Summary #
- The question challenge is formally replaced by bank transfer verification as of August 20, 2026, 11:00 PM.
- The change responds to a recommendation issued by the Accrediting Entity during the 2025 Annual Ordinary Inspection of E-SIGN.
- The mechanism has express regulatory backing under Law No. 19,799 and Article 3 of Decree No. 24 of 2019.
- Your banking credentials never leave your bank’s environment and are not stored by Khipu or E-SIGN.
- E-SIGN’s team will support clients throughout the transition. For assistance, contact your account executive or contacto@e-sign.cl.
7. Official documents (downloadable evidence) #
The original official communications (in Spanish) can be downloaded here:
