In force since Feb 20, 2025
Being a Registration Authority: what the rules require
SICYT Resolution 11/2025, Annex II, Sections 1 and 4
in forceNATIONAL
Market deregulation
Derives from: What it costs to be a digital signature certifier
What Annex II of SICYT Resolution 11/2025 requires to operate as a Registration Authority: no vault levels, no performance bond and mobile desks allowed.
The other rules on this subject40
Mega-DNU 70/2023: repeals the Rentals, Shelves and Supply lawsDecreto 70/2023 (DNU-2023-70-APN-PTE)in force
The IGJ digitizes companies' financial statementsIGJ General Res. 9/2026 (RESOG-2026-9-APN-IGJ#MJ), Official Gazette Jul 2, 2026in force
What changed and who it applies to
What changed
Annex II of the resolution — «Requirements for licensing certifiers» — is the document that says what infrastructure is needed, and it separates two roles with requirements that are nothing alike. The Licensed Certifier must submit eleven documents (Single Certification Policy, subscriber agreement, terms and conditions for relying parties, privacy policy, contracts with infrastructure providers, procedures manual, cessation-of-activities plan, security plan, contingency plan, description of the technological platform and description of the services provided), and if it is a private legal entity also a performance bond, notarially certified articles and minutes, registration with the Companies Registry and with the tax authority ARCA, its latest audited financial statements and proof of payment of the filing fee. It is then subject to inspections and audits at its premises, with access for the Licensing Authority and the national audit office. And on physical controls it needs four levels of access to get from open circulation to the equipment that signs certificates, plus two further levels — 5 and 6 — consisting of a safe, reinforced cabinet or exclusive-access compartment for the elements that activate the private key. The Registration Authority has none of those levels. The text requires of it, literally, «a physical security system that guarantees its proper operation and the adequate protection of the information and documentation submitted by the applicant or holder», taking every measure «to prevent unauthorised access to the Registration Officer's workstation and to the documentation entrusted to them». It may operate «at a physical location different from the Certifying Authorities», and it may work from mobile desks where «conditions warranting such a service arise», subject to two conditions: notifying the Licensing Authority, and providing its Registration Officers with their own equipment running an up-to-date operating system and antivirus. verif Feb 20, 2025 ↗
In force
In force with the resolution, since 20 February 2025. It is the set of rules in operation today: the resolution itself repealed the three that underpinned the previous procedure, among them Resolution 946/2021, whose article 25 declared physical presence an «unavoidable condition». verif Feb 20, 2025 ↗
Who it applies to
The small firm in the interior that wants to sell identity verification. Now that a digital signature can be obtained without physical presence, somebody has to verify that a person is who they say they are, and that job belongs to the Registration Officer. Annex II says what is needed to do it: a workstation with controlled access, safeguarded documentation and up-to-date equipment. It does not require a vault, audited financial statements or a performance bond. Anyone who needs to sign where there are no offices. The mobile desk is expressly provided for, and that is the case of a mining camp, a well site, a road job or a town with no bank branch: the Registration Officer goes, verifies and comes back. And the certifier that wants territorial coverage without opening its own premises in every province: its Registration Authorities may sit elsewhere, and the rules set them no numbered levels of physical security. verif Feb 20, 2025 ↗
The norm
Resolution 11/2025 of the Secretariat for Innovation, Science and Technology of the Chief of Staff's Office, Annex II («Requirements for licensing certifiers to operate with digital signatures»), issued under Digital Signature Law No. 25.506 and Decree 182/2019. Published on 20 February 2025. verif Feb 20, 2025 ↗
Our reading
thesis This annex closes the question left open when we read the fees annex, and it answers it the other way round from what we expected. There we saw that getting licensed as a certifier is very expensive — 1,600 modules in fees, 700 for the pre-licensing audit, a minimum performance bond of 3,200 — and that auditing a Registration Authority costs 50 modules, two orders of magnitude less. From that came the conclusion that «the way in is not licensing, it is being a Registration Authority». Annex II confirms that conclusion from the infrastructure side, which was the missing half: the certifier needs six levels of physical security and a safe; the Registration Authority needs a desk with the documentation under lock and a laptop with up-to-date antivirus, and it can be a mobile desk. ⇒ In other words: the role that is cheap in fees is also the role that is cheap in hardware, and both halves point the same way. But here is the edge that stops us closing the topic: Annex II governs the licensing of the certifier, not the authorisation of a Registration Authority. We did not find the procedure by which a company becomes a Registration Authority, nor whether it exists as a procedure of its own or only as a contract with an already licensed certifier. Without that we know what has to be in place but not whose door to knock on, and that is the piece missing to make this actionable. There are two doors and they are not the same. The one in this annex is becoming the Registration Authority of a licensed certifier. The other, the state platform for remote digital signature, admits private companies only to sign payslips, at the Secretariat's discretion, with a performance bond in favor of the Jefatura de Gabinete, a manager, two registration officers and a technical support manager who are trained and examined, and removal if it approves no application within six months. ⇒ The conclusion about the cheap door for an SME in the provinces depends on the first route, and how a private certifier adds registration authorities is something we have not yet seen. thesis
Analyze this rule for my company
Where it lands, province by province1
San Juan The express authorisation of mobile desks is what makes it viable to verify identity at a high-altitude camp or in a cordillera department with no branches. It is the kind of satellite service that requires no capital and does require a local presence. favorable cheaper to respond: investing takes time, held-back supply shows up at once thesis
First step
Tell us what your company does
Your website is enough to start. We look at what the company does and reply with the projects and the buyers worth looking at.
Open the report ↗A real analysis · a real company, open in full →
Analysis and curation: Ignacio Aredez
Head of Despegue
Method and track record →- 20+ years in technology, 15 of them in data and AI, for clients across Europe and the Americas
- Certified in AI governance (ISO/IEC 42001)
- Machine Learning (Google Cloud)
- Registered expert with the European Commission
How to read the seals →
verif primary source · prob primary source pending · unconf a source said it · estim our own calculation · thesis our reading · the date belongs to the datum, at the precision its source allows