Being a Registration Authority: what the rules require

Annex II of the resolution — «Requirements for licensing certifiers» — is the document that says what infrastructure is needed, and it separates two roles with requirements that are nothing alike. The Licensed Certifier must submit eleven documents (Single Certification Policy, subscriber agreement, terms and conditions for relying parties, privacy policy, contracts with infrastructure providers, procedures manual, cessation-of-activities plan, security plan, contingency plan, description of the technological platform and description of the services provided), and if it is a private legal entity also a performance bond, notarially certified articles and minutes, registration with the Companies Registry and with the tax authority ARCA, its latest audited financial statements and proof of payment of the filing fee. It is then subject to inspections and audits at its premises, with access for the Licensing Authority and the national audit office. And on physical controls it needs four levels of access to get from open circulation to the equipment that signs certificates, plus two further levels — 5 and 6 — consisting of a safe, reinforced cabinet or exclusive-access compartment for the elements that activate the private key. The Registration Authority has none of those levels. The text requires of it, literally, «a physical security system that guarantees its proper operation and the adequate protection of the information and documentation submitted by the applicant or holder», taking every measure «to prevent unauthorised access to the Registration Officer's workstation and to the documentation entrusted to them». It may operate «at a physical location different from the Certifying Authorities», and it may work from mobile desks where «conditions warranting such a service arise», subject to two conditions: notifying the Licensing Authority, and providing its Registration Officers with their own equipment running an up-to-date operating system and antivirus. verif · Feb 20, 2025 ↗

In force with the resolution, since 20 February 2025. It is the set of rules in operation today: the resolution itself repealed the three that underpinned the previous procedure, among them Resolution 946/2021, whose article 25 declared physical presence an «unavoidable condition». verif · Feb 20, 2025 ↗

The small firm in the interior that wants to sell identity verification. Now that a digital signature can be obtained without physical presence, somebody has to verify that a person is who they say they are, and that job belongs to the Registration Officer. Annex II says what is needed to do it: a workstation with controlled access, safeguarded documentation and up-to-date equipment. It does not require a vault, audited financial statements or a performance bond. Anyone who needs to sign where there are no offices. The mobile desk is expressly provided for, and that is the case of a mining camp, a well site, a road job or a town with no bank branch: the Registration Officer goes, verifies and comes back. And the certifier that wants territorial coverage without opening its own premises in every province: its Registration Authorities may sit elsewhere, and the rules set them no numbered levels of physical security. verif · Feb 20, 2025 ↗