What it costs to be a digital signature certifier

This is the resolution that turned into procedure what Decreto 743/2024 had authorised. In one move it repeals the three resolutions that held up the old process — 116/2017, 42/2019 and 946/2021, whose section 25 declared physical presence an "unavoidable condition" — and approves eight annexes that are the rulebook in use today: procedures and technical guidelines (I), licensing requirements (II), the Single Certification Policy (III), certificate and revocation-list profiles (IV), minimum content of subscriber agreements (V) and of terms with third-party users (VI), fee and surety bond amounts (VII) and minimum content of the privacy policy (VIII). It gave certifiers 30 business days to file their new Single Certification Policy, and authorised them to keep issuing while it was being approved. ⭐ Annex VII is the one with numbers, and they are in Procurement Modules (MC), not pesos: private Licensed Certifier licence 1,600 MC · renewal 800 MC · pre-licensing audit 700 MC · annual ordinary audit 580 MC · inspections 350 MC · new version of the Single Certification Policy 200 MC · audit or inspection of a private Registration Authority hanging off a public certifier: 50 MC · and a minimum surety bond of 3,200 MC. Per diems: 0.9 MC per day per auditor, plus travel and lodging borne by any certifier based outside the City of Buenos Aires. Fines under Ley 25.506: between 157 and 7,865 MC. ⭐ And what Annex II says, which had not been opened on the previous pass: the requirements for obtaining a licence. Every applicant files eleven documents — Single Certification Policy, Subscriber Agreement, Terms and conditions with Relying Parties, Privacy Policy, contracts with infrastructure providers, Procedures Manual, Cessation of Activities Plan, Security Plan, Contingency Plan, description of the technology platform and description of the services — all digitally signed and filed solely through Trámites a Distancia (TAD) or the State's document management system. A private company adds seven more papers: the surety bond, the articles of incorporation certified by a notary, the latest shareholders' and board minutes also certified, registration with the Inspección General de Justicia or the relevant public registry, the ARCA registration certificate, the latest audited financial statements and proof of payment of the filing fee. The Security Plan is built on the guidelines of the IRAM ISO/IEC 27002 standard, the annex itself clarifying that "certification is not required". And there are two physical requirements that are the ones that really cost: the equipment issuing the certificates must be on Argentine territory, on independent servers dedicated solely to certification; and the premises are organised into six nested security levels — at the third, identification by two different methods on entry and exit; at the fourth, nothing may be done without two authorised operators present; and the fifth and sixth are a safe or a reinforced cabinet holding the elements that activate the private key. verif · Feb 20, 2025 ↗

From its publication in the Boletín Oficial, 20 February 2025 (section 13). The 30-business-day deadline set by section 10 for certifiers to file their new Single Certification Policy expired in April 2025. verif · Feb 20, 2025 ↗

To anyone who wants to enter the digital signature certification business, a service Decreto 743/2024 has just made remote and therefore sellable at a distance. And there are two doors, very different in price and in demands. The expensive door: Licensed Certifier. It pays the licence (1,600 MC), the pre-licensing audit (700 MC), the annual audit (580 MC) and posts a minimum surety bond (3,200 MC); and, under Annex II, it files eighteen documents, sets up its issuing infrastructure on Argentine territory with dedicated servers, and organises its premises into six levels of physical security, with two operators present for any signing operation. ⭐ The cheap door: Registration Authority — the body that verifies the applicant's identity on a certifier's behalf. And here is the correction that opening the annexes brought, because it changes the answer: the Registration Authority is not licensed. Annex I (ss. 23 to 32) says they are "the entities empowered by Licensed Certifiers", that they operate "under the responsibility of those Licensed Certifiers" and that the certifier enables them by notifying the State, with seven items: name, physical address, telephone and email, the people responsible for each role, the start date and whether they will operate in fixed or mobile mode. There is no entry fee, no minimum capital and no surety bond required of the Registration Authority in either annex. What is required: three people in defined roles — a Head of the Registration Authority, a Registration Officer who does the operational work and a Digital Signature Technical Support Officer (s. 29 of the Annex to Decreto 182/2019); a workstation with physical security preventing unauthorised access to the documentation (Annex II, Section 4, point 3); and mandatory use of RENAPER's identity verification service (Annex I, s. 26). ⚠️ Three conditions that are not free and are worth knowing before telling the business story: (1) the Licensing Authority may audit it before it starts, every year or whenever it wishes; (2) a public-sector certifier may deregister it if in three months it approves not a single application for a certificate; and (3) the link with the certifier is a commercial contract, so the real cost of entry is not the State's fee but whatever that agreement says. verif · Feb 20, 2025 ↗