The signature is the easy part
Collecting an electronic signature is close to a solved problem, and that is precisely why it isthe wrong thing to evaluate a system on. If a client later disputes what they agreed to, thesignature itself establishes very little: they are rarely denying that they clicked. What theydispute is whether they understood, whether they saw the relevant document, or whether thedocument they signed is the one being shown to them now. A defensible arrangement answers allthree, and none of them is the signature.
Reading evidence, and the ninety per cent rule
The most useful thing a signing flow can capture is evidence of reading. In practice this meanstracking how far through each document the signer has actually scrolled and how long they spent,and not releasing the one-time code until a genuine threshold — around ninety per cent of boththe agreement and the Investor Charter — has been passed. Clients sometimes find this mildlyirritating, which is the point: a flow that can be completed without reading produces asignature that proves nothing, and the irritation lasts a minute while the record lasts foryears.
Identity, time and place
A signature is worth more when it is anchored. The anchors that matter are the signer's verifiedemail or phone, the exact timestamp in a stated timezone, the IP address the signature camefrom, and where possible the city that resolves to. None of these individually proves identity.Together they make a later claim that somebody else signed substantially harder to sustain, andthey cost nothing to capture at the moment of signing. Capturing them afterwards is impossible,which is why this is a design decision rather than a feature.
Hash the document, not the template
The detail most implementations miss: record a cryptographic hash of the exact document that wassigned, not of the template it came from. Agreements get revised. Disclaimers change. If all youcan show is that the client signed 'the MITC', you have to argue about which version. If you canshow a SHA-256 hash of the specific file, there is nothing to argue about — either the documentbeing discussed matches the hash or it does not. This single field removes an entire class ofdispute.
Put it all on one page, at the end
The practical form of all of this is a certificate page appended to the signed document itself:a certificate identifier, the signer's name, email and phone, the timestamp, the IP and city,the document hash, the seconds spent on each document, when the code was sent, when the documentwas first opened, and the advisory business's own name and registration number. One page, onePDF, no assembly required at the moment somebody asks. The value of it is entirely in not havingto gather it later.
Name your provider, and expect to be asked
Compliance officers ask who performs the signature, and 'we have e-sign' is not an answer. Beingable to name a recognised provider — Digio, in our case — answers a question that otherwiseturns into a meeting. Similarly, if a digital signature certificate is applied to outgoingdocuments, its issuer, serial number and validity dates should be recorded for audit rather thanjust configured and forgotten.
How OptumFlex does this
The agreement and the Investor Charter open in a viewer that tracks reading, and the one-timecode does not appear until both are at least ninety per cent read. The signed PDF carries bothdocuments stamped, plus a final certificate page with the identifier, the signer's details, thetimestamp in IST, the IP address and city, the SHA-256 hash of the document signed, the secondsspent on each, and the advisory firm's own name and SEBI registration number. Aadhaar e-sign isprovided through Digio, and a firm's own digital signature certificate can be appliedautomatically with its issuer and validity recorded.