Electronic signatures in Paraguay: which signature you need for each use

Anyone trying to sign electronically in Paraguay quickly encounters terms such as electronic signature, qualified electronic signature, F1, F2, F3, chip cédula and Identidad Electrónica. The better starting point is not the technology but a simpler question: what do you actually want to do?

The short answer: which solution do I need?

That already answers the most common cases. There is no need to understand F1, F2 and F3 first.

An electronic signature and a qualified signature are not the same thing

Law No. 6822/2021 deliberately defines electronic signatures broadly. An electronic signature cannot be denied legal effect or admissibility merely because it is electronic or because it does not meet the requirements of a qualified signature.

A qualified electronic signature, however, has a stronger expressly defined legal effect: Article 39 gives it the same legal effect as a handwritten signature.

This does not mean that every transaction can automatically be completed electronically. Special statutory formalities can still apply. Where electronic form is permitted and a qualified signature is required or used, the law nevertheless expressly gives that signature equivalence with a handwritten signature.

e-Kuatia’i: DNIT already defines the route

For small electronic invoicers, the answer is particularly clear. The Dirección Nacional de Ingresos Tributarios (DNIT), Paraguay’s tax authority, provides users of e-Kuatia’i with a qualified electronic-signature certificate free of charge.

e-Kuatia’i is DNIT’s free electronic-invoicing solution for small taxpayers with one establishment and one point of issuance. The qualified certificate is one of the requirements for using the system.

A taxpayer who wants to use e-Kuatia’i therefore does not need to begin by comparing private providers or F1, F2 and F3 certificate labels. The intended starting point is DNIT’s free certificate.

e-Kuatia with your own software: use an authorised provider

The route is different for e-Kuatia. This model is for businesses using their own software to submit electronic tax documents to the Sistema Integrado de Facturación Electrónica Nacional (SIFEN), Paraguay’s national electronic-invoicing system.

Here DNIT requires a qualified electronic-signature certificate from a Prestador Cualificado de Servicios de Confianza, a qualified trust-service provider authorised by the Ministry of Industry and Commerce.

The practical decision is therefore not initially “F1, F2 or F3?” but e-Kuatia’i or e-Kuatia? e-Kuatia’i has the DNIT route; e-Kuatia requires an authorised qualified provider.

Signing general documents: the chip cédula

For contracts, declarations, applications, permits, forms and other documents, Paraguay’s chip cédula provides a concrete route to a qualified signature.

The Ministry of the Interior, operating through the Identification Department of the National Police, is an authorised qualified trust-service provider. The certificate used on the cédula is listed in the official trust list as an F2 certificate.

Having a chip cédula does not automatically mean that a signing certificate is already installed.

If you already have a chip cédula, a smart-card reader can be used to check whether the certificate is present. The software should display information including the holder’s name, issuer, serial number and validity period. Without a reader, Portal Paraguay currently says the certificate can also be checked at the MITIC desk at the central Identificaciones office.

If the certificate is missing, installation can be requested from Identificaciones. Portal Paraguay says installation on an existing chip cédula currently carries no additional fee. If the identity card itself has to be renewed, the ordinary document fee applies.

When applying for or renewing a chip cédula, the qualified signing certificate should be requested expressly. At collection, a four-digit PIN is set and later used to trigger the signature.

What is needed to sign a PDF?

The card alone is not enough. According to the official instructions, the user needs:

• a chip cédula with an active qualified certificate;
• the four-digit PIN;
• a computer or notebook;
• a compatible smart-card reader;
• the required drivers and smart-card software;
• Paraguay’s Public Key Infrastructure (PKI) certificates;
• compatible signing software such as Adobe Acrobat Reader or JSignPDF.

Identificaciones provides software for Windows, macOS and Linux, the required Paraguayan certificates and a validation guide.

How to sign a PDF with the chip cédula

1. Connect the smart-card reader.
2. Insert the cédula and check that the certificate is recognised.
3. Open the PDF in compatible software.
4. Choose the digital-signature or certificate-signing function.
5. Select the certificate issued by the Ministry of the Interior.
6. Save the document.
7. Enter the four-digit PIN.

The visible picture of a signature inside the PDF is not the decisive element. The actual signature consists of cryptographic data bound to the document. A scanned autograph by itself does not make a PDF a qualified-signed document.

What do F1, F2 and F3 mean?

Paraguay’s official trust list uses the labels F1, F2 and F3 for different authorised certificate types. The list also shows which providers are authorised for which types.

What the official sources already attached to this article do not provide is a reliable universal consumer rule such as “F1 means tax, F2 means hardware and F3 means cloud signing”. That would be too broad for a practical guide.

For the main use cases, the reader does not need that taxonomy:

• e-Kuatia’i: DNIT certificate;
• e-Kuatia: authorised qualified provider;
• chip cédula: F2 certificate from the Ministry of the Interior;
• another specific platform: follow its published requirements.

Who may issue qualified certificates?

The Ministry of Industry and Commerce maintains Paraguay’s official trust list of qualified trust-service providers. It currently lists seven issuers for qualified electronic-signature certificates: VIT S.A., CODE100 S.A., Documenta S.A., the Ministry of the Interior, Confirma S.A., ITTI S.A.E.C.A. and SOS Tecnología y Gestión de Información Ltda.

Authorisations are specific to services and certificate types and can change. Anyone buying a private certificate should therefore start from the current official trust list rather than relying only on a provider’s advertising.

How should a received qualified signature be validated?

A visible signature graphic or a green symbol in a PDF application is not a complete validation.

Article 47 of Law No. 6822 includes checks such as:

• Was the certificate a qualified certificate at the time of signing?
• Was it issued by a qualified trust-service provider?
• Was it valid at the time of signing?
• Do the certificate holder and claimed signer match?
• Has the document remained unchanged since signing?
• Was the signature created through a qualified signature-creation process?

With the chip cédula, the Paraguayan certification chain may need to be installed on the computer before signing software can validate the certificate correctly.

A certificate that expires later does not automatically make a signature created earlier invalid. One of the key questions is whether the certificate was valid when the signature was created.

When is a timestamp also useful?

For electronic private instruments, a qualified signature proves the authenticity of the signature and the identity of the signer, but it does not automatically establish a particular date.

If the time itself needs stronger proof, a qualified electronic timestamp can be relevant. It is used to establish the date, time and integrity of the associated data.

Companies: signature or electronic seal?

An electronic signature belongs to a natural person. For legal entities, the law also provides for an electronic seal, primarily to establish the origin and integrity of data issued by an organisation.

If a transaction requires a qualified electronic seal from a legal entity, the law generally also requires acceptance of the qualified signature of its authorised representative. The reverse does not automatically apply: a company seal does not replace a specifically required personal qualified signature.

Anyone trying to sign electronically in Paraguay quickly encounters terms such as electronic signature, qualified electronic signature, F1, F2, F3, chip cédula and Identidad Electrónica. The better starting point is not the technology but a simpler question: what do you actually want to do?

The short answer: which solution do I need?

This answers the most common cases. Understanding F1, F2 and F3 is nevertheless useful because the type directly affects where the signing key is stored, how long the certificate can remain valid and what recurring costs can arise.

An electronic signature and a qualified signature are not the same thing

Law No. 6822/2021 deliberately defines electronic signatures broadly. An electronic signature cannot be denied legal effect or admissibility merely because it is electronic or does not meet the requirements of a qualified signature.

A qualified electronic signature, however, has a stronger expressly defined effect: Article 39 gives it the same legal effect as a handwritten signature.

This does not mean that every transaction can automatically be completed electronically. Special statutory formalities can still apply. Where electronic form is permitted and a qualified signature is required or used, the law expressly gives that signature equivalence with a handwritten signature.

e-Kuatia’i: DNIT already defines the route

For small electronic invoicers, the answer is particularly clear. The Dirección Nacional de Ingresos Tributarios (DNIT) provides users of e-Kuatia’i with a qualified electronic-signature certificate free of charge.

e-Kuatia’i is DNIT’s free electronic-invoicing solution for small taxpayers with one establishment and one point of issuance. The qualified certificate is one of the requirements for using the system.

An e-Kuatia’i user therefore does not need to select a private provider or buy a commercial F1 certificate first. DNIT’s free certificate is the intended route.

e-Kuatia with your own software: obtain your own certificate

The route is different for e-Kuatia. This model is for businesses using their own software to submit electronic tax documents to the Sistema Integrado de Facturación Electrónica Nacional (SIFEN), Paraguay’s national electronic-invoicing system.

DNIT requires a qualified certificate from a trust-service provider authorised by the Ministry of Industry and Commerce.

F1 is especially common in this environment. Under Paraguay’s current certification policy, F1 is the model in which the private key is stored in a software module. Its certificate may be valid for no more than one year. A business that depends on it for invoicing therefore needs a renewed or newly issued certificate at least annually.

As a current market example, electronic-invoicing platform GOEKUA quotes ₲350,000 for an F1 certificate and expressly states that it is renewed every year. This is a commercial example, not a government-set tariff.

Signing general documents: the chip cédula

For contracts, declarations, applications, permits, forms and other documents, Paraguay’s chip cédula provides a concrete route to a qualified signature.

The Ministry of the Interior, operating through the Identification Department of the National Police, is an authorised qualified trust-service provider. The certificate used on the cédula is listed in the official trust list as an F2 certificate.

Having a chip cédula does not automatically mean that a signing certificate is already installed.

A smart-card reader can be used to check an existing card. The software should display information including the holder’s name, issuer, serial number and validity period. Without a reader, Portal Paraguay currently says the certificate can also be checked through Identificaciones.

If the certificate is missing, installation can be requested from Identificaciones. Portal Paraguay states that installation on an existing chip cédula currently carries no additional fee. If the identity card itself must be renewed, the ordinary document fee applies.

When applying for or renewing a chip cédula, the qualified signing certificate should be requested expressly. At collection, a four-digit personal identification number (PIN) is set and later used to trigger the signature.

What is needed to sign a PDF?

The card alone is not enough. According to the official instructions, the user needs:

• a chip cédula with an active qualified certificate;
• the four-digit PIN;
• a computer or notebook;
• a compatible smart-card reader;
• the required drivers and smart-card software;
• Paraguay’s Public Key Infrastructure (PKI) certificates;
• compatible signing software such as Adobe Acrobat Reader or JSignPDF.

Identificaciones provides software for Windows, macOS and Linux, the required Paraguayan certificates and a validation guide.

How to sign a PDF with the chip cédula

1. Connect the smart-card reader.
2. Insert the cédula and check that the certificate is recognised.
3. Open the PDF in compatible software.
4. Choose the digital-signature or certificate-signing function.
5. Select the certificate issued by the Ministry of the Interior.
6. Save the document.
7. Enter the four-digit PIN.

The visible picture of a signature inside the PDF is not the decisive element. The actual signature consists of cryptographic data bound to the document. A scanned autograph by itself does not make a PDF a qualified-signed document.

F1, F2 and F3: why are there three types?

F1, F2 and F3 are not three levels meaning “slightly, moderately and especially legally valid”. The number mainly describes how and where the private signing key is protected and stored.

The current certification policy also distinguishes by use. General qualified electronic-signature certificates use F2 or F3. Qualified tax certificates can use F1, F2 or F3. This explains why F1 is especially visible in electronic invoicing while F2 and F3 are also sold for general document signing.

F3 is therefore not “more legally valid” than F2. The important distinction is who controls the qualified device: the user in F2, or the provider centrally in F3. F1 instead uses a software-based key for the authorised tax-certificate context.

What does it cost in practice?

There is no single price for an electronic signature. Cost depends heavily on the type and provider. The following current examples were checked on October 3, 2026:

The private prices are examples, not official tariffs. They can change and may include different services. The F2 and F3 examples also cannot be compared solely on their purchase price: the quoted F2 allows unlimited signatures for two years, while the F3 package contains 50 signatures.

Does the certificate have to be renewed every year?

Not every certificate — but F1 does expire after no more than one year. This probably explains why users familiar with electronic invoicing often assume that every Paraguayan signing certificate needs annual renewal.

The current certification policy sets these maximum validity periods:

• F1: maximum 1 year;
• F2: maximum 4 years;
• F3: maximum 4 years.

A provider can issue a certificate for a shorter period. The current Dígito/Documenta example demonstrates this: its F2 product lasts two years even though the regulatory maximum is four, while its F3 product uses the full four-year period.

The actual expiry date should therefore always be checked in the certificate itself. Businesses should treat it like the expiry of a licence or other operationally critical credential and arrange renewal in advance.

Once the certificate has expired, it cannot be used to create new signatures. For a certificate used with SIFEN, failing to renew it can therefore interrupt electronic invoicing.

For the chip cédula, Identificaciones directs users with an expired certificate back to its service points for renewal.

Later expiry does not automatically invalidate a signature created earlier. A central question in validation is whether the certificate was valid when the document was signed.

Who may issue qualified certificates?

The Ministry of Industry and Commerce maintains Paraguay’s official trust list of qualified trust-service providers. It currently lists seven issuers for qualified electronic-signature certificates: VIT S.A., CODE100 S.A., Documenta S.A., the Ministry of the Interior, Confirma S.A., ITTI S.A.E.C.A. and SOS Tecnología y Gestión de Información Ltda.

Not every provider is authorised for every type. The current trust list therefore shows whether each provider may issue F1, F2 and/or F3 certificates. This official list matters more than a general marketing claim from a seller.

How should a received qualified signature be validated?

A visible signature graphic or a green symbol in a PDF application is not a complete validation.

Article 47 of Law No. 6822 includes checks such as:

• Was the certificate a qualified certificate at the time of signing?
• Was it issued by a qualified trust-service provider?
• Was it valid at the time of signing?
• Do the certificate holder and claimed signer match?
• Has the document remained unchanged since signing?
• Was the signature created through a qualified signature-creation process?

With the chip cédula, the Paraguayan certification chain may need to be installed on the computer before signing software can validate the certificate correctly.

When is a timestamp also useful?

For electronic private instruments, a qualified signature proves the authenticity of the signature and the identity of the signer, but it does not automatically establish a particular date.

If the time itself needs stronger proof, a qualified electronic timestamp can be relevant. It is used to establish the date, time and integrity of the associated data.

Companies: signature or electronic seal?

An electronic signature belongs to a natural person. For legal entities, the law also provides for an electronic seal, primarily to establish the origin and integrity of data issued by an organisation.

If a transaction requires a qualified electronic seal from a legal entity, the law generally also requires acceptance of the qualified signature of its authorised representative. The reverse does not automatically apply: a company seal does not replace a specifically required personal qualified signature.

What if a token is lost, a key compromised or a certificate expires?

Expiry and revocation are different. A certificate expires automatically on its stated date. Revocation ends its validity early, for example if a token is lost or the private key may have been compromised.

If misuse is suspected, the certificate should be suspended or revoked promptly through the issuer. Revocation of a qualified certificate is final; a new certificate is then required.

If the certificate has merely expired, it must be renewed or reissued. For F1, this is a regular requirement because its maximum validity is one year. For F2 and F3, the actual renewal cycle depends on the validity period chosen by the provider.

The decision rule in one sentence

For e-Kuatia’i use DNIT’s free certificate; for electronic invoicing with your own software, F1 is a common one-year tax-certificate model; F2 means a qualified key on a cédula or token under your control; F3 means qualified remote signing with the key protected centrally by the provider. Compare not only the purchase price but also validity, renewal, required hardware and any signature allowance.

What if a token is lost, a PIN forgotten or a certificate expires?

If misuse is suspected or signing credentials are lost, the certificate should be suspended or revoked promptly through the issuer. Revocation of a qualified certificate is final; a new certificate is then required.

For the chip cédula, Identificaciones directs users with a forgotten PIN or expired certificate back to its service desks.

The decision rule in one sentence

Do not begin with F1, F2 or F3; begin with the transaction: e-Kuatia’i leads to DNIT, e-Kuatia to an authorised qualified provider, general qualified signing can be done through the chip cédula, and a specialised system is governed by its expressly published requirements.