Law · Italy
E-Signature, KYC and AML Rules for SMEs in Italy
Italian SMEs onboarding a new client work under EU electronic-signature law, the national Codice dell'Amministrazione Digitale, and Italy's anti-money-laundering decree for obliged professions. This guide covers when an electronic signature is valid, who has AML duties, what customer due diligence, adeguata verifica, looks like in practice, and the data-protection points around collecting a codice fiscale.
- eIDAS applies directly, and the CAD covers the national detail
- D.Lgs. 231/2007 lists who runs adeguata verifica in Italy
- UIF at the Bank of Italy receives suspicious-transaction reports
Is an electronic signature valid on an Italian contract
Yes, for the majority of private-law documents. The eIDAS Regulation applies directly in Italy, so an electronic signature cannot be denied legal effect solely for being electronic, and a qualified electronic signature carries the same legal weight as a handwritten one. Italy's Codice dell'Amministrazione Digitale, CAD, D.Lgs. 82/2005, sets out the national framework for electronic documents and signatures, including how a document signed with an advanced, qualified or digital signature is treated under Article 21 of the code. For a standard commercial contract or engagement letter, an advanced electronic signature under that framework already carries full legal standing.
When does Italian practice still require a qualified signature
The documents Italian law routes through a notary, an atto pubblico for certain real-estate transfers, company formation acts and specific formal deeds, sit outside what an advanced electronic signature covers, and typically involve either a notary authenticating the signature or a qualified signing process entirely. Outside that narrower set, ordinary commercial paperwork, service agreements, engagement letters and consent forms, does not need a qualified signature. If a specific document in your practice is unclear, check with a notary or your professional body, since the notarial list is set by Italian civil law rather than by eIDAS.
Which professions in Italy run adeguata verifica
D.Lgs. 231/2007, Italy's anti-money-laundering decree, requires customer due diligence, adeguata verifica della clientela, from banks and financial intermediaries and from a defined set of professionals: dottori commercialisti and other accounting professionals, notai, and lawyers for specific transactions such as real-estate deals or company formation. The decree also sets out simplified due diligence for lower-risk situations under Article 25, and a full reporting duty when something looks suspicious. If your practice falls into one of these categories, treating due diligence as optional is not consistent with the decree's own risk-based structure.
What does adeguata verifica actually involve
In practice it means identifying the client, verifying that identity against a reliable document, understanding who owns or controls the client if it is a company, and forming a view of the purpose of the relationship, calibrated to risk under the decree's risk-based approach. A straightforward domestic client gets standard checks; a higher-risk client, a complex ownership structure, a politically exposed person, or an unusual cash pattern, gets a closer look. None of this needs a separate compliance process bolted on afterward if it runs as part of the same intake that collects the engagement letter.
Who receives a suspicious-transaction report in Italy
The Unità di Informazione Finanziaria, UIF, based at the Bank of Italy, is the authority that receives suspicious-transaction reports under D.Lgs. 231/2007. Article 35 of the decree covers this duty in terms of three levels of knowledge, knowing, suspecting or having reasonable grounds to suspect, all of which trigger a report, with no minimum transaction amount exempting a case where genuine suspicion exists. An obliged professional who spots something concerning has a legal duty to report it to UIF rather than deciding privately to end the relationship quietly.
What about data protection when a client's codice fiscale is involved
The codice fiscale, Italy's tax code, identifies a person across many Italian systems at once, which is part of why it deserves the same minimisation discipline as any other identifying data under GDPR. Collecting a client's ID and tax code is generally justified by the legal duty to run due diligence, where the AML decree applies, or by the underlying contract otherwise, but the copy should be kept only for as long as the applicable record-keeping period requires. A scanned ID sitting in an email thread with no retention plan is a more frequent gap in practice than the initial collection.
How this looks as one onboarding flow
In one flow, a new Italian client opens a single link, completes the client-acceptance questionnaire, uploads an ID and codice fiscale, verifies identity where the firm requires it, reads the data-protection notice, and signs the engagement letter with an advanced electronic signature, sealed and evidenced. Adeguata verifica, screening and a risk score run at the point the firm's policy calls for it. For an Italian accounting or law practice with AML duties, Practice at €149 a month adds hosted identity checks; screening runs on your own provider key at every tier, including Solo at €29 a month.
In Braigest
Client acceptance, adeguata verifica and the signed contract, one link
For an Italian accounting or law practice with AML duties, Practice at €149 a month adds hosted identity checks; sanctions screening runs on your own Dilisense key at every tier, including Solo at €29 a month.
Frequently asked questions
Is an electronic signature legally valid in Italy?
Yes, for most private-law documents. The eIDAS Regulation applies directly, and the Codice dell'Amministrazione Digitale sets out the national framework for electronic documents and signatures under Italian civil and administrative law.
Which Italian professionals must run adeguata verifica?
D.Lgs. 231/2007 covers banks and financial intermediaries, plus accounting professionals, notai, and lawyers for specific transactions such as real-estate deals or company formation, among several other legally obliged professional categories.
Where do suspicious-transaction reports go in Italy?
To UIF, the Unità di Informazione Finanziaria at the Bank of Italy, under Article 35 of D.Lgs. 231/2007, rather than to a local police station or a court in the first instance.
Can an Italian firm keep a scanned ID and codice fiscale?
Yes, generally justified by the duty to run adeguata verifica or by the contract, provided the copy is minimised and retained only for the required record-keeping period, not indefinitely by default.
Explore more of the platform
Ready to fix your onboarding?
See the whole flow in a 30-minute call, or explore the full Braigest platform.