![[eSign] Cross Border Signing Has an Identity Problem. Can One Verification Flow Solve It?](https://mekarisign.com/wp-content/uploads/2026/10/eSign-Cross-Border-Signing-Has-an-Identity-Problem.-Can-One-Verification-Flow-Solve-It-1024x576.webp)
- ASEAN concluded negotiations on the Digital Economy Framework Agreement in May 2026, with digital identity among the areas covered, but the negotiated text remains unpublished.
- Sign with Singpass produces Secure Electronic Signatures under Singapore’s Electronic Transactions Act, but Singpass is available only to eligible Singapore citizens, permanent residents, and FIN holders.
- Singapore separates personal identity through Singpass from corporate authorisation through Corppass. Cross border contract workflows need to preserve the same separation between identity and authority.
- For a cross border contract, the stronger question is whether the business can later prove who signed, how they were authenticated, why they were authorised, and what evidence remains.
On 31 May 2026, Singapore’s Ministry of Trade and Industry announced that ASEAN member states had concluded negotiations on the ASEAN Digital Economy Framework Agreement, or DEFA.
Digital identity is among the areas covered, alongside digital trade, payments, and cross border data flows. The negotiated text remains unpublished, and its practical effect will depend on signing, ratification, and implementation. Contracts between Singapore and Indonesian entities are already being signed today.
The parties may use different national identity systems, different electronic signature frameworks, and different evidentiary rules. The signature itself may take only a few minutes. The harder questions often appear afterwards.
Who actually signed the document? How was that person authenticated? Did the person have authority to bind the company? Can Legal or Compliance retrieve the relevant evidence later? These questions point to a wider issue in cross border signing. Identity is important, but identity alone does not establish trust in the entire transaction.
Why does cross border signing get complicated?
Singapore and Indonesia each have established systems for identity and electronic signing. The complexity starts when people operating under those different systems become parties to the same commercial agreement.
Singapore uses Singpass for digital identity and authentication for eligible users. Indonesia uses certified electronic signatures issued through licensed Electronic Certification Providers, known as PSrEs. Each system addresses its own domestic requirements.
A regional transaction has to account for how those different systems connect with corporate authority, document integrity, approval, and evidence.
Table 1. Two signing frameworks meet in one Singapore Indonesia transaction
| Layer | Singapore | Indonesia |
| Identity route | Singpass for eligible users | Identity verification through a licensed PSrE |
| Signing route | Sign with Singpass | Certified electronic signature |
| Legal framework | Electronic Transactions Act | Electronic Information and Transactions framework |
| Identity question | Who is the individual? | Who is the individual? |
| Authority question | Is the individual authorised to act for the entity? | Is the individual authorised to act for the entity? |
| Evidence question | Can the signing event and supporting records be reconstructed? | Can the signing event and supporting records be reconstructed? |
The table shows where the problem begins. Both sides can have a valid identity and signing process, yet the enterprise still needs one governance model for the transaction.
That model needs to connect identity, authority, signing activity, and evidence.
Figure 1 – The Cross-Border Signing Trust Chain
Source: Mekari editorial analysis, 2026
The trust chain in Figure 1 places the signature inside a wider process. Identity establishes who the person is. Authentication establishes how that identity was verified or controlled during the signing event. Authorisation addresses whether the person can act for the organisation. Evidence allows the organisation to reconstruct what happened later.
A signing workflow can be strong at one layer and still leave another layer unresolved. That is why cross border signing becomes an enterprise governance issue rather than a question of signing technology alone.
A signature is only one link
Singapore’s Electronic Transactions Act recognises electronic signatures and provides specific treatment for Secure Electronic Signatures when the relevant conditions are satisfied.
Sign with Singpass connects the signing action with Singpass authentication and digital certificates. GovTech describes Sign with Singpass as producing Secure Electronic Signatures under Singapore’s electronic transaction framework.
The relationship between identity and signing is easier to understand when the signing flow itself is considered.
Figure 2 – How Sign with Singpass Connects Identity and Signing
Source: Mekari Sign, 2026.
Figure 2 shows the point at which Singpass enters the signing process. The signer is authenticated through the Singpass environment before completing the signing action.
That connection can reduce uncertainty around the identity associated with the signing event. The process links authentication with the act of signing rather than treating them as completely separate events.
The organisation still needs to preserve the records surrounding the transaction. Those records may include the document version, approval, authority, signing activity, timestamps, and other information needed to reconstruct what happened.
The identity layer therefore strengthens the signing process without resolving every question surrounding the agreement.
What Singpass changes?
Sign with Singpass gives eligible users a stronger identity and authentication route when signing electronic documents.
GovTech states that Singpass is available to Singapore citizens, permanent residents, and eligible Foreign Identification Number holders. This creates a practical limitation for cross border transactions.
An Indonesian executive based in Jakarta who does not have an eligible Singapore identity cannot simply use Singpass because the other contracting party is Singaporean.
The workflow therefore needs to account for the identity status of each signer.
This is an important consideration when a regional agreement involves people from different countries. One signing route may work for one signer while another signer requires a different route. Figure 2 shows the identity route. It does not establish authority. That distinction becomes more important when the signer acts on behalf of a company.
Knowing who signed is not enough
Identity verification answers one question: who is the individual?
Corporate authority asks another: was that individual authorised to act for the organisation?
Singapore’s own digital infrastructure reflects this separation. Singpass provides personal digital identity, while Corppass provides a corporate authorisation system for business transactions with government digital services and participating services.
Figure 3 – Singapore Separates Identity From Authority
Source: GovTech Singapore, 2026.
Figure 3 makes the separation easier to see. The person can authenticate through Singpass, while the organisation manages corporate access and authorisation through a separate layer.
Private commercial contracts still require their own authority checks. Depending on the transaction, an enterprise may need to rely on board resolutions, delegation records, powers of attorney, internal signing policies, or other corporate records.
The same principle applies when the contract crosses borders. A verified identity does not automatically prove that the individual can bind the company.
Head of Business Operations at Mekari Sign, Nishabella Mosisa said:
In cross border agreements, verifying someone’s identity is only one part of the process. Businesses also need to know whether that person is authorized to sign, and whether the supporting evidence can be retrieved when the agreement is reviewed later,
The practical issue is easy to miss during a fast signing process. Identity verification may be completed while the organisation is still unable to establish whether the signer had the required authority.
The authority check therefore needs to sit within the broader transaction process.
What happens after everyone has signed?
A completed signature does not automatically create a complete record of the transaction.
For enterprise agreements, the organisation should be able to reconstruct the important events surrounding the document. At minimum, the workflow should allow the business to establish:
- Who signed the document
- Which identity route each signer used
- How each signer was authenticated
- Which document version was signed
- Who approved the transaction
- What evidence established signing authority
- When the relevant actions occurred
- Where the final document and supporting records are stored
The purpose is practical. Legal, Compliance, Internal Audit, Procurement, or another stakeholder may need to understand the transaction long after the final signature was completed.
Nishabella added:
For enterprise agreements, trust comes from being able to reconstruct what happened after the document was signed. The identity, approval, signing activity, and supporting records should remain traceable when the business needs to review them,
This makes evidence part of the business process rather than a technical record added at the end. The organisation should know what happened, who was involved, and where the relevant records can be found.
One contract can involve several signing routes
Consider a regional company with a Singapore headquarters and an Indonesian subsidiary preparing a commercial agreement.
The signing plan includes a Singapore executive with Singpass, an Indonesian director using a certified electronic signature, an expatriate manager based in Indonesia, and a corporate representative whose authority comes from an internal delegation.
The people involved may require different identity routes. Their authority may also come from different corporate records.
Table 2. One transaction, different identity routes
| Signer | Identity route | Authority evidence | Question for the business |
| Singapore executive | Singpass | Corporate authorisation record | Does the person have authority for this agreement? |
| Indonesian director | Indonesian PSrE | Corporate authorisation record | Does the signing authority cover this transaction? |
| Expatriate manager | Applicable identity route based on status | Delegation from the employing entity | Which verification route applies to the person? |
| Corporate representative | Applicable identity route | Board resolution, delegation, or power of attorney | Was the authority valid when the document was signed? |
This is an illustrative enterprise scenario, not a customer case.
The scenario shows why a regional signing process can become difficult even when every individual can complete a signature.
The identity route may differ. The authority evidence may differ. The organisation still needs to connect all of those records to the same transaction. Nishabella said:
“When different parties use different signing processes, the operational burden often moves back to the business team. They have to reconcile who signed, what was approved, and where the supporting records are stored,”
The business problem is therefore not simply getting everyone to sign.
It is keeping the transaction coherent when different people need different identity and signing routes.
Where Mekari Sign fits into the workflow?
Mekari Sign supports signing workflows that use different requirements, including Singpass for Singapore signing and PSrE based signing for Indonesian signers.
For Singapore signing, Mekari Sign allows the sender to select Singpass as the relevant compliance option. The signer then completes the signing process through Singpass.
Figure 4 – How Mekari Sign Runs a Singpass Signing Flow
Source: Mekari Sign, 2026.
Figure 4 connects the product section to the identity discussion earlier in the article. The workflow shows how Mekari Sign can facilitate the document journey around the Singpass signing process, while the actual authentication and signing take place through the Singpass environment.
Mekari’s Trust Center describes Singpass as the platform where process execution and document signing take place, with Mekari Sign serving as the document repository and facilitating the redirection to Singpass.
For PSrE signing, Mekari Sign supports certified electronic signatures through its PSrE route. Its Help Center also documents workflows involving multiple signers and signing order.
The product can therefore sit within a broader workflow that accommodates different signing requirements.
It does not replace the company’s responsibility to establish who is authorised to sign, what approval is required, or which supporting records need to be retained.
The current public product documentation does not establish that a single document can combine Singpass signing for one signer and PSrE signing for another. That capability should be confirmed with Product before the workflow is presented as a supported configuration.
Build a signing matrix
Once different identity routes are involved, enterprises need a consistent way to decide which controls apply to each document.
A signing matrix can connect the document type, jurisdiction, identity route, authority requirement, approval, signature category, and evidence retention.
Table 3. Cross border signing evaluation framework
| Dimension | Question to ask | Warning sign |
| Identity | Which verification route does each signer use based on country and status? | One identity route is assumed for everyone |
| Authentication | How does the signer prove control of the identity during signing? | An email link is treated as sufficient for a high risk document |
| Authorisation | What evidence shows that the signer can bind the entity? | Authority is checked only after signing |
| Signature | What signature category is produced under the applicable framework? | Signature types are treated as automatically equivalent |
| Document integrity | How can the organisation identify changes to the signed record? | The final document is stored without supporting integrity evidence |
| Approval | Who approved the transaction before signing? | Approval exists only in email or chat |
| Evidence | Can the organisation reconstruct the signing event? | Evidence is spread across unrelated systems |
| Retention | Where are the document and supporting records stored? | No clear owner for retention |
| Governance | Who reviews the process when regulation or business requirements change? | The workflow remains unchanged after implementation |
The matrix gives each control a clear business owner.
Legal may define authority requirements. Compliance may determine evidence requirements. IT and Security may assess authentication and data handling. Operations may manage document retention.
The exact ownership model will differ between organisations. What matters is that someone is accountable for each control.
What DEFA could change?
DEFA makes cross border identity more relevant, but it is too early to predict exactly what will change for enterprise signing.
ASEAN member states concluded negotiations in May 2026, with digital identity among the areas covered. The negotiated text remains unpublished, and implementation will depend on the final agreement, signing, ratification, and domestic processes.
Enterprises therefore have limited value in designing current signing controls around assumptions about future regional recognition.
A more durable model is to establish controls that remain useful regardless of how ASEAN develops its digital identity framework.
The organisation should know who is signing, how that person is authenticated, what authority they have, and what evidence needs to remain available.
A future regional framework may reduce friction between jurisdictions. It does not remove the need for corporate governance around who can commit an entity.
From digital signing to cross border trust
The harder question in cross border signing is not whether a document can be signed online.
It is whether the organisation can explain the signing process later.
Singpass can provide strong identity and authentication for eligible Singapore users. Indonesian PSrE infrastructure provides a separate trust route for Indonesian signers. Corporate authority remains a separate business control.
The question for enterprise teams should therefore move beyond:
“Can everyone sign?”
A stronger question is:
“Can we prove who signed, how they were authenticated, why they were authorised, what they signed, and what evidence remains?”
A signing platform can support that workflow. The governance model still belongs to the enterprise.
Referensi
- Allen & Gledhill. “ASEAN member states conclude negotiations on landmark Digital Economy Framework Agreement.”
- Attorney-General’s Chambers. “Electronic Transactions Act 2010.”
- Chambers and Partners. “Data Protection & Privacy 2025: Indonesia, Trends and Developments.”
- GovTech Singapore. “Sign with Singpass: Overview, How it works, FAQs.”
- ISAS, National University of Singapore. “The Digital Economy Framework Agreement: Connecting India and ASEAN.”
- K&L Gates. “An Overview: Electronic Signing and the New Sign with SingPass Service in Singapore.”
- Rajah & Tann Asia. “PDP Law Updates: The PDP Implementing Regulation Is Out.”
- World Economic Forum. “ASEAN Digital Economy Outlook 2026.”
