Key points to remember about proof of transaction in Fintech
- Clicking "Invest" constitutes a financial order as defined by the ECSP regulations: its exact date may determine the order's validity.
- An uncertified internal log does not constitute admissible evidence: the ECSP and DORA regulations require data retention but do not specify the level of evidence required for the data to be admissible.
- Onlyan eIDAS-qualified time stamp, pursuant to Article 41, creates a legal presumption of the accuracy of the date and the integrity of the data and reverses the burden of proof.
- A retrievable evidence file that includes all the components of the time-stamped order is essential for an effective response in both litigation and regulatory reviews.
The "Invest" button: a financial order subject to the requirements of the ECSP regulation
Once confirmed, the investment click legally binds the parties, regardless of how it is subsequently processed. This principle stems from the interplay between general law governing electronic evidence and the ECSP Regulation[1].
The click: a legal act in its own right
Article 1366 of the Civil Code establishes the following principle: an electronic document has the same probative value as a paper document, provided that its author is duly identified and that the document is created and stored under conditions that guarantee its integrity. Article 1369 specifies the conditions for the validity of a contract concluded electronically. This framework applies to any online action with contractual implications, including an investment click.
In the context of real estate crowdfunding and P2P lending platforms, this click takes on an additional dimension. Since November 2021, the ECSP regulation has required these platforms to obtain mandatory authorization as crowdfunding service providers (PSFP). As such, they are responsible for receiving and transmitting client orders: the “Invest” click is not a trivial technical action; it is the formalization of a financial order that is binding on both parties.
A framework specific to PSFPs, with blind spots
This is the model adopted by real estate crowdfunding and P2P lending platforms, as well as participatory investment platforms in general: a fully online process, accessible starting at just a few hundred euros, with no human interaction during the approval process.
In this regard, the ECSP Regulation distinguishes between experienced and inexperienced investors. The latter, who make up a significant portion of these platforms’ users, are entitled to a four-day withdrawal period as provided for in Article 22 of the Regulation. This detail is not insignificant: it means that the exact date and time of the click can directly determine the validity of the order.
The ECSP Regulation expressly excludes PSFPs from the MiFID II Directive[2], which nevertheless requires traditional financial firms to maintain strict records of communications related to orders. In the absence of this pre-established framework, the responsibility for providing indisputable evidence rests entirely with the platform.
The three types of challenges a fintech company faces in the absence of certified evidence
There is no single way to dispute an order placed online, and multiple grievances may apply.
Challenging the existence of order
The investor denies having confirmed the order: he claims never to have clicked or simply pits his word against that of the platform. In response to this dispute, an internal log may be presented. But its probative value remains weak: there is no guarantee that it was not altered afterward.
The principle that no one may serve as their own witness fully applies to data generated unilaterally by the platform’s systems. The concept of non-repudiation addresses this issue: the ability to prevent a user from denying an action that they actually performed, which requires external, certified, and auditable evidence.
Dispute the date and time
In some products, the purchase window is time-limited. Whether a cutoff deadline has been exceeded or a four-day cooling-off period is still open under Article 22 of the ECSP Regulation, the exact time of the click can be enough to completely reverse the situation. However, a simple server timestamp does not hold up to such a challenge. It is generated by the platform’s own infrastructure and can be called into question precisely for this reason.
Challenge the version of the accepted terms and conditions
The platform updated its Terms of Service or product terms between the time the order was confirmed and the time the dispute arose. Which version did the investor accept when they clicked? It’s easy to claim that. Proving it requires having recorded the exact content of the terms at the precise moment of confirmation.
A stringent regulatory framework that is silent on the standard of proof
Data retention is a regulatory requirement. Being able to present this data in court is a matter of evidence. Industry-specific regulations require traceability but never define the standard required in the event of a dispute.
The ECSP Regulation: a retention requirement without evidentiary guarantee
It requires PSFPs to retain records of orders and mandates on a durable medium for a minimum of five years. This retention requirement therefore does indeed exist.
However, the regulation does not specify the technical standard of proof required for a record to be enforceable against a disputing third party. An internal log formally meets this requirement without, however, constituting irrefutable evidence.
DORA: data integrity as a performance obligation
Effective as of January 2025, the DORA regulation[3] expressly applies to PSFPs and requires them to preserve the authenticity and integrity of their digital data. Smaller platforms benefit from a simplified regime, but the obligation to achieve the desired outcome remains. Here again, DORA establishes a requirement without defining how it can be demonstrated before a judge or regulator.
eIDAS: presumption as the sole legal solution
Only the eIDAS Regulation, in Article 41, establishes a legal presumption regarding the date and integrity of data that has been qualifiedly time-stamped. This is the missing link: it transforms these sector-specific obligations regarding data retention and integrity into legally enforceable evidence. Without it, the platform is in regulatory compliance but unable to assert its rights in the event of a dispute.
This evidentiary framework, which has already been tested in the context of obtaining consent under the GDPR, applies here based on the same principle of legal presumption.
eIDAS-qualified timestamps: a legal presumption in the face of potential challenges
The concept of non-repudiation is addressed here from both a technical and legal perspective. Preventing an investor from denying an action that he or she actually performed requires evidence that does not rely solely on the platform’s systems.A qualified timestamp meets this requirement.
Unlike the internally generated server timestamp, the eIDAS-qualified timestamp is issued by a qualified trust service provider (QTSP) that is independent of the platform. Under Article 41 of the eIDAS Regulation, it is legally presumed to be accurate in terms of date and data integrity.
This presumption shifts the burden of proof. It is no longer up to the platform to demonstrate that the order is authentic; rather, it is up to the party challenging it to rebut the presumption. In litigation or during a regulatory review, this reversal is decisive.
The timestamp does not apply solely to the click, but to a cryptographic fingerprint of the order’s constituent elements: transaction ID, order parameters, version of the terms accepted at the time of confirmation, and session data. It is this link between the proof and the exact content of the order that gives it its probative value.
Conclusion: compiling a set of evidence that can be returned
A qualified timestamp forms the basis of legally enforceable evidence. Its full effectiveness, however, depends on the ability to reproduce a complete record that includes all elements related to the order: a qualified time stamp cryptographically linked to the transaction parameters, the exact version of the accepted terms and conditions sealed at that same moment, the investor’s session and identification data, and traceability maintained for the duration required by the ECSP regulation.
This file will be required in two distinct situations. In the event of a dispute, the platform must be able to produce it before a judge or an AMF mediator. In the event of a regulatory review—whether an AMF audit under the ECSP regulation or a DORA review of system integrity—it must be provided upon request in an auditable format.
Solutions such as Evidency make it possible to generate and maintain this type of record, which complies with eIDAS requirements and can be retrieved upon request. For platforms seeking to transform a regulatory requirement into a genuine means of providing evidence, this is a technical solution with legal standing.
Sources
[1] Regulation (EU) 2020/1503 of the European Parliament and of the Council of October 7, 2020, on European crowdfunding service providers for entrepreneurs: https://eur-lex.europa.eu/eli/reg/2020/1503/oj
[2] Directive 2014/65/EU of the European Parliament and of the Council of May 15, 2014, on markets in financial instruments: https://eur-lex.europa.eu/eli/dir/2014/65/oj
[3]Regulation (EU) 2022/2554 of the European Parliament and of the Council of December 14, 2022, on the digital operational resilience of the financial sector: http://data.europa.eu/eli/reg/2022/2554/oj
Disclaimer of liability
The opinions, presentations, figures and estimates presented on the website, including the blog, are intended for information purposes only and should not be construed as legal advice. For legal advice you should contact a legal professional in your jurisdiction.
The use of the content of this website, including the blog, for commercial purposes, including resale, is prohibited without prior authorization from Evidency. The request for permission must specify the purpose and extent of reproduction. For non-commercial purposes, all material in this publication may be freely quoted or reprinted, but acknowledgement is required, together with a link to this website.
