A digital signature is a cryptographic control applied to data or a document. It can help a bank detect changes and verify that the signature was created with a particular private key, but the surrounding process must still establish who controls that key and what the person or system was authorized to approve.
A digital signature is a specific kind of electronic evidence
An electronic signature is a broad concept that can include several ways of showing agreement in an electronic process. A digital signature is narrower: it uses public-key cryptography to produce a value that can be verified against the signed data.
Banks may use digital signatures for documents, software, messages, certificates or system-to-system instructions. The purpose and assurance needs differ, so a valid cryptographic result is interpreted within the business process rather than assumed to prove every aspect of a transaction.
Hashing and a private key create the signature
The signing process first derives a fixed-length digest from the data using a cryptographic hash function. An approved signature algorithm then uses the signer's private key and required parameters to create a signature tied to that digest.
A change to the signed content produces a different digest, so verification should fail when the data has been altered. The protection depends on sound algorithms, correct implementation and keeping the private key from unauthorized use; the signature cannot distinguish the intended signer from an attacker who has obtained the key.
The public key verifies integrity and claimed origin
A recipient uses the corresponding public key and the same data to verify the signature. A successful result supports two linked conclusions: the data has not changed since signing, and the signature was produced with the private key associated with that public key.
A certificate or another governed trust mechanism can bind the public key to a person, organization, device or service. Identity proofing, certificate issuance and validation, secure enrollment and reliable directories therefore affect how much confidence the bank can place in the claimed signer.
Identity, authority and intent remain separate questions
Knowing which credential signed the data does not by itself establish that the signer understood the content, intended a particular legal effect or had authority to bind an account or organization. Authentication, transaction context, disclosures, approval limits and evidence of the customer's or employee's action supply that missing meaning.
For example, a system can correctly verify a digitally signed payment file while the underlying instruction exceeds the employee's approval authority. The bank still applies entitlement, segregation, fraud and transaction controls before acting on the message.
Key life cycle and audit evidence preserve trust over time
Private keys are generated, stored, used, rotated, recovered where permitted and retired under controls proportionate to their purpose. Certificates and status services help relying parties determine whether a credential was valid, expired or revoked at the relevant time, while timestamps can support evidence about when signing occurred.
Banks retain the signed content, signature, validation results, certificate chain, transaction context and relevant approvals according to recordkeeping needs. Monitoring addresses failed validation, unexpected signers, weak algorithms and key compromise, with defined procedures to revoke trust, contain exposure and reassess affected activity.
Read the primary material
Banking Explained prioritizes regulators, official publications and first-party announcements.