CA, TSP and QTSP: The Trust-Service Ecosystem

The European Commission maintains the EU Trusted List — a public registry of all accredited QTSPs in member states. Check this list to verify whether a TSP is qualified under eIDAS.

China's CA system is regulated by MIIT and SCA. Licensed CAs include eSign, BJCA, and others. Under T/CQAE 11034-2025, CAs must directly handle identity verification and key management.

IMDA accredits CAs under the ETA. Netrust is a prominent licensed CA. IMDA oversees the trust framework for digital signatures in Singapore.

eIDAS allows EU member states to recognise QTSPs from third countries if they meet equivalent standards. Most APAC CAs are not eIDAS-accredited.

The EU Trusted Lists are the authoritative source for checking whether a provider and a specific trust service hold qualified status. Counts change as services are added, suspended, withdrawn, or renewed, so procurement teams should verify the live list rather than rely on a static total.

APAC markets use their own legal and supervisory models. Singapore maintains a voluntary accreditation framework for certification authorities under the ETA; Hong Kong recognises certification authorities and certificates under the ETO; Malaysia licenses certification authorities under the Digital Signature Act; China regulates electronic certification services and commercial cryptography; and Indonesia maintains a registered PSrE framework. These local statuses are not the same as qualified status under eIDAS and must be checked with the relevant regulator.