The Third Panel of the Brazilian Superior Court of Justice (STJ) has upheld the validity of a loan executed digitally with an electronic signature made on a platform not accredited by ICP-Brasil.
For the court, the absence of certification by the official infrastructure does not, by itself, invalidate the contract, provided there are elements that prove the consumer’s manifestation of will and rule out indications of fraud.
Below are 3 points to understand what this decision signals for the digital credit market and for creditors’ risk management:
1. A signature outside the ICP-Brasil standard can be valid, as long as there is evidence of authentication and the intent is clear: In the underlying case, the plaintiff claimed she had not contracted the payroll-deductible loan and requested suspension of the deductions, as well as double reimbursement of the amounts withheld.
The trial court, however, found sufficient elements to indicate a legitimate transaction, such as the submission of photos of the driver’s license, a selfie, geolocation data and the use of the borrower’s own device to formalize the deal. The Paraná State Court (TJPR) overturned that decision based on article 10, paragraph 2, of Provisional Measure 2.200‑2/2001, arguing that an electronic document without ICP-Brasil certification would only be valid if expressly accepted by the party against whom it is invoked, which, in that case, had not occurred since the plaintiff denied the contract. In ruling on the special appeal, the STJ adopted an interpretation more aligned with the reality of digital contracting: acceptance does not need to be express or formal; it may be demonstrated by the party’s conduct.
As Justice Nancy Andrighi stressed, a person who voluntarily enters personal data, sends a selfie, allows geolocation and uses their device to conclude the transaction is, through this active participation, tacitly admitting the validity of that authentication method. The practical consequence is clear: the lack of ICP-Brasil certification, by itself, does not invalidate electronic contracts supported by an evidentiary trail demonstrating authorship and integrity.
2. A generic consumer challenge is insufficient to void a digital contract: A central aspect of the decision is the rejection of the idea that a mere ex post challenge by the consumer, unsupported by other elements, is sufficient to defeat the validity of an electronic contract.
The STJ emphasized that the interpretation of Provisional Measure 2.200‑2/2001 must take into account the massification of digital contracting and the need to preserve legal certainty in this environment. In her opinion, Justice Nancy Andrighi stated that a simple generic denial (“I do not recognize the signature” or “I did not contract”) is not enough to declare the legal transaction non-existent when the evidentiary record indicates no fraud. To hold otherwise, the court noted, would mean allowing any objection based solely on the absence of ICP-Brasil certification to tear down digital contracts even in the face of robust authentication evidence.
For the market, the message is significant: consumer protection remains in place, but it does not equate to an absolute “right of regret” capable of undermining the reliability of digital channels in the absence of minimum probative support.
3. Creditor’s burden of proof: evidentiary trails to rule out fraud and sustain the transaction. By invoking STJ Theme 1,061, the Third Panel reaffirmed that when a consumer challenges the authenticity of a signature on a banking contract, it is up to the financial institution to prove the validity of the document. This applies equally to digital transactions with signatures not certified by ICP-Brasil.
In practice, the bank must show that there are no indications of fraud, gathering elements such as access logs, IP address, geolocation, device identification, photos of documents, selfies, clickstream records, acceptance of terms and any recordings available. If this evidentiary trail is well structured, the party’s mere challenge, unaccompanied by even minimal counter‑evidence, will not be enough to invalidate the transaction based solely on article 10, paragraph 2, of Provisional Measure 2.200‑2/2001.
As the rapporteur noted, embracing the lower court’s view would mean that, in the absence of ICP-Brasil certification, any unilateral objection would suffice to annul a digital contract, regardless of the evidence produced by the creditor – a scenario the STJ rejected by reinstating the judgment dismissing the claim.
Accordingly, the decision does not “relax” the diligence expected from creditors in digital contracting; on the contrary, it rewards those who invest in robust authentication mechanisms and in the organized preservation of evidence.
For the payroll-deduction credit market and online lending in general, the message is twofold: on one hand, platforms not certified by ICP-Brasil can support valid contracts, provided they are combined with serious identification procedures; on the other, legal risk management increasingly depends on technological compliance, the design of safer onboarding and contracting journeys, and the ability to demonstrate in court that the consumer effectively participated in the formation of the deal.
