EUDI Wallet

The wallet holds two kinds of content, the first being Personal Identification Data, the core set a member state vouches for, such as name, date of birth and a unique identifier. The second is electronic attestations of attributes, each a separate signed statement about the holder: a driving entitlement, a university degree, a company role, a residence address.

Both sit on the holder's own device, and the holder decides per request what goes out. That design is what lets a verifier ask a narrow question instead of copying a whole document, and it is also why there is no central store of who proved what to whom. The EU Digital Identity Wallet for banks uses person identification data, trust lists and defined levels of assurance.

Article 5a(1) requires that each member state provide at least one European Digital Identity Wallet "within 24 months of the date of entry into force of the implementing acts" referred to in Article 5a(23) and Article 5c(6). Article 5f(2) gives obliged private relying parties longer: they shall accept the wallet "no later than 36 months from the date of entry into force" of those same implementing acts, and only on the user's voluntary request. The clock in both articles starts at the implementing acts, not at the regulation, which determines the project implementation timetable.

The target of the European Commission for the EU Digital Identity Wallet is that each member state provide at least one wallet, built to the same common specifications, by 2026. For planning, 2026 is the working date of the Commission for the member state obligation, and the legally operative wording is the 24 months in Article 5a.

Article 5f(2) names the sectors, and banking and financial services are in the list, alongside transport, energy, social security, health, drinking water, postal services, digital infrastructure, education and telecommunications. The obligation catches private relying parties in those sectors that are required by law or by contract to use strong user authentication for online identification. Microenterprises and small enterprises are excluded.

So a German bank that already does strong authentication at login is a relying party in scope, and it will have to take a wallet presentation when a customer offers one. What it may not do is treat that as the whole of its duties. A wallet settles who the person is; the rest of customer due diligence, the purpose of the relationship, the source of funds, the sanctions and PEP screening and the ongoing monitoring, is untouched. KYC in Germany and AML in Germany cover those, and KYC vs AML separates the two terms.

A wallet from one member state has to work with a verifier in another, and that only happens if everyone implements the same formats and protocols. The Architecture and Reference Framework is the document that fixes them. The Commission describes it as setting out the common architecture of the wallet ecosystem by specifying the standards, protocols and formats of information exchanges between issuers, wallets and service providers, and it states that version 2.0 is available on GitHub.

Publishing it in the open, versioned, has a practical effect for anyone building against it: you can read the current text, see what changed between versions, and raise an issue on a point that does not work in production. Bank architects use the framework as the specification for their integration.

Before the obligation takes effect, the ecosystem is being tested in four consortia that the Commission describes as bringing together public and private sector expertise from across the EU, funded by European Commission grants, and building prototypes and testing everyday use cases. They are POTENTIAL, NOBID, EWC and DC4EU.

The payment and financial use cases are being worked out there first, so the integration patterns that arrive in the framework have usually been through a pilot. A bank that wants to see how a wallet behaves in an account opening or at a payment authorization can read what the pilots published today.

Germany is building its own wallet, and the project site eudi-wallet.gov.de presents it as an official project of Bund, Länder und Kommunen, says the German EUDI Wallet app will launch in early 2027, and describes it as voluntary to use and regulated throughout Europe. On data it is explicit: documents are encrypted and stored on your smartphone, and there is no central data collection.

For a bank in Germany, the state wallet is the one most customers will carry, so it is the one to test against first, and because use is voluntary a bank still needs its existing identification routes for everyone who does not use a wallet. The eID and video identification methods for KYC in Germany stay in the product.

At a checkout a wallet credential verifies the identity of a customer and an attribute about them. A merchant that has to establish an age, a residence or a company role can get a signed answer instead of a scan. The payment itself still runs on a card, an account transfer or a stablecoin, as in digital wallets in payments.

The identity rules and the payment rules meet where authentication is concerned, because a wallet is capable of the strong authentication that payment law demands. The coming payment rulebook is PSD3, and the regulation that created the wallet, with its trust services, signatures and seals, is eIDAS 2 and finance.

Member states must provide at least one wallet within 24 months of the entry into force of the implementing acts under Article 5a(23) and Article 5c(6), and the working date of the European Commission for that obligation is 2026. Obliged private relying parties have 36 months from the same point. The German app is announced for early 2027 on eudi-wallet.gov.de.

The regulation puts obligations on member states to provide a wallet and on obliged relying parties to accept one, and Article 5f(2) adds that acceptance happens only upon the voluntary request of the user. The German wallet is voluntary to use, so nobody has to install it, and services have to keep working for people who do not.

For the identification step, a wallet presentation gives identity attributes a member state vouches for, at a level of assurance the scheme defines. A wallet presentation does not deliver the rest of customer due diligence. Purpose of the business relationship, beneficial ownership, source of funds, sanctions and PEP screening and ongoing monitoring stay the bank's own work under the rules for AML in Germany.

eIDAS 2 is the law, the EUDI Wallet is the app that the law requires. Regulation (EU) 2024/1183 amended the 2014 eIDAS Regulation and established the European Digital Identity Framework, of which the wallet is one part next to the trust services for signatures, seals and attestations. eIDAS 2 and finance also governs these trust services for electronic transactions.