The EUDI Wallet: what European law requires, and by when

Two kinds of content. The first is Personal Identification Data, the core set a member state vouches for, such as name, date of birth and a unique identifier. The second is electronic attestations of attributes, each a separate signed statement about the holder: a driving entitlement, a university degree, a company role, a residence address.

Both sit on the holder's own device, and the holder decides per request what goes out. That design is what lets a verifier ask a narrow question instead of copying a whole document, and it is also why there is no central store of who proved what to whom. The EU Digital Identity Wallet for banks goes through person identification data, trust lists and levels of assurance in detail.

Article 5a(1) requires that each member state provide at least one European Digital Identity Wallet "within 24 months of the date of entry into force of the implementing acts" referred to in Article 5a(23) and Article 5c(6). Article 5f(2) gives obliged private relying parties longer: they shall accept the wallet "no later than 36 months from the date of entry into force" of those same implementing acts, and only on the user's voluntary request. The clock in both articles starts at the implementing acts, not at the regulation, which is the detail that decides a project plan.

The European Commission translates the first of those into a plain target on its own EU Digital Identity Wallet pages, where it says each member state must provide at least one wallet, built to the same common specifications, by 2026. Read the two together: 2026 is the Commission's working date for the member state obligation, and the legally operative wording is the 24 months in Article 5a.

Article 5f(2) names the sectors, and banking and financial services are in the list, alongside transport, energy, social security, health, drinking water, postal services, digital infrastructure, education and telecommunications. The obligation catches private relying parties in those sectors that are required by law or by contract to use strong user authentication for online identification. Microenterprises and small enterprises are excluded.

So a German bank that already does strong authentication at login is a relying party in scope, and it will have to take a wallet presentation when a customer offers one. What it may not do is treat that as the whole of its duties. A wallet settles who the person is; the rest of customer due diligence, the purpose of the relationship, the source of funds, the sanctions and PEP screening and the ongoing monitoring, is untouched. KYC in Germany and AML in Germany cover those, and KYC vs AML separates the two terms.

A wallet from one member state has to work with a verifier in another, and that only happens if everyone implements the same formats and protocols. The Architecture and Reference Framework is the document that fixes them. The Commission describes it as setting out the common architecture of the wallet ecosystem by specifying the standards, protocols and formats of information exchanges between issuers, wallets and service providers, and it states that version 2.0 is available on GitHub.

Publishing it in the open, versioned, has a practical effect for anyone building against it: you can read the current text, see what changed between versions, and raise an issue on a point that does not work in production. For a bank's architects that matters more than the regulation's recitals, because the framework is what the integration is actually built to.

Before the obligation bites, the ecosystem is being tested in four consortia that the Commission describes as bringing together public and private sector expertise from across the EU, funded by European Commission grants, and building prototypes and testing everyday use cases. They are POTENTIAL, NOBID, EWC and DC4EU.

They matter to a bank for one reason: the payment and the financial use cases are being worked out there first, so the integration patterns that arrive in the framework have usually been through a pilot. A bank that wants to see how a wallet behaves in an account opening or at a payment authorization can read what the pilots published today.

Germany is building its own. The project site eudi-wallet.gov.de presents it as an official project of Bund, Länder und Kommunen, says the German EUDI Wallet app will launch in early 2027, and describes it as voluntary to use and regulated throughout Europe. On data it is explicit: documents are encrypted and stored on your smartphone, and there is no central data collection.

For a bank in Germany that fixes two planning assumptions. The state wallet is the one most customers will carry, so it is the one to test against first, and because use is voluntary a bank still needs its existing identification routes for everyone who does not use a wallet. The eID and video identification methods on KYC in Germany stay in the product.

At a checkout a wallet credential answers a question the payment rails handle badly: who is this, and is an attribute about them true. A merchant that has to establish an age, a residence or a company role can get a signed answer instead of a scan. The payment itself still runs on a card, an account transfer or a stablecoin, which digital wallets in payments sets out.

The identity rules and the payment rules meet where authentication is concerned, because a wallet is capable of the strong authentication that payment law demands. The coming payment rulebook is covered on PSD3, and the regulation that created the wallet, with its trust services, signatures and seals, on eIDAS 2 and finance.

Member states must provide at least one wallet within 24 months of the entry into force of the implementing acts under Article 5a(23) and Article 5c(6), and the European Commission's own working date for that obligation is 2026. Obliged private relying parties have 36 months from the same point. The German app is announced for early 2027 on eudi-wallet.gov.de.

No. The regulation puts obligations on member states to provide a wallet and on obliged relying parties to accept one, and Article 5f(2) adds that acceptance happens only upon the voluntary request of the user. The German project site states plainly that the wallet is voluntary to use. Nobody has to install it, and services have to keep working for people who do not.

For the identification step, yes: a wallet presentation gives identity attributes a member state vouches for, at a level of assurance the scheme defines. It does not deliver the rest of customer due diligence. Purpose of the business relationship, beneficial ownership, source of funds, sanctions and PEP screening and ongoing monitoring stay the bank's own work under the AML rules on AML in Germany.

eIDAS 2 is the law, the EUDI Wallet is the thing the law requires. Regulation (EU) 2024/1183 amended the 2014 eIDAS Regulation and established the European Digital Identity Framework, of which the wallet is one part next to the trust services for signatures, seals and attestations. eIDAS 2 and finance covers the rest of the regulation.