Yes, businesses can use the EUDI Wallet to verify customers online. Under eIDAS 2.0, which amends Regulation (EU) 910/2014, organisations that register as relying parties gain the ability to request and receive verified identity attributes directly from a customer’s European Digital Identity Wallet. This makes digital identity verification faster, more reliable, and more privacy-friendly than many current methods.
The EUDI Wallet is a practical infrastructure for businesses that need to confirm who they are dealing with, whether that is during onboarding, age verification, or regulated service access. The sections below walk through what this means in practice, which sectors stand to gain the most, and how your organisation can start preparing.
What can businesses actually do with the EUDI Wallet?
Businesses can use the EUDI Wallet to request verified identity attributes from users, confirm their identity, and accept digitally signed credentials, all without requiring the user to upload documents or repeat information they have already provided elsewhere. This turns the wallet into a practical tool for customer verification, onboarding, and compliance.
The wallet allows users to store and share a wide range of verified documents and credentials. From a business perspective, this opens up a number of concrete use cases:
- Customer onboarding: Verify identity during account creation or registration without manual document checks
- Age and eligibility verification: Confirm that a user meets a specific requirement, such as being over 18, without receiving unnecessary personal data. This is possible through selective disclosure of a single attribute, for example a confirmation that the user is over 18, without sharing a date of birth
- KYC and AML compliance: Accept cryptographically signed identity attestations to meet regulatory obligations in financial services. Note that whether verified identity data can be reused across KYC checks is governed by AML legislation, not by eIDAS 2.0 itself
- Contract signing: Link qualified electronic signatures to a verified identity for legally binding agreements, subject to applicable national form requirements
- Access to regulated services: Confirm professional qualifications, residency status, or other attributes required to access certain products or services
What makes this different from traditional identity checks is the principle of selective disclosure. Users share only the specific attributes a business needs, and nothing more. A business asking for proof of age receives confirmation of that fact, not a full copy of a passport or driving licence. This reduces data liability for businesses and gives customers more control over their personal information.
How does EUDI Wallet-based verification work in practice?
When a business wants to verify a customer using the EUDI Wallet, it sends a request for specific identity attributes. The customer receives this request in their wallet app, reviews what is being asked, and chooses to approve or decline. If approved, the wallet releases only the requested data, digitally signed and tamper-evident, directly to the business.
Receiving and validating a presentation from a EUDI Wallet involves three distinct checks. First, the relying party verifies the issuer’s signature against the relevant national trusted list, which is part of the EU List of Trusted Lists (LOTL). This check can be performed offline. Second, the relying party checks the revocation status of the attestation using status information provided by the issuer, which requires a connection to that issuer’s infrastructure. Third, the relying party validates the wallet unit attestation to confirm that the presenting wallet is running on a certified wallet solution. Together, these checks establish the authenticity and current validity of the credential presented.
From a technical standpoint, businesses interact with the EUDI Wallet ecosystem through a set of standardised protocols. The implementing acts adopted by the European Commission are legally binding and set the requirements that wallet solutions, issuers, and relying parties must meet. The Architecture and Reference Framework (ARF) provides the technical elaboration of those requirements and serves as the common technical foundation. Credential formats supported by the ARF include mdoc and SD-JWT VC. Online presentation uses OID4VP, while issuance uses OID4VCI. Large-scale pilots across EU Member States tested these specifications in real-world scenarios between 2023 and 2025, covering areas such as banking, healthcare, education, and travel.
For businesses, the practical implication is that integration requires connecting to this standardised framework. Under CIR (EU) 2025/848, adopted on 6 May 2025, relying parties must register with the national competent authority of their Member State of establishment before they can request wallet data. Registration is per intended use: the relying party declares which attributes and attestations it will request, and the wallet checks incoming requests against that registered scope. A relying party must be able to accept every relevant notified wallet, regardless of which provider issued it. This creates a basis for consistency across borders, though relying party registration remains connected to the applicable national framework in each Member State, and sector-specific rules continue to apply alongside the eIDAS 2.0 requirements.
Which industries are most likely to benefit from EUDI Wallet verification?
The industries most likely to benefit from EUDI Wallet-based customer verification are those that already face the heaviest identity and compliance requirements: financial services, healthcare, government, and pharmaceuticals. These sectors carry significant regulatory obligations around knowing who their customers are, and the wallet offers a way to meet those obligations more efficiently.
Financial services and banking
Banks, insurers, and fintechs operate under strict KYC and AML requirements. Today, onboarding a new customer often involves uploading identity documents, waiting for manual review, and sometimes visiting a branch. With digital identity in finance, the EUDI Wallet can replace this with a verified data exchange. The customer shares their confirmed identity attributes, the business receives a digitally signed attestation, and onboarding can be completed far more quickly. Whether that verified data can be reused for subsequent KYC checks depends on the applicable AML legislation rather than on eIDAS 2.0 itself.
Healthcare and pharmaceuticals
In healthcare, verifying patient identity and confirming professional credentials are both critical. The EUDI Wallet supports use cases such as claiming prescriptions at pharmacies, accessing personal health records, and confirming that a healthcare professional holds the right qualifications. For healthcare providers, this reduces administrative burden while maintaining a high level of assurance. Processing health data through the wallet requires a legal basis under both Article 6 and Article 9(2) of the GDPR.
Government and public services
Public sector organisations have a clear obligation under eIDAS 2.0 to accept notified EUDI Wallets for online services that require electronic identification, from 24 December 2026. For government services, the wallet enables citizens to apply for permits, access social security information, or register for services without repeatedly proving who they are from scratch.
What are the legal requirements for businesses that want to use the EUDI Wallet?
Businesses that want to request identity data from EUDI Wallets must register as relying parties under CIR (EU) 2025/848. Registration is managed through national competent authorities in each Member State of establishment. The registration process requires organisations to declare a legitimate purpose for the data they are requesting, and to specify which attributes and attestations they will request for each intended use. The wallet will check requests against this registered scope. Collecting more data than declared is not permitted.
Beyond registration, businesses must also comply with the GDPR when handling personal data received through the wallet. eIDAS 2.0 governs the identity verification process itself, while the GDPR governs what happens to the data once it has been received. Businesses need clear data retention policies, a lawful processing ground, and appropriate security measures in place. Approving a data request in the wallet is a separate act from providing consent as a GDPR legal basis: a relying party needs its own GDPR ground for processing, which in a KYC context is typically a legal obligation rather than consent.
Two separate acceptance deadlines apply. From 24 December 2026, public sector bodies must accept notified EUDI Wallets for online services that require electronic identification. From 24 December 2027, Article 5f of eIDAS 2.0 extends a mandatory acceptance obligation to private sector relying parties in regulated sectors where strong user authentication is required by law or contract. The sectors covered include banking and financial services, healthcare, telecoms, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services. Micro and small enterprises are excluded from this private sector obligation: organisations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros fall outside its scope. Very large online platforms (VLOPs) are subject to a separate provision under Article 5f: they must accept the EUDI Wallet where the platform requires user authentication, on voluntary request by the user and for the minimum necessary data, without the condition of legally or contractually required strong authentication applying to them.
The 24 December 2026 deadline is a legal obligation on Member States to make EUDI Wallets available and to accept notified wallets for public services. It is not a predicted launch date, and it does not guarantee that every national wallet will have reached the same level of maturity or that every cross-border use case will be fully operational throughout Europe on that date. Practical interoperability and national rollout are expected to develop in phases, as wallets are certified, notified, and progressively adopted by relying parties. Organisations that delay preparing their systems risk both regulatory exposure and a poor customer experience as wallet adoption grows.
It is also worth noting that a vendor processing wallet data on behalf of a client does not thereby become the relying party. The registration obligation rests with the organisation that delivers the service to the end user. Understanding exactly where your organisation sits within the regulatory scope of eIDAS 2.0 is an important early step. Beginning preparation now and monitoring national developments as they unfold is more effective than waiting for a single European go-live moment.
What should businesses do now to prepare for EUDI Wallet integration?
Businesses should start by mapping their current identity verification processes and identifying where EUDI Wallet-based verification could replace or improve existing steps. From there, the priority is understanding the technical and legal requirements for becoming a relying party in the relevant Member States, and beginning to align internal systems, compliance frameworks, and vendor relationships accordingly.
A practical preparation approach follows a clear sequence:
- Assess your current identity flows: Identify which customer journeys involve identity verification, credential checks, or document submission
- Review your regulatory obligations: Determine which eIDAS 2.0 requirements apply to your sector and service type, including any sector-specific legislation that continues to apply alongside the eIDAS 2.0 framework, and whether the 24 December 2026 or 24 December 2027 deadline applies to your organisation
- Understand the relying party registration process: Find out what is required under CIR (EU) 2025/848 in each relevant Member State to register as a relying party, since registration is handled at national level, and begin that process early
- Evaluate your technical infrastructure: Check whether your current systems can connect to the standardised wallet protocols, including OID4VP for presentation and OID4VCI for issuance, or whether integration work is needed
- Update your data governance policies: Ensure your GDPR compliance framework covers data received through wallet-based verification, including the distinction between approving a wallet request and establishing a GDPR legal basis
- Review pilot outputs: The four large-scale pilots that ran from April 2023 to 2025 produced practical learnings about real-world wallet usage across banking, healthcare, education, travel, and government services. A second wave of pilots started in 2025. Reviewing their outputs can inform your own implementation planning
Organisations that treat EUDI Wallet integration as a compliance checkbox will miss the broader opportunity. Businesses that approach it strategically, as a way to reduce onboarding friction, lower compliance costs, and build customer trust, are the ones most likely to see a genuine return on the investment. Explore the resources available to stay informed as implementing acts, technical specifications, and national implementations continue to develop.
How the ID Connector supports EUDI Wallet verification
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organisations in financial services, healthcare, pharma, and government preparing for EUDI Wallet-based verification, the ID Connector handles the technical complexity of connecting to the standardised wallet ecosystem. Specifically, it covers:
- Wallet acceptance and trust management: The ID Connector validates issuer signatures against the relevant national trusted lists, which are part of the EU List of Trusted Lists (LOTL), so your organisation can confirm the authenticity of received attestations
- Revocation checking: The connector checks the revocation status of attestations against issuer-provided status information, so your organisation is not relying on a snapshot that may no longer be valid
- Wallet unit attestation validation: The connector verifies that the presenting wallet is running on a certified wallet solution, completing the three-part verification process required for reliable relying party acceptance
- Attribute scope enforcement: Requests are checked against the attributes and attestations declared in your relying party registration, keeping your data collection within the registered scope
- Reuse of verified identity data: Where your compliance framework permits, verified identity data can be reused across customer journeys, reducing the need for repeated checks
- Qualified signing via a connected QTSP: For use cases that require qualified electronic signatures linked to a verified identity, the ID Connector connects to a qualified trust service provider
Get in touch with TrustTech to discuss how the ID Connector can connect your organisation to the EUDI Wallet ecosystem.