eIDAS 2.0, formally Regulation (EU) 2024/1183, amends Regulation (EU) 910/2014 and establishes new, stricter requirements for identity verification, including SIM registration, and introduces the European Digital Identity (EUDI) Wallet as a regulated tool for proving identity across digital services. For mobile network operators (MNOs), this is a regulatory change that reshapes how they verify customers, manage compliance, and position themselves within Europe’s broader digital identity ecosystem. This article walks through the key questions telecoms need answered right now.
What changes does eIDAS 2.0 bring to identity verification?
eIDAS 2.0 amends the original eIDAS regulation with a significantly expanded framework that makes digital identity verification more consistent, more secure, and more interoperable across all EU Member States. The most important change is the introduction of the EUDI Wallet, which every Member State is legally required to provide or mandate for citizens, residents, and businesses. This creates a standardized way to verify identity across both public and private sector services, with governance shared across the European Commission, Member States, national competent authorities, wallet providers, issuers, qualified trust service providers, and relying parties.
Under the original eIDAS regulation, Member States could choose whether to notify their national electronic ID schemes, and there was no obligation for those schemes to work seamlessly across borders. eIDAS 2.0 closes this gap. Any organization operating in a regulated or trust-sensitive sector, including telecommunications, must be prepared to accept and interact with EUDI Wallets as a valid form of identity verification, within the scope and timelines set by the regulation and its implementing acts.
A few other important shifts stand out:
- Stronger assurance levels: eIDAS 2.0 tightens the requirements for what counts as a high-assurance identity, meaning low-quality verification methods are no longer sufficient for many regulated interactions.
- Privacy by design: Users control exactly what data they share. Services can only request what is strictly necessary, reducing the risk of over-collection.
- Private sector inclusion: eIDAS 2.0 explicitly extends to private sector relying parties, including telecoms, in addition to government services.
- Qualified Trust Service Providers (QTSPs): The regulation expands the role of QTSPs and sets clearer standards for electronic signatures, seals, and attestations.
For organizations that have been operating with identity processes built around older standards, eIDAS 2.0 represents a meaningful shift in what compliance actually requires.
How does SIM-based identity currently work in telecom?
SIM-based identity uses the SIM card in a mobile device as a proxy for verifying who a user is. Because a SIM is tied to a specific mobile subscription, which in turn requires a name, address, and often a government-issued ID to register, mobile network operators have historically treated SIM possession as a form of identity verification. This underpins services like SMS one-time passwords (OTPs), mobile number portability, and SIM-based authentication used by banks and other services.
In practice, SIM-based identity works on the assumption that the person holding the phone is the registered subscriber. When a user receives an SMS OTP to confirm a login or transaction, the implicit logic is that only the legitimate account holder has access to that SIM. This has made mobile numbers a widely used second factor in authentication flows across banking, e-commerce, and government services.
However, SIM-based identity has well-documented weaknesses. SIM swap fraud, where an attacker convinces a mobile operator to transfer a victim’s number to a new SIM, has been used to bypass SMS-based authentication at scale. Similarly, the quality of the original SIM registration process varies significantly across operators and countries, meaning the identity behind a SIM card is not always robustly verified. These limitations have become more visible as identity fraud has grown more sophisticated.
How does eIDAS 2.0 affect mobile network operators?
eIDAS 2.0 affects mobile network operators in two concrete ways: it raises the bar for how MNOs must verify customer identity during SIM registration, and it opens the door for telecoms to become active participants in the broader European digital identity ecosystem.
On the compliance side, the POTENTIAL large-scale pilot, which ran from April 2023 to 2025, explicitly included SIM registration as one of the use cases tested. The idea is that a customer registering a SIM card, whether pre-paid or post-paid, can use their EUDI Wallet to prove their identity securely and verifiably, without handing over unnecessary data. This reduces fraud risk for the operator and simplifies the process for the customer. It also means MNOs will need to build the technical capability to accept EUDI Wallet-based identity presentations, in line with the technical requirements elaborated in the Architecture and Reference Framework (ARF) and the binding requirements set out in the relevant implementing acts.
On the opportunity side, telecoms are well-positioned to become trust anchors within the eIDAS 2.0 ecosystem. MNOs already hold verified subscriber data for millions of customers. If they align their identity infrastructure with eIDAS 2.0 standards, they could offer identity verification services to other sectors, acting as a trusted source of identity data that other organizations can rely on. This is a meaningful commercial opportunity, particularly for operators looking to expand beyond connectivity services.
That said, the transition also comes with real challenges. Existing identity verification workflows may not meet the assurance levels required under eIDAS 2.0. Legacy systems built around SMS OTPs or basic document checks may need to be replaced or significantly upgraded. And MNOs will need to navigate the technical specifications of the EUDI Wallet architecture, including how to function as a relying party, and potentially as an identity provider or attestation issuer. Under CIR (EU) 2025/848, adopted on 6 May 2025, a relying party must register with the national authority of the Member State where it is established before it can request wallet data, and must specify per intended use which attributes and attestations it will request. This is a good moment for organizations to map current capabilities against what eIDAS 2.0 actually demands.
Can SIM-based identity coexist with the EUDI Wallet?
Yes, SIM-based identity and the EUDI Wallet can coexist, but the relationship between them will shift. SIM-based identity is more likely to become one input or layer within a broader, wallet-centric identity framework. The two approaches serve different purposes and operate at different assurance levels.
The EUDI Wallet is designed for high-assurance identity interactions: proving who you are to open a bank account, register a SIM, access government services, or sign a contract. SIM-based identity, by contrast, is primarily useful as an authentication factor, confirming that a known user is present at a specific device. These are complementary roles.
In a mature eIDAS 2.0 environment, a plausible flow might look like this:
- A customer uses their EUDI Wallet to verify their identity when registering a new SIM contract, replacing a manual document check with a tamper-evident, cryptographically signed credential.
- Once registered, their mobile number becomes a verified attribute tied to a confirmed identity.
- For subsequent authentication, such as logging in to an app or confirming a payment, the SIM or device-based factor can still play a role, now backed by a higher-quality identity foundation.
This layered model makes identity more robust without discarding the convenience that SIM-based approaches already offer. The key is that the initial identity verification step is elevated to meet eIDAS 2.0 standards, which strengthens everything built on top of it. Cross-border use of EUDI Wallet credentials is designed into the framework. A certified wallet from one Member State can be used with an appropriate relying party in another. However, this does not mean that every use case will be immediately available in every Member State, or that sector-specific national requirements such as those governing SIM registration disappear. Relying parties remain subject to the applicable national registration framework in their jurisdiction, including the registration obligation under CIR (EU) 2025/848.
What should telecoms do to prepare for eIDAS 2.0?
Telecoms that want to stay compliant and competitive under eIDAS 2.0 need to take action now. The regulation sets 24 December 2026 as the legal deadline by which every Member State must make at least one certified EUDI Wallet available to citizens, residents, and businesses, and public sector bodies must accept notified wallets as a valid means of identification from that date. For telecoms and other regulated private sector organizations, the obligation to accept EUDI Wallet credentials applies from 24 December 2027, under Article 5f of the regulation, in contexts where strong user authentication is legally or contractually required. The legal deadline is a final date, not a predicted launch date, and practical interoperability and national rollout are expected to develop in phases. Organizations should plan accordingly. The large-scale pilots that tested SIM registration use cases have already generated real technical specifications. Waiting for full market adoption before preparing is a risky strategy.
The most important steps for mobile network operators include:
- Audit current identity verification processes: Understand where your SIM registration and customer onboarding workflows fall short of eIDAS 2.0 assurance level requirements.
- Assess your role in the ecosystem: Decide whether you want to operate as a relying party (accepting EUDI Wallet credentials), an identity provider, an attestation issuer, or a combination of these. Each role has different technical and compliance implications. Registration as a relying party under CIR (EU) 2025/848 requires specifying, per intended use, which attributes and attestations you will request. The wallet checks each presentation request against that registered scope.
- Build EUDI Wallet acceptance into your technical roadmap: This means integrating with the wallet’s presentation protocols, including OID4VP for online presentation, and ensuring your systems can process verified credential data in line with the requirements set out in the implementing acts and elaborated in the ARF.
- Review fraud prevention frameworks: SIM swap fraud and related threats are directly addressed by stronger identity verification at registration. Aligning with eIDAS 2.0 is also a fraud reduction strategy.
- Engage with your compliance and legal teams early: The intersection of eIDAS 2.0, GDPR, and sector-specific regulation such as AML and KYC creates complexity that needs cross-functional input.
Organizations that treat eIDAS 2.0 purely as a compliance burden will miss the bigger picture. Telecoms that invest in their digital identity infrastructure now will be better positioned to offer trusted, reusable identity services to customers and partners, turning a regulatory requirement into a genuine competitive advantage. It is also worth examining how adjacent industries like financial services are approaching the same transition, since many of the identity challenges overlap.
How TrustTech helps telecoms navigate eIDAS 2.0
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For telecoms preparing for eIDAS 2.0, the ID Connector handles the practical complexity of wallet acceptance. Concretely, it covers:
- EUDI Wallet acceptance across every certified wallet solution, regardless of the issuing Member State, so MNOs do not need to build separate integrations per wallet provider
- Verification against national trusted lists, which are consolidated in the EU List of Trusted Lists (LOTL), to confirm the issuer of each credential presented
- Revocation status checks against issuer-provided status information, so that only valid, current credentials are accepted
- Wallet unit attestation validation, confirming that the presenting wallet runs on a certified wallet solution
- Registered attribute scope enforcement, ensuring that each presentation request stays within the scope registered under CIR (EU) 2025/848
- Reuse of verified identity data across onboarding and authentication flows, reducing friction for customers while meeting KYC, AML, and eIDAS compliance requirements
- Qualified signing via a connected QTSP, covering the full identity lifecycle from first verification to final signature
The same integration is in use across financial services, healthcare, and government, sectors where the identity challenges closely mirror those facing telecoms under eIDAS 2.0. Explore our customer stories to see how organizations in similar positions have approached this challenge, or get in touch with our team to discuss what eIDAS 2.0 means specifically for your telecom environment.