How does eIDAS 2.0 affect the banking sector?

eIDAS 2.0 significantly affects the banking sector by introducing stronger, standardized digital identity requirements that banks must both accept and integrate into their services. The regulation amends Regulation (EU) 910/2014 and requires financial institutions across the EU to recognize the European Digital Identity Wallet (EUDI Wallet) for identity verification, fundamentally changing how banks handle onboarding, authentication, and compliance. Below, we answer the most important questions banks are asking right now.

What changes does eIDAS 2.0 bring to identity verification in banking?

eIDAS 2.0 raises the bar for digital identity verification in banking by establishing a single, EU-wide standard that replaces the fragmented national approaches that have existed until now. Banks must accept verified identity data from EUDI Wallets, meaning the identity a customer has already established with their government or another trusted provider becomes valid across borders and across services.

Under the original eIDAS regulation, EU member states were required to recognize each other’s notified electronic ID schemes, but there was no obligation to create a national eID or make it interoperable with private sector services. eIDAS 2.0 closes that gap. It extends the framework to the private sector and introduces a wallet-based model that puts verified, tamper-evident identity data directly into the hands of users.

For banks, this means identity verification can no longer rely solely on proprietary processes or locally accepted documents. The standard for what counts as a verified identity becomes EU-wide, which is both a technical shift and a compliance obligation. Banks operating across multiple European markets will benefit from this harmonization, since a single integration with the EUDI Wallet ecosystem can replace multiple country-specific identity verification flows. The governance of this ecosystem is a shared responsibility: the European Commission manages the legal framework and adopts implementing acts, EU member states provide or mandate wallet solutions and supervise actors within their jurisdictions, and qualified trust service providers, wallet providers, and relying parties each carry distinct obligations within that structure.

How does the EUDI Wallet affect KYC and onboarding processes?

The EUDI Wallet has the potential to make KYC and customer onboarding significantly faster and less repetitive. Instead of asking a new customer to upload documents, submit selfies, and wait for manual review, a bank can request verified identity attributes directly from the customer’s wallet. The data has already been verified at a high assurance level, which means the bank can rely on it without repeating the full verification process from scratch.

This is one of the most practical shifts eIDAS 2.0 brings to financial services. Today, customers often go through the same identity checks multiple times: once with their bank, again with their insurer, and again with another financial provider. The EUDI Wallet introduces the concept of reusable identity. A customer verifies once, and that verified identity can be reused across services with their explicit approval for each presentation.

For onboarding specifically, this removes a major source of friction. Lengthy identity checks are one of the leading causes of onboarding abandonment. When a customer can share verified attributes from their wallet in seconds, conversion rates improve and the time-to-trust shrinks considerably. At the same time, banks retain full auditability, since every data-sharing event is logged and approval-based.

KYC and Anti-Money Laundering (AML) obligations remain in place. The EUDI Wallet does not replace compliance requirements. What it provides is a higher-quality, more reliable data source to meet those requirements more efficiently. The legal basis for processing identity data in a KYC context is typically a statutory obligation under AML legislation, not consent under the GDPR. Banks still need to assess risk, apply due diligence, and maintain records. The wallet makes the identity verification step of that process more trustworthy and less burdensome for both the bank and the customer.

Which banking services must accept the EUDI Wallet under eIDAS 2.0?

eIDAS 2.0 establishes two distinct acceptance obligations with different timelines and scopes.

From 24 December 2026, public bodies must accept notified EUDI Wallets for online services that require electronic identification. From 24 December 2027, Article 5f of the amended regulation extends acceptance obligations to relevant regulated private sectors where strong user authentication is required by law or contract. Banking and financial services are among the sectors covered by this obligation, alongside healthcare, telecoms, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services. Micro and small enterprises are exempt: organisations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros fall outside the scope of the private sector obligation. Very large online platforms fall under a separate provision of Article 5f and must accept wallet-based authentication where their platform requires user authentication, on the voluntary request of the user and for the minimum necessary data.

The Large Scale Pilots that ran from April 2023 to 2025 tested several banking-specific wallet use cases. Opening a bank account online was one of the priority use cases piloted under the POTENTIAL consortium, where the wallet enabled identity verification without requiring the customer to repeatedly provide personal information. Payment authentication was tested under the NOBID consortium, which piloted the use of EUDI Wallets for authorising payments across Nordic, Baltic, Italian, and German participants. The EWC consortium piloted digital travel credentials, payments, and organisational digital identity. DC4EU focused on education and social security use cases.

In practical terms, banks need to evaluate which of their digital services fall within the scope of the 24 December 2027 obligation. Services that currently rely on eID-based login or strong customer authentication under PSD2 are natural starting points. The intersection of eIDAS 2.0 and PSD2 is particularly relevant for financial services, since strong customer authentication requirements and wallet-based identity verification will increasingly overlap. Acceptance obligations apply to relying parties operating within their national registration frameworks, and sector-specific legislation does not disappear simply because a wallet is technically interoperable at European level.

What compliance obligations does eIDAS 2.0 create for financial institutions?

eIDAS 2.0 creates several concrete compliance obligations for financial institutions. The most significant for banks is the requirement under Article 5f to accept the EUDI Wallet for identity verification in services that fall within the regulation’s scope by 24 December 2027. Beyond acceptance, banks must ensure their systems can technically interact with wallet-based identity data, which involves implementing the necessary protocols and meeting interoperability standards.

Key compliance areas include:

• Wallet acceptance: Banks providing online services that require identity verification must be capable of accepting identity attributes presented via the EUDI Wallet by the applicable deadline.
• Relying party registration: Under CIR (EU) 2025/848, adopted on 6 May 2025, a bank acting as a relying party must register with the national authority of its member state of establishment before requesting wallet data. Registration specifies, per intended use, which attributes and attestations will be requested. The wallet checks incoming requests against this registered scope.
• Data minimization: The wallet is designed to share only the specific attributes a service needs, using selective disclosure. Banks must align their data requests with this principle, requesting only what is necessary for a given transaction or onboarding step.
• Interoperability standards: Banks must implement the technical standards defined in the implementing acts adopted under eIDAS 2.0. The Architecture and Reference Framework (ARF) provides the technical elaboration of those requirements and is an essential reference for development and architecture teams, though it is the implementing acts themselves that carry legal force.
• Audit and record-keeping: Approval-based data-sharing events must be logged appropriately to maintain compliance with both eIDAS 2.0 and GDPR requirements.
• AML and KYC alignment: Wallet-verified identity data must be integrated into existing AML and KYC workflows in a way that satisfies regulatory obligations under those frameworks. The reuse of KYC data across institutions is governed by AML legislation, not by eIDAS 2.0 itself.

eIDAS 2.0 does not operate in isolation. Financial institutions are simultaneously navigating PSD2, GDPR, AML directives, and the AMLR, which becomes applicable in July 2027. eIDAS 2.0 adds another layer, but it also creates an opportunity to consolidate identity infrastructure in a way that serves multiple regulatory frameworks at once.

How should banks prepare their systems for eIDAS 2.0?

Banks should prepare for eIDAS 2.0 by starting with a gap analysis of their current identity verification infrastructure and mapping where wallet-based identity data will need to be accepted and processed. The goal is to identify which systems, APIs, and onboarding flows need to be updated to support EUDI Wallet interactions.

A practical preparation approach follows these steps:

1. Assess current identity infrastructure: Identify which services require identity verification and how those processes currently work. Map out where EUDI Wallet acceptance will be required under the 24 December 2027 deadline.
2. Review the implementing acts and the Architecture and Reference Framework: Understand the legally binding requirements set out in the implementing acts and the technical specifications in the ARF that govern how EUDI Wallets present and share identity data. Development and architecture teams will need to align with these standards.
3. Evaluate your relying party obligations: Banks acting as relying parties in the wallet ecosystem must register under CIR (EU) 2025/848 with the national authority in each member state of establishment before requesting wallet data. Registration is per intended use and defines which attributes and attestations may be requested. It is important to understand what that process involves in each market where you operate.
4. Update onboarding and authentication flows: Redesign relevant customer journeys to accommodate wallet-based identity sharing, including approval mechanisms and data minimization practices.
5. Align with AML and KYC teams: Ensure that wallet-verified identity data integrates into your compliance workflows. Define how high-assurance wallet data satisfies due diligence requirements under applicable AML legislation.
6. Test and pilot: Where possible, engage with available sandbox environments to test wallet integrations before full deployment. The first wave of Large Scale Pilots concluded in 2025. A second wave, including the WE BUILD consortium focusing on business wallets and payments, and the APTITUDE consortium covering travel, ticketing, vehicle registration, and payments, started in 2025.

The legal deadline for member states to make EUDI Wallets available to citizens and businesses is 24 December 2026. This is a statutory deadline, not a predicted launch date, and it does not guarantee that every national wallet will reach the same level of maturity on that date, or that every cross-border use case will be fully operational throughout Europe from that point. Practical interoperability and national rollout are likely to develop in phases, as individual member states certify and notify their wallet solutions and as relying party registration processes mature in each jurisdiction. Banks cannot afford to treat this as a distant future concern. Organisations that begin their preparation now will be in a much stronger position than those that wait for full enforcement before acting.

What are the business opportunities eIDAS 2.0 creates for banks?

eIDAS 2.0 creates genuine business opportunities for banks that move beyond viewing the regulation purely as a compliance burden. The most immediate opportunity is faster, lower-friction onboarding that reduces customer drop-off and improves conversion rates. When identity verification becomes a matter of seconds, banks can compete more effectively on the quality of their digital experience.

Reusable identity is another significant opportunity. Banks are often among the first institutions to verify a customer’s identity at a high assurance level. Under the EUDI Wallet model, banks can potentially become trusted issuers of attestations within the ecosystem, issuing verified credentials that their customers can reuse across other services. This positions banks as central players in the broader digital identity infrastructure.

Cross-border expansion also becomes more tractable. Today, entering a new European market often means building or procuring a country-specific identity verification solution. The EUDI Wallet framework is designed so that a certified wallet from one member state can be used with an appropriately registered relying party in another member state, which means a bank that has integrated with the EUDI Wallet ecosystem can serve customers across borders without rebuilding its identity layer from scratch. In practice, not every use case will be available in every member state from day one, and sector-specific legislation and national registration requirements continue to apply. Banks should plan for a phased expansion.

The overlap between eIDAS 2.0 and existing compliance frameworks creates efficiency gains. A bank that builds its identity infrastructure around wallet-based verification can potentially satisfy KYC, AML, PSD2 strong customer authentication, and eIDAS 2.0 requirements through a single, well-designed integration. That consolidation reduces operational complexity and long-term compliance costs.

How TrustTech helps banks prepare for eIDAS 2.0

Navigating eIDAS 2.0 as a bank means dealing with technical complexity, regulatory overlap, and the practical challenge of updating live systems without disrupting existing customer journeys. TrustTech addresses this through the ID Connector.

The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.

For banks and financial institutions, the ID Connector handles the following:

• EUDI Wallet-ready onboarding: Accept wallet-based identity attributes in your customer journeys without building the underlying infrastructure from scratch. The ID Connector verifies the issuer signature against the relevant national trusted lists, checks revocation status via the issuer’s status information, and validates the wallet unit attestation to confirm that the presenting wallet runs on a certified wallet solution.
• Registered attribute scope management: The ID Connector checks incoming wallet presentations against your registered attribute scope under CIR (EU) 2025/848, so that data requests stay within the bounds of your relying party registration.
• Reusable identity data: Enable customers to share verified identity attributes across services, reducing repeated checks and improving the customer experience.
• Qualified digital signing: Link identity to every signature and approval via a connected qualified trust service provider, with a complete audit trail for regulatory purposes.
• eIDAS 2.0 compliance by design: The ID Connector is built on European digital identity standards, so every component is aligned with the implementing acts and the ARF from the ground up.
• Fast time to production: TrustTech clients in financial services, healthcare, and government typically go from integration to production in under five months, which matters when the 24 December 2027 deadline for private sector acceptance is approaching.

Whether your organisation is still mapping the implications of eIDAS 2.0 or ready to start implementation, the ID Connector provides a concrete starting point. Get in touch with TrustTech to discuss how the ID Connector can support your organisation’s eIDAS 2.0 readiness.