eIDAS 2.0 fundamentally changes digital onboarding by requiring organizations to accept identity verification through the European Digital Identity Wallet (EUDI Wallet) and standardized verifiable credentials, replacing fragmented, manual identity checks with a unified, user-controlled digital identity framework. This shift applies to any organization offering digital services across the EU, including banks, healthcare providers, government agencies, and online platforms. The sections below break out what this means in practice, who is affected, and how to get ready.
What does eIDAS 2.0 require from digital onboarding flows?
eIDAS 2.0, Regulation (EU) 2024/1183, amends Regulation (EU) 910/2014 and requires organizations that offer digital services to accept identity verification through the EUDI Wallet and to support standardized, interoperable identity proofing methods. This means onboarding flows must be capable of receiving and validating verifiable credentials issued by trusted sources, going beyond document uploads or manual checks.
Under the updated regulation, identity data must be handled in a way that respects data minimization principles. Your onboarding system should request only the specific attributes it genuinely needs, such as proof of age, nationality, or professional qualifications, and should not collect a full identity document by default. Users retain control over what they share and with whom, approving each individual presentation request from within their wallet.
For organizations in regulated sectors, eIDAS 2.0 also reinforces the requirement to use high assurance levels for identity verification where the risk profile demands it. The legally binding requirements are set out in the implementing acts adopted by the European Commission, while the Architecture and Reference Framework (ARF) provides the technical elaboration of those requirements. Both have direct implications for how KYC compliance processes are designed and how identity proofing is documented for audit purposes.
How does the EUDI Wallet replace traditional identity verification steps?
The EUDI Wallet allows users to present pre-verified, tamper-evident credentials directly from their wallet app, removing the need to repeatedly submit documents, fill in forms, or undergo fresh identity checks for each new service. The wallet acts as a trusted, reusable digital identity that organizations can rely on at high assurance levels.
In a traditional onboarding flow, a user might upload a passport photo, submit a selfie for liveness detection, and wait for a manual review. With the EUDI Wallet, that same user can share a verified attestation, for example a confirmed identity attribute from their national identity system, through a single interaction. The receiving organization obtains a tamper-evident proof without needing to re-verify the underlying document.
Verifying that attestation involves three distinct checks: confirming the issuer’s signature against the relevant national trusted list (part of the EU List of Trusted Lists), checking the revocation status through the issuer’s status information, and validating the wallet unit attestation to confirm that the presenting wallet is running on a certified wallet solution. Only the first of these checks can be performed fully offline.
This approach also reduces friction for users. For each service, the user approves a presentation from their wallet and shares only the attributes required for that transaction. From an organizational perspective, this reduces the cost and complexity of identity proofing while improving the reliability of the data received.
The EUDI Wallet ecosystem involves shared governance. The European Commission manages the legal framework and adopts implementing acts. Each EU Member State is responsible for providing or mandating a wallet solution, certifying and notifying it, and supervising actors within its jurisdiction. Wallet providers, issuers of Person Identification Data and attestations, qualified trust service providers, and relying parties all carry distinct responsibilities within this framework. No single central European authority operationally manages all EUDI Wallets.
Which industries are most affected by eIDAS 2.0 onboarding changes?
The industries most affected by eIDAS 2.0 onboarding changes are financial services, government, healthcare, and telecommunications, as these sectors handle sensitive identity data at scale and are already subject to strict regulatory requirements around identity verification and KYC compliance.
Here is a closer look at the sectors facing the most significant adjustments:
- Financial services and banking: Banks and payment providers must update their KYC and AML onboarding workflows to accept EUDI Wallet credentials. The POTENTIAL large-scale pilot tested wallet-based identity verification for opening bank accounts, and the NOBID pilot focused on payments.
- Government services: Public sector organizations must accept EUDI Wallet credentials for online services that require electronic identification, such as tax filing, social security, and passport applications. Member States are legally required to make wallet solutions available to citizens and residents by 24 December 2026, though the pace of national rollout and the maturity of individual wallet implementations will vary across countries. From that date, public sector bodies must accept notified wallets for such services.
- Healthcare and pharmaceuticals: Patient identity verification, prescription claims, and access to medical records all require secure, high-assurance identity proofing. The POTENTIAL pilot tested use cases including electronic prescriptions. Processing health data requires a legal basis under both the GDPR and Article 9(2) GDPR.
- Telecommunications: SIM registration and contract activation were included in the POTENTIAL pilot testing scenarios, meaning mobile operators will need to align their identity verification processes with wallet-based credentials.
- Education: Institutions issuing or verifying diplomas and certificates were part of the DC4EU pilot scope, with the wallet enabling portable, verifiable educational credentials.
What is the difference between eIDAS 1.0 and eIDAS 2.0 for onboarding?
The key difference between eIDAS 1.0 and eIDAS 2.0 for onboarding is that the original regulation focused on enabling cross-border recognition of national electronic ID schemes between Member States, while eIDAS 2.0 introduces a universal, wallet-based identity layer that extends to the private sector and gives individuals direct control over their own identity data.
Under eIDAS 1.0, Member States could notify their national eID schemes so they would be recognized across the EU. However, there was no obligation for every country to create such a scheme, and private sector organizations were largely outside the scope of the regulation. This created significant inconsistency: some countries had mature digital identity infrastructure while others had very little, and businesses could not rely on a single, interoperable method for digital identity verification across Europe.
eIDAS 2.0 closes these gaps in several important ways:
- Universal wallet availability: Every Member State must provide an EUDI Wallet to all citizens, residents, and businesses by 24 December 2026, creating a baseline that did not exist before. The legal deadline marks the point by which Member States must fulfill their wallet obligations, though practical interoperability and the maturity of national implementations will develop in phases beyond that date.
- Private sector inclusion: Relying parties in the private sector, including banks, insurers, and online platforms, can integrate wallet-based identity verification into their onboarding flows. Under CIR (EU) 2025/848, adopted on 6 May 2025, a relying party must register with the national authority of its Member State of establishment before requesting wallet data. Registration specifies the intended use and the attributes or attestations to be requested, and the wallet validates each request against that registered scope.
- Verifiable credentials: eIDAS 2.0 introduces a structured framework for issuing and accepting attestations, enabling organizations to trust digitally signed identity attributes. The ARF specifies mdoc and SD-JWT VC as the supported credential formats.
- Data minimization by design: Users can share only the attributes required for a specific transaction, which was not a core feature of eIDAS 1.0 onboarding approaches.
- Expanded trust services: eIDAS 2.0 adds new categories of qualified trust services, including electronic attestation of attributes, which are directly relevant to identity proofing in onboarding contexts.
When do organizations need to comply with eIDAS 2.0 onboarding requirements?
The legal deadline for Member States to make the EUDI Wallet available to all citizens and businesses is 24 December 2026. Public sector bodies must accept notified wallets for online services requiring electronic identification from that date. Organizations that rely on digital identity verification for onboarding, particularly in regulated sectors, should treat this date as a key milestone for ensuring their systems can accept and process wallet-based credentials. This legal deadline does not guarantee that every national wallet will reach the same level of maturity simultaneously, or that every cross-border use case will be fully operational across all Member States on that date. National rollout, certification, notification, and operational interoperability will each progress according to their own timelines.
For regulated private sector organizations, Article 5f of the amended regulation sets a separate obligation. From 24 December 2027, relevant private sector bodies in sectors such as financial services, healthcare, telecommunications, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services must accept the EUDI Wallet where strong user authentication is legally or contractually required. Very large online platforms (VLOPs) are covered by a distinct provision of Article 5f: for VLOPs, the obligation applies where the platform requires user authentication, on voluntary request by the user and for the minimum necessary data. Micro and small enterprises, defined as organizations with fewer than 50 employees and an annual turnover or balance sheet total not exceeding 10 million euros, are exempt.
In practice, compliance timelines vary depending on the type of organization and the specific requirements that apply to it. The four original large-scale pilot programs ran from April 2023 to 2025 and involved over 350 entities across 26 Member States. They generated the technical specifications and real-world feedback needed to inform the wallet’s architecture. A second wave of pilots started in 2025, with WE BUILD focusing on business wallets and payments, and APTITUDE covering travel, ticketing, vehicle registration, and payments.
For organizations in sectors with existing regulatory obligations, such as KYC compliance under AML directives or patient identity verification in healthcare, eIDAS 2.0-compliant methods are expected to become the standard approach as wallet adoption grows. Waiting until the last moment to adapt onboarding systems carries real risk, both in terms of regulatory exposure and competitive disadvantage. Organizations that have not yet assessed their current identity proofing processes against eIDAS 2.0 requirements should begin that review now.
How should organizations start preparing their onboarding systems for eIDAS 2.0?
Organizations should start by auditing their current onboarding flows to identify where identity verification happens, what data is collected, and whether existing processes can be adapted to accept attestations from the EUDI Wallet. From there, the focus shifts to technical integration, compliance alignment, and stakeholder readiness.
A practical starting point involves asking a few foundational questions about your current setup: Does your onboarding system support standards-based credential verification? Are your identity assurance levels documented and aligned with eIDAS requirements? Do your data collection practices reflect the principle of data minimization?
Beyond the technical audit, preparation also means engaging the right internal stakeholders. Compliance teams, IT architects, legal counsel, and digital transformation leads all have a role to play. eIDAS 2.0 is not purely a technology project; it requires alignment between regulatory interpretation, system design, and user experience.
Where your organization operates across multiple Member States, it is also worth mapping out how national registration requirements under CIR (EU) 2025/848 and sector-specific legislation interact with the eIDAS 2.0 framework in each relevant jurisdiction. A relying party must register per intended use and specify which attributes and attestations it will request. The wallet validates each presentation request against that registered scope. Not every credential will automatically carry the same legal consequence in every country, and your organization must accept every relevant notified wallet, regardless of which provider issued it.
It is also worth noting that a relying party does not automatically need a qualified trust service provider (QTSP) to accept the EUDI Wallet. A QTSP becomes relevant in specific contexts, such as qualified electronic signatures and qualified attestations of attributes.
How TrustTech supports eIDAS 2.0 digital onboarding
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organizations preparing their onboarding systems for eIDAS 2.0, the ID Connector addresses several of the practical challenges that arise during implementation:
- Wallet acceptance: The ID Connector enables your onboarding flow to accept every notified EUDI Wallet, regardless of the issuing Member State or wallet provider.
- Trust management and verification: The connector handles verification of issuer signatures against national trusted lists, checks revocation status through issuer-provided status information, and validates wallet unit attestations to confirm the presenting wallet runs on a certified wallet solution.
- Registered attribute scope: The connector supports the relying party in staying within the attribute scope registered under CIR (EU) 2025/848, so that each presentation request aligns with what has been declared to the national authority.
- Qualified signing: For use cases that require a qualified electronic signature, the ID Connector connects to a qualified trust service provider. TrustTech does not itself issue qualified electronic signatures or attestations.
- Sector coverage: The ID Connector is applicable across the sectors most affected by eIDAS 2.0 onboarding changes, including financial services, healthcare, pharma, and government, each of which faces distinct compliance timelines and identity assurance requirements.
If your organization is ready to take the next step toward eIDAS 2.0-compliant digital onboarding, get in touch with TrustTech to discuss your situation and explore how the ID Connector fits your onboarding flow.