eIDAS 2.0 handles remote identity verification by allowing individuals to prove their identity entirely online, without needing to visit a physical location. Regulation (EU) 2024/1183 amends Regulation (EU) 910/2014, defines accepted methods, sets assurance levels, and introduces the European Digital Identity Wallet as a standardized tool for remote identification across the EU. This article walks through the key questions organizations need to understand to prepare for these changes.
What methods does eIDAS 2.0 accept for remote identity verification?
eIDAS 2.0 accepts several methods for remote identity verification, including chip-based document reading (NFC), biometric liveness detection, video-based identification, and reusable digital identities issued by qualified providers. The regulation does not prescribe a single method but requires that the chosen approach meets the appropriate assurance level for the intended use case.
In practice, the most robust remote identification methods combine two elements: verifying the authenticity of an identity document and confirming that the person presenting it is physically present. Technologies like NFC passport chip reading allow a device to verify the data stored in a document’s chip in a tamper-evident way, making it extremely difficult to spoof. Biometric liveness detection adds a second layer by confirming the user is a real, live person and not a photo or recording.
Video-based identification, where a trained agent or automated system reviews a live session, is also accepted under eIDAS 2.0 when it meets the required standards. Additionally, reusable digital identities play a growing role: once a person has been verified by a trusted provider, that verified identity can be reused across services without repeating the full verification process from scratch.
What assurance levels apply to remote identification under eIDAS 2.0?
eIDAS 2.0 defines three assurance levels for identity verification: Low, Substantial, and High. Remote identity verification can achieve any of these levels, depending on the method used and the strength of the identity proofing process. Most regulated services, such as banking or healthcare access, require Substantial or High assurance.
The assurance level reflects how confident a relying party can be that the person claiming an identity is actually that person. Here is what each level generally means in a remote context:
- Low: Basic self-asserted information, suitable for low-risk services with minimal identity requirements.
- Substantial: Verified identity using reliable documents or credentials, with some protection against forgery and impersonation. This level covers many commercial and government services.
- High: The strongest level, requiring cryptographic verification and robust liveness checks. Required for accessing sensitive government services, financial products, or healthcare records remotely.
Achieving High assurance remotely typically requires NFC chip reading combined with biometric verification, or the use of a qualified electronic identity issued by a recognized qualified trust service provider. Organizations in financial services and healthcare are most likely to need this level for their digital onboarding processes.
How does the EUDI Wallet enable remote identity verification?
The European Digital Identity Wallet enables remote identity verification by giving users a secure, standardized digital container for their verified identity attributes and credentials. When accessing a service remotely, users can share only the specific information required, such as age, nationality, or a verified qualification, without exposing unnecessary personal data. This selective disclosure capability is built into the wallet architecture.
The EUDI Wallet framework is designed so that a certified wallet from one Member State can be used with a relying party in another Member State. This means a person verified in one country can, in principle, use their wallet to access services in another without repeating the identification process. However, this does not mean that every use case will immediately be available in every Member State, that national registration requirements disappear, or that sector-specific legislation ceases to apply. Which elements are interoperable at European level and which remain national or sector-specific will depend on the applicable legal and technical frameworks in each jurisdiction.
From a technical standpoint, the wallet stores attestations that are cryptographically signed by trusted issuers, such as governments or qualified trust service providers. When a user presents an attestation remotely, the receiving organization verifies it through a combination of checks: verifying the issuer’s signature against the relevant national trusted list (part of the EU List of Trusted Lists), checking the revocation status via the issuer’s status information, and validating the wallet unit attestation to confirm that the presenting wallet runs on a certified wallet solution. The first of these checks can be performed offline; the others require a connection. This makes the process privacy-preserving and reliable, though it is not fully contactless in every scenario.
The four large-scale pilots that ran from April 2023 to 2025 tested exactly these scenarios. The POTENTIAL consortium piloted opening bank accounts, SIM registration, mobile driving licences, remote qualified signing, and e-prescriptions. DC4EU covered education credentials and social security. EWC focused on Digital Travel Credentials, payments, and organisational digital identity. NOBID concentrated on payments. A second wave of pilots started in 2025: WE BUILD covers business wallets and payments, and APTITUDE covers travel, ticketing, vehicle registration, and payments.
The legal deadline for Member States to make EUDI Wallets available is 24 December 2026. This deadline does not guarantee that every national wallet will have reached the same level of maturity by that date, or that every possible cross-border use case will be fully operational throughout Europe immediately. Practical interoperability and national rollout are expected to develop in phases, and organizations should plan accordingly.
What is the difference between remote verification under eIDAS 1.0 and eIDAS 2.0?
The key difference is scope and standardization. eIDAS 1.0 focused primarily on enabling cross-border recognition of national eID schemes between EU Member States, but participation was largely optional and uneven. Regulation (EU) 2024/1183 amends Regulation (EU) 910/2014 to make digital identity infrastructure mandatory, extends obligations to the private sector, and introduces the EUDI Wallet as a universal tool for remote identity verification.
Under eIDAS 1.0, only public sector services were required to accept notified eIDs from other Member States. Private organizations, such as banks or healthcare providers, were largely outside the scope of the regulation. This created a fragmented landscape where remote identity verification methods varied significantly across countries and sectors.
eIDAS 2.0 changes this in several important ways:
- Mandatory wallet availability: Every Member State must provide an EUDI Wallet by the legal deadline of 24 December 2026, creating a consistent baseline for remote identification across the EU. National rollout, certification, notification, and the operational readiness of relying parties are distinct steps that will develop over time.
- Private sector inclusion: From 24 December 2027, Article 5f requires relevant regulated private sector organizations to accept EUDI Wallets as a valid identification method where strong user authentication is legally or contractually required. Very large online platforms (VLOPs) are subject to a separate provision under Article 5f: they must accept wallet-based authentication where their platform requires user authentication, on the voluntary request of the user and for the minimum necessary data. Micro and small enterprises, defined as organizations with fewer than 50 employees and an annual turnover or balance sheet total not exceeding 10 million euros, are exempt.
- Reusable credentials: Verified attributes can be reused across services, reducing repeated verification and improving user experience.
- Stronger privacy controls: Users have explicit control over what data they share and with whom, supported by selective disclosure mechanisms.
- Broader trust services: eIDAS 2.0 expands the list of qualified trust services, including electronic attestations of attributes, which are essential for remote credential verification.
For organizations that already built their remote verification processes around eIDAS 1.0, these changes represent a significant upgrade in both capability and compliance requirements.
Which sectors are most affected by eIDAS 2.0 remote identity rules?
The sectors most affected by eIDAS 2.0 remote identity rules are financial services, government, healthcare, and any industry that relies on regulated onboarding or cross-border identity verification. These sectors handle sensitive data, operate under strict compliance frameworks, and interact with large numbers of users who need to be reliably identified before accessing services.
Financial services organizations, including banks, insurers, and payment providers, are directly impacted because KYC, AML, and PSD2 requirements already demand strong identity proofing. eIDAS 2.0 introduces new obligations around accepting EUDI Wallet credentials and aligning remote verification processes with updated assurance standards. It is worth noting that the reuse of KYC data across institutions is governed by AML regulation, not by eIDAS itself. Organizations in government services must make their digital services wallet-compatible and ensure citizens can access them remotely at the appropriate assurance level.
Healthcare and pharmaceutical organizations face similar pressures, particularly around patient identity verification, prescription access, and consent management. Remote identification at High assurance is increasingly expected when sensitive health data or medical decisions are involved. Processing health data also requires a lawful basis under both Article 6 and Article 9(2) of the GDPR, in addition to any eIDAS 2.0 obligations.
Beyond these sectors, the Article 5f obligation covers telecom, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services. Verifying employment eligibility, academic qualifications, or professional licences remotely becomes significantly more reliable and efficient under eIDAS 2.0, thanks to verifiable attestations stored in the EUDI Wallet. Recognition of professional qualifications as such continues to be governed by Directive 2005/36/EC. For relying parties operating across borders, registration obligations are connected to the applicable national registration framework under CIR (EU) 2025/848, and sector-specific legal requirements continue to apply alongside the eIDAS 2.0 rules.
What should organizations do to prepare for eIDAS 2.0 remote verification requirements?
Organizations should start by mapping their current identity verification processes against eIDAS 2.0 requirements, identifying gaps in assurance levels, compliance coverage, and technical readiness. The goal is to understand where existing remote identification methods fall short and what changes are needed to become wallet-ready and regulation-compliant.
Practical preparation involves several parallel workstreams. First, organizations need to assess which services require which assurance levels and whether their current remote verification methods can meet those standards. Second, they should evaluate how to integrate EUDI Wallet acceptance into their onboarding and authentication flows. Third, they need to review their data governance and consent frameworks to align with eIDAS 2.0’s stricter privacy and selective disclosure requirements. A relying party must also register with the national authority of its Member State of establishment under CIR (EU) 2025/848, specifying per intended use which attributes and attestations it will request. The wallet checks requests against this registered scope before any data is disclosed.
It is also worth investing in reusable identity infrastructure. One of the most significant operational benefits of eIDAS 2.0 is that once a user has been verified, that verification can be reused across services. Organizations that build for reusability now will reduce friction, cut onboarding costs, and improve conversion rates over time. Exploring the available digital identity solutions early gives organizations a head start on implementation.
Because national wallet rollout, certification, notification, and relying-party acceptance are distinct steps that will progress at different speeds across Member States, organizations should begin preparations now. Early engagement with the governance landscape, including understanding the roles of national competent authorities, wallet providers, issuers of Person Identification Data, and qualified trust service providers, will help teams make informed decisions about integration timelines and compliance obligations.
Finally, do not underestimate the change management dimension. Teams across compliance, IT, legal, and customer experience all need to understand how eIDAS 2.0 affects their work. Early cross-functional alignment makes implementation smoother and avoids costly rework later.
How TrustTech supports eIDAS 2.0 remote identity verification
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For remote identity verification specifically, the ID Connector handles verification against national trusted lists as part of the EU List of Trusted Lists, revocation status checks, and validation of wallet unit attestations to confirm that a presenting wallet runs on a certified wallet solution. It also enforces the registered attribute scope, so only the data a relying party has declared in its registration under CIR (EU) 2025/848 is requested and processed. Where a use case requires qualified signing, the ID Connector connects to an accredited QTSP for that step.
Organizations in financial services, healthcare, pharma, and government can use the ID Connector to build EUDI Wallet-ready onboarding and authentication flows into their existing systems, with a complete audit trail and EU compliance built in.
Get in touch with TrustTech to discuss your specific situation and find out how to connect your services to the EUDI Wallet.