A trust anchor is the root of trust in a digital identity system: the authoritative starting point that all parties in a trust chain rely on to verify that credentials, certificates, and identities are genuine. Under eIDAS 2.0, which amends Regulation (EU) 910/2014, trust anchors form the foundation of the entire European Digital Identity ecosystem, making it possible for organisations and individuals to exchange verified identity data with confidence across borders. This article unpacks how trust anchors work, who can act as one, and what this means for your organisation in practice.
How does a trust anchor fit into the eIDAS 2.0 trust chain?
A trust anchor fits into the eIDAS 2.0 trust chain as the starting point from which all trust is derived. When a relying party, such as a bank or government service, receives a credential or attestation, it needs to confirm that it was issued by a legitimate, authorised party. The trust anchor is the entity whose trustworthiness is accepted without further verification, and from which everything else in the chain can be validated.
Think of it like a chain of certificates. Each link in the chain can be verified by checking the one above it, all the way back to the trust anchor at the top. Under eIDAS 2.0, this chain is formalised through national trusted lists, maintained by EU Member States and brought together in the EU List of Trusted Lists (LOTL). These are official registries that list recognised trust service providers and their cryptographic certificates.
When the EUDI Wallet presents a credential to a relying party, the relying party traces the credential’s provenance back through the chain. If that chain leads to a recognised trust anchor on a national trusted list, the credential is considered valid. If the chain cannot be verified back to a trusted root, the credential is rejected. This mechanism is what makes cross-border digital identity verification possible at scale across the EU.
Verifying a credential involves more than one cryptographic check. Three distinct steps apply: first, verifying the issuer’s signature against the relevant national trusted list; second, checking the revocation status of the credential via the issuer’s status information; and third, validating the wallet unit attestation to confirm that the presenting wallet runs on a certified wallet solution. Only the first of these checks can be performed fully offline.
What role does a trust anchor play in the EUDI Wallet ecosystem?
In the EUDI Wallet ecosystem, trust anchors play a central role in ensuring that every piece of identity data stored and shared through a wallet can be cryptographically verified. Without a trust anchor, there is no reliable way for a relying party to confirm that a credential was issued by an authorised source.
The EUDI Wallet ecosystem involves several interacting parties, each with distinct responsibilities: wallet providers, issuers of Person Identification Data and attestations, qualified trust service providers, relying parties, and users. Governance of this ecosystem is a shared responsibility. The European Commission manages the legal framework and adopts implementing acts. EU Member States provide or mandate wallet solutions, certify and notify them, and supervise actors within their jurisdiction. The European Digital Identity Cooperation Group supports cooperation and cross-border alignment, while national competent authorities and registrars carry out oversight at the national level. Trust anchors make interaction between all these parties possible by providing a shared, verifiable reference point that each party can check against.
In practical terms, this means that when a user presents a credential from their EUDI Wallet, such as proof of professional qualification or a government-issued identity document, the receiving organisation can verify that the credential traces back to a recognised trust anchor. This supports scalable identity verification without requiring direct relationships between every pair of parties in the ecosystem.
For organisations operating in financial services or other regulated sectors, this is particularly significant. Accepting identity credentials that are anchored to national trusted lists means that trust verification is built into the process itself. It is worth noting, however, that sector-specific legislation continues to apply alongside eIDAS 2.0, and that not every credential automatically carries the same legal consequence in every Member State.
Who can act as a trust anchor under eIDAS 2.0?
Under eIDAS 2.0, trust anchors are typically qualified trust service providers (QTSPs) or government authorities that are listed on an EU Member State’s national trusted list. These are entities that have been assessed, certified, and formally recognised as meeting the strict security and operational requirements set out in the eIDAS regulation and the legally binding implementing acts adopted by the European Commission.
The following types of entities can act as trust anchors within the eIDAS 2.0 framework:
- National governments and public authorities that issue official identity credentials, such as national ID cards or electronic identification schemes
- Qualified Trust Service Providers (QTSPs) that have been assessed by an accredited conformity assessment body and listed on a national trusted list
- Wallet providers that are officially certified and notified under the eIDAS 2.0 framework by the relevant Member State
- Authentic sources, such as official registries or public sector bodies, that are authorised to issue verified attributes about individuals or organisations
Not every organisation that participates in the ecosystem qualifies as a trust anchor. Relying parties, for example, consume trusted credentials but do not themselves act as trust anchors. The distinction is significant: a trust anchor must be formally recognised and listed, whereas a relying party must be registered under the applicable national registration framework before it can request data from the ecosystem. Under CIR (EU) 2025/848, adopted on 6 May 2025, a relying party registers with the national authority of its Member State of establishment and specifies, per intended use, which attributes and attestations it will request. The wallet checks each request against this registered scope.
What is the difference between a trust anchor and a trust service provider?
The key difference is scope and function. A trust service provider (TSP) is any entity that provides digital trust services, such as electronic signatures, certificates, or timestamping. A trust anchor is a specific role within a trust chain: the entity whose public key or certificate is accepted as inherently trustworthy and does not require further verification. All trust anchors in the eIDAS 2.0 context are trust service providers, but not all trust service providers act as trust anchors.
To put it more concretely: a qualified trust service provider might issue certificates for electronic signatures. Those certificates form part of a trust chain. The trust anchor is the root certificate authority at the top of that chain, whose certificate is published on a national trusted list and accepted as the ultimate source of trust.
There is also a regulatory distinction. Trust service providers are regulated entities under eIDAS 2.0 and must meet specific requirements to operate. Qualified TSPs face even stricter requirements and undergo independent conformity assessments. Trust anchors, in the context of the EUDI Wallet ecosystem, are specifically those entities whose cryptographic material is published in official trust infrastructure, such as national trusted lists or the wallet ecosystem’s Lists of Trusted Entities (LoTE). The technical elaboration of how these registries operate is set out in the Architecture and Reference Framework (ARF), which provides the technical basis for implementing the legally binding requirements contained in the eIDAS 2.0 implementing acts.
For organisations building or integrating with digital identity solutions, understanding this distinction matters when deciding which parties you need to rely on and how to structure your verification processes.
How do organisations verify a trust anchor in practice?
In practice, organisations verify a trust anchor by checking the cryptographic certificate chain of a credential or signature against an authoritative, publicly available trusted list. Under eIDAS 2.0, the primary mechanism for this is the national trusted lists maintained by each Member State, brought together in the EU List of Trusted Lists (LOTL), and made available in a standardised machine-readable format.
The verification process typically works as follows:
- Receive the credential or certificate: The organisation receives a verifiable credential, electronic signature, or other trust-bearing artefact from a user or counterparty.
- Extract the certificate chain: The credential contains a chain of cryptographic certificates linking it back to the issuing authority.
- Check the chain against the national trusted list: The organisation’s verification system checks whether the root certificate in the chain matches a trust anchor listed on the relevant national trusted list.
- Validate revocation status and validity period: The system also confirms that the trust anchor’s certificate has not been revoked and is still within its validity period. This step requires contact with the issuer’s status information and cannot be performed fully offline.
- Validate the wallet unit attestation: The system confirms that the presenting wallet runs on a certified wallet solution, by checking the wallet unit attestation.
- Accept or reject the credential: If the chain traces back to a valid, listed trust anchor and all checks pass, the credential is accepted. If not, it is rejected.
This process is largely automated in modern identity verification systems. Organisations do not need to manually check trusted lists for every transaction. Instead, their software integrates with the relevant trust infrastructure and performs these checks in real time. For organisations in sectors such as government services or healthcare, this automated verification is essential for processing high volumes of identity interactions without adding friction for users.
The EUDI Wallet architecture also introduces additional trust infrastructure specific to the wallet ecosystem, including Lists of Trusted Entities (LoTE) covering certified wallet solutions and registered relying parties. Each Member State is responsible for certifying and notifying its own wallet solution or solutions, and relying party registration remains connected to the applicable national registration framework under CIR (EU) 2025/848. Organisations operating within this ecosystem need to ensure their verification systems are aligned with these registries as well as the national trusted lists. Practical interoperability and national rollout are expected to develop in phases, and organisations should plan their integration accordingly.
How the ID Connector supports trust anchor verification
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
In the context of trust anchors, the ID Connector handles the specific technical steps that make trust anchor verification reliable in production environments. It verifies issuer signatures against national trusted lists and the LOTL, checks revocation status via issuer-provided status information, and validates wallet unit attestations to confirm that a presenting wallet runs on a certified wallet solution. It also monitors the registered attribute scope for each relying party, so that credential requests stay within the bounds registered under CIR (EU) 2025/848.
For organisations in financial services, healthcare, and government, the ID Connector provides the verification infrastructure needed to accept EUDI Wallet credentials in compliance with eIDAS 2.0 requirements. The 24 December 2026 deadline applies to public sector bodies required to accept notified wallets for online services where electronic identification is mandated. For regulated private sector organisations in sectors such as banking, healthcare, telecoms, energy, and digital services, the obligation under Article 5f of eIDAS 2.0 applies from 24 December 2027, where strong user authentication is legally or contractually required. Micro and small enterprises with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros are exempt.
To see how the ID Connector fits your organisation’s verification requirements, get in touch with our team.