A verifiable credential in the context of the EUDI Wallet is a tamper-evident digital document that proves something about you, such as your age, nationality, or professional qualification, in a way that can be cryptographically verified by any party that receives it. Unlike a scanned PDF or a photo of your passport, a verifiable credential carries built-in proof of who issued it and that it has not been altered. The sections below unpack how these credentials work, who issues them, and what they mean for organizations preparing for the European Digital Identity Wallet.
How do verifiable credentials work inside the EUDI Wallet?
A verifiable credential works inside the EUDI Wallet through a three-party system: an issuer creates and signs the credential cryptographically, the holder stores it in their wallet, and a verifier checks its authenticity. The digital signature embedded in the credential is tamper-evident, making it possible to detect any alteration at the moment of presentation.
When a user wants to share a credential, for example to open a bank account or access a government service, they select it from their EUDI Wallet and approve the sharing request. The receiving organization, called the relying party, then performs a series of checks. First, it verifies the issuer’s signature against the relevant national trusted list, which is part of the EU List of Trusted Lists (LOTL). Second, it checks the revocation status of the credential using status information provided by the issuer. Third, it validates the wallet unit attestation to confirm that the presenting wallet is running on a certified wallet solution. Only the first of these checks can be performed fully offline. The revocation check and the wallet unit attestation validation require a connection to external sources.
This architecture is built on open technical standards. The EUDI Wallet uses mdoc and SD-JWT VC as credential formats, with OID4VCI for issuance and OID4VP for presentation. For proximity presentation, ISO/IEC 18013-5 applies; for online presentation, ISO/IEC TS 18013-7 is used. The High Assurance Interoperability Profile (HAIP) sets out the interoperability requirements across these components. The Architecture and Reference Framework (ARF) provides the technical elaboration of the requirements set out in the implementing acts adopted under eIDAS 2.0. The ARF is not itself legislation; the implementing acts are legally binding. Note that W3C Verifiable Credentials is not a credential format prescribed by the ARF for the EUDI Wallet.
The large-scale pilots that ran from April 2023 to 2025 tested this flow in real-world scenarios. The POTENTIAL consortium piloted government services, bank account opening, SIM registration, mobile driving licence, remote qualified signing, and e-prescriptions. The EWC consortium focused on Digital Travel Credentials, payments, and organisational digital identity. NOBID concentrated on payments, and DC4EU covered education and social security. A second wave of pilots started in 2025: WE BUILD focuses on business wallets and payments, and APTITUDE covers travel, ticketing, vehicle registration, and payments. Digital Travel Credentials have been piloted, but wallet-based use at border or airport controls is not yet operational functionality.
What types of verifiable credentials will the EUDI Wallet support?
The EUDI Wallet is designed to support a wide range of verifiable credentials covering both personal identity and domain-specific documents. The wallet can hold anything from government-issued identity attributes to professional qualifications, travel documents, and financial credentials, as long as they are issued by a recognized authority within the trust framework.
Based on the use cases tested in the large-scale pilots, the following credential types are among those the EUDI Wallet will support:
- Identity credentials: National identity attributes such as name, date of birth, and nationality, derived from official government records
- Mobile driving licence: A digital version of your driving licence usable both online and in physical roadside checks
- Educational credentials: Diplomas, degrees, and certificates issued by recognized educational institutions
- Healthcare credentials: Prescription details and the European Health Insurance Card
- Travel credentials: Information from passports and visas piloted for use at border control and airport security
- Organisational credentials: Proof that you are an authorised representative of a business or institution
- Payment credentials: Identity verification linked to financial transactions and bank account opening
This breadth reflects the ambition behind eIDAS 2.0, Regulation (EU) 2024/1183, which amends Regulation (EU) 910/2014: a single, secure wallet that addresses the fragmented mix of passwords, paper documents, and siloed digital accounts that Europeans currently navigate every day.
What is the difference between a verifiable credential and a traditional digital document?
The key difference is that a verifiable credential carries cryptographic proof of its authenticity, while a traditional digital document such as a PDF or scanned image does not. Anyone can copy or alter a PDF. A verifiable credential contains a digital signature that makes tampering detectable and allows any recipient to verify its origin through the checks described above.
Traditional digital documents also require the receiving party to perform manual checks, cross-reference databases, or trust the sender at face value. A verifiable credential makes that verification structured and automatable.
There is also a fundamental difference in how data is handled. A traditional document typically shares everything it contains, whether relevant or not. A verifiable credential supports selective disclosure, meaning the holder can share only the specific attributes needed for a given interaction. To prove you are over 18, for example, you do not need to reveal your exact date of birth, your address, or any other personal detail. This is a structural privacy advantage that paper and PDF documents cannot replicate. Selective disclosure of a single attribute such as “over 18” does not require zero-knowledge proofs; it is achievable through the credential formats the EUDI Wallet supports.
Who issues verifiable credentials in the EUDI Wallet ecosystem?
Verifiable credentials in the EUDI Wallet ecosystem are issued by trusted entities that have been formally recognized within the eIDAS 2.0 trust framework. These issuers can be public authorities, such as national identity agencies or healthcare regulators, as well as private organizations that meet the regulatory requirements to act as qualified or recognized credential providers. Issuing attestations of attributes is itself a trust service under eIDAS 2.0.
The regulation establishes a layered trust model. Governance is a shared responsibility distributed across several actors. The European Commission manages the legal framework and adopts implementing acts that set out legally binding requirements. EU Member States are responsible for providing or mandating wallet solutions, certifying and notifying them, and supervising actors within their jurisdiction. The European Digital Identity Cooperation Group supports cooperation and cross-border alignment between Member States. National competent authorities and registrars oversee trusted lists and issuer recognition at the national level. Wallet providers develop and operate the wallet solutions. Qualified trust service providers underpin cryptographic security. Issuers of Person Identification Data and attestations produce the credentials themselves, and relying parties consume them.
At the foundation of the credential hierarchy are Member States, which are responsible for issuing the core identity attestation known as the Person Identification Data (PID) that anchors a user’s wallet to their verified legal identity. On top of this foundation, a broad range of sector-specific issuers can provide Qualified Electronic Attestations of Attributes (QEAAs), Public Body Electronic Attestations of Attributes (PuB-EAAs), or non-qualified Electronic Attestations of Attributes (EAAs), depending on the assurance level required. PuB-EAAs are issued by or on behalf of public bodies and are distinct from non-qualified EAAs.
In practice, this means a university can issue a diploma attestation, a hospital can issue a prescription attestation, and a financial institution can issue attestations related to account status or KYC verification. Each issuer must appear on the relevant national trusted list or Lists of Trusted Entities (LoTE) so that verifiers can confirm the issuer’s legitimacy. Not every private issuer is automatically placed on an EU trusted list; recognition depends on the applicable requirements for the attestation type in question. This structure is what makes the system scalable and interoperable across EU Member States.
An issuer must also make revocation status information available and support re-issuance when a user switches to a new device. Because private keys associated with PID and attestations do not leave the secure cryptographic device within the wallet unit, attestations cannot simply be copied to a new device. They must be re-issued.
How do verifiable credentials protect privacy in the EUDI Wallet?
Verifiable credentials protect privacy through a combination of selective disclosure, minimal data sharing, and user approval. The user approves each presentation request individually in the wallet. Nothing is shared without that approval, and only the data strictly necessary for the transaction is transmitted. Approving a presentation request in the wallet is a separate matter from consent as a legal basis under the GDPR. The relying party receiving the data needs its own GDPR legal basis for processing. For KYC, that basis is typically a legal obligation. For health data, an additional condition under Article 9(2) GDPR is required.
This design directly addresses one of the most significant weaknesses of current identity systems: over-sharing. When you show a physical ID card to prove your age, you also reveal your full name, address, and date of birth, even though only your age is relevant. Verifiable credentials address this by allowing the wallet to present a single confirmed attribute, such as “this person is over 18,” without exposing any additional personal information.
The EUDI Wallet framework also addresses cross-context tracking. The cryptographic mechanisms used in credential presentation can be designed to reduce linkability across different services or transactions. This gives users greater control over their personal data. However, it is important to note that this does not eliminate all risk of tracking or profiling. The wallet dashboard provides users with an overview of their presentation activity; it is a user-facing feature, not a logging facility for the wallet provider.
Privacy protection is a regulatory requirement under eIDAS 2.0, which mandates that wallets must respect user control and data minimisation principles in line with the GDPR. Wallet use is voluntary. Organizations that accept verifiable credentials benefit from receiving only the data they are entitled to, which also reduces their own compliance exposure.
What does verifiable credential adoption mean for organizations?
For organizations, adopting verifiable credentials means replacing slow, manual identity verification processes with structured, cryptographically verifiable checks. It also means preparing your systems to accept credentials from the EUDI Wallet as a recognized and legally valid form of identity proof under eIDAS 2.0, Regulation (EU) 2024/1183, which amends Regulation (EU) 910/2014.
The obligations differ depending on the type of organization. From 24 December 2026, public bodies must accept notified EUDI Wallets for online services that require electronic identification. From 24 December 2027, Article 5f of eIDAS 2.0 extends mandatory acceptance to relevant regulated private sectors where strong user authentication is legally or contractually required. These sectors include banking and financial services, healthcare, telecoms, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services. Micro and small enterprises are excluded from this obligation: the threshold is fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros. Very Large Online Platforms (VLOPs) are subject to a separate provision under Article 5f: where a VLOP requires user authentication, it must accept the EUDI Wallet on voluntary request from the user and for the minimum necessary data. The condition relating to legally or contractually required strong authentication does not apply to VLOPs.
The practical implications vary by role. Organizations can act as relying parties, issuers, or both. As a relying party, you must register with the national authority of your Member State of establishment under CIR (EU) 2025/848 of 6 May 2025 before you can request wallet data. Registration is per intended use and specifies which attributes and attestations you are entitled to request. The wallet checks each presentation request against this registered scope. A relying party must be able to accept every relevant notified wallet, regardless of which wallet provider issued it. A relying party does not automatically need a qualified trust service provider (QTSP) for wallet acceptance; a QTSP becomes relevant in scenarios involving qualified signing or qualified attestations. A vendor processing wallet data on behalf of a client does not thereby become the relying party. The registration obligation lies with the organization delivering the service to the end user.
As an issuer, you need to produce attestations in the correct technical format, sign them with a recognized key, and meet the applicable requirements for your attestation type, whether QEAA, PuB-EAA, or non-qualified EAA.
The transition also creates real business value. Automated credential verification reduces onboarding friction, cuts operational costs associated with manual document checks, and lowers the risk of identity fraud. Organizations in financial services stand to benefit significantly, given the volume of identity verification they currently perform for KYC and account opening. Note that reuse of KYC data is governed by AML regulation, not by eIDAS 2.0 itself. Similarly, healthcare organizations can streamline patient identification and prescription handling through wallet-based credentials.
The timeline matters. The legal deadline for Member States to make EUDI Wallets available is 24 December 2026. This is an outer deadline, not a predicted launch date. Practical interoperability and national rollout are likely to develop in phases, and not every cross-border use case will be fully operational throughout Europe on that date. The private sector acceptance deadline under Article 5f is 24 December 2027. Organizations that begin integrating now will be better positioned than those that wait.
For government organizations, the stakes are particularly high, as they are both major issuers and major relying parties within the ecosystem, making early alignment with the technical and regulatory standards essential.
How the ID Connector supports verifiable credential adoption
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organizations preparing to act as relying parties, the ID Connector handles the technical complexity of wallet acceptance. This includes verifying issuer signatures against national trusted lists that form part of the EU List of Trusted Lists, checking revocation status, validating wallet unit attestations to confirm that the presenting wallet runs on a certified wallet solution, and ensuring that each presentation request stays within the attribute scope registered under CIR (EU) 2025/848. For organizations in financial services, healthcare, pharma, and government, the ID Connector provides a single integration point that covers the full verification chain without requiring each organization to build and maintain that infrastructure independently.
Qualified signing via a connected QTSP is also available through the same interface, for organizations that need to support qualified electronic signatures in their workflows.
To find out how the ID Connector fits your organization’s specific situation as a relying party or issuer, get in touch with TrustTech.