A wallet provider is an organisation that issues and operates a digital identity wallet, giving users a secure app or platform to store, manage, and share their identity data and credentials. Under eIDAS 2.0, which amends Regulation (EU) 910/2014, every EU Member State must make a wallet available to its citizens, residents, and businesses, either by building one directly or by certifying a private organisation to do so. Governance of the EUDI Wallet ecosystem is a shared responsibility: the European Commission manages the legal framework and adopts implementing acts, Member States provide or mandate wallet solutions and supervise actors within their jurisdiction, and national competent authorities certify and notify wallet providers. This article unpacks the wallet provider role in detail, from who can become one to what it means for your organisation.
What does a wallet provider actually do?
A wallet provider issues and operates a digital identity wallet that allows users to store verified credentials, prove who they are, and selectively share personal data with third parties. The provider is responsible for the technical infrastructure behind the wallet, the security of the data stored in it, and the overall user experience of managing digital identity.
In practical terms, this means a wallet provider builds and maintains the application that sits on a user’s device, connects it to the trust infrastructure that makes credentials verifiable, and ensures it works across different services and borders. Users rely on the wallet to do things like open a bank account online, access government services, share a diploma, or present a mobile driving licence, without handing over more personal data than is strictly necessary.
The wallet itself does not store credentials on a central server owned by the provider. Instead, the user holds their own credentials, and the wallet provider supplies the secure environment in which those credentials live and can be presented. Technically, this environment is the wallet unit: the wallet instance together with the Wallet Secure Cryptographic Application and the Wallet Secure Cryptographic Device in which private keys are held. Private keys for Person Identification Data and attestations never leave the secure element, which means that when a user switches devices, attestations must be re-issued rather than simply copied across. This distinction matters a great deal for privacy and data sovereignty. It also reflects the fact that no single central European authority operationally manages all EUDI Wallets; responsibility is distributed across Member States, national competent authorities, and the providers they certify.
Who is allowed to become a wallet provider under eIDAS 2.0?
Under eIDAS 2.0, both public authorities and private organisations can become wallet providers, provided they meet the certification requirements set by their Member State and comply with the technical standards elaborated in the Architecture and Reference Framework. The legally binding requirements are contained in the implementing acts adopted by the European Commission; the Architecture and Reference Framework provides the technical elaboration of those requirements. A private company cannot simply launch a wallet and call it an EUDI Wallet; it must be officially certified and notified by the relevant national competent authority.
Member States are required to provide at least one certified wallet to all citizens, residents, and businesses by 24 December 2026. This is the legal deadline for Member States’ wallet obligations, meaning it is the latest date by which the obligation must be met. It does not guarantee that every national wallet will have reached the same level of maturity by that date, or that every possible cross-border use case will be fully operational throughout Europe at that point. Practical interoperability and national rollout are likely to develop in phases, and organisations should plan accordingly. Member States can fulfil their obligation by building a government-operated wallet or by certifying one or more private providers, which opens the door for banks, telecoms, and technology companies to operate wallets, as long as they pass the required conformity assessments and security certifications.
The certification process is designed to ensure a consistent baseline of trust across the EU. A wallet certified and notified in one Member State must be recognised and accepted in all others, which is one of the core goals of the regulation. This interoperability requirement places significant technical and compliance demands on any organisation seeking to become a wallet provider.
What is the difference between a wallet provider and an identity provider?
A wallet provider gives users a secure container to hold and present credentials, while an identity provider authenticates users and issues identity assertions. The key distinction is that a wallet provider does not necessarily verify who you are; it provides the infrastructure for you to carry and use credentials that have already been verified by authoritative sources such as issuers of Person Identification Data or qualified trust service providers.
An identity provider, in the traditional sense, sits between a user and a service and confirms that the user is who they claim to be, typically through a login process. The identity provider issues a token or assertion in real time. The wallet model works differently: a trusted authority issues a verifiable credential once, the user stores it in their wallet, and they can then present it to any relying party without the original issuer needing to be involved in every transaction. It is worth noting that verifying a presented credential involves more than one check: the issuer’s signature must be verified against the relevant national trusted list, the revocation status must be checked using the issuer’s status information, and the wallet unit attestation must be validated to confirm that the presenting wallet runs on a certified wallet solution. Only the first of these checks can be performed fully offline.
In the EUDI Wallet ecosystem, a single organisation could play multiple roles. A government agency might issue a national identity credential and also operate a wallet. But conceptually, and often practically, these are separate functions with distinct governance responsibilities. The wallet provider manages the user-facing application and the secure presentation of credentials; the issuer is the authority that produced and signed those credentials in the first place. Relying parties, for their part, remain subject to applicable national registration frameworks and sector-specific legislation even when accepting wallet-based credentials.
What responsibilities does a wallet provider have toward users?
A wallet provider is responsible for the security, privacy, and reliability of the wallet environment. This includes protecting stored credentials from unauthorised access, ensuring users retain full control over what data is shared and with whom, and maintaining the technical integrity of the wallet so that credentials remain valid and tamper-evident.
Beyond the technical obligations, wallet providers have clear responsibilities under eIDAS 2.0 and related data protection rules:
- Data minimisation: The wallet must be designed so users can share only the specific attributes a service needs, not an entire document or identity record.
- User control: Users must be able to see which credentials they hold and which parties they have shared data with. The wallet dashboard serves as a tool for the user, giving visibility over past presentations. Each presentation requires the user’s individual approval; the wallet does not grant standing access to a relying party.
- Transparency: The provider must be clear about how the wallet works, what data it processes, and under what conditions.
- Security certification: The wallet solution must meet the assurance levels required by the regulation and pass conformity assessments conducted under national supervision.
- Availability and continuity: Users depend on the wallet for access to critical services, so providers must ensure the application remains available and functional over time.
These responsibilities make wallet provision a serious undertaking. It is a trusted piece of infrastructure that people rely on for access to healthcare, financial services, government benefits, and more.
How does a wallet provider fit into the broader trust ecosystem?
A wallet provider is one of several core roles in the EUDI Wallet trust ecosystem, alongside issuers of Person Identification Data, issuers of attestations, qualified trust service providers, and relying parties. The provider sits in the middle: it receives credentials from issuers, holds them securely on behalf of the user, and enables the user to present them to relying parties in a way that those parties can verify.
Verification draws on national trusted lists, which are brought together in the EU List of Trusted Lists. Issuers, such as government agencies, universities, or healthcare authorities, must be registered and recognised under the applicable national or European framework. Relying parties, such as banks, employers, or online platforms, must verify that a credential is genuine and tamper-evident, and they remain subject to national registration requirements and sector-specific legislation. Under CIR (EU) 2025/848, adopted on 6 May 2025, a relying party must register with the national authority of its Member State of establishment before it can request wallet data, and must register per intended use which attributes and attestations it will request. The wallet checks requests against this registered scope. The European Digital Identity Cooperation Group supports cross-border alignment and cooperation among Member States. The wallet provider connects these parties through standardised protocols and certified infrastructure, but does not replace the distinct governance responsibilities each actor holds.
The four large-scale pilot projects that ran from April 2023 to 2025 tested exactly this kind of end-to-end ecosystem in real-world scenarios. The EWC consortium piloted Digital Travel Credentials, payments, and organisational digital identity. POTENTIAL covered government services, opening a bank account, SIM registration, mobile driving licences, qualified remote signing, and e-prescriptions. NOBID focused on payments, and DC4EU addressed education and social security credentials. A second wave of pilots started in 2025, with WE BUILD focusing on business wallets and payments, and APTITUDE covering travel, ticketing, vehicle registration, and payments. The insights from these pilots are shaping the technical elaboration that wallet providers will need to meet. Cross-border interoperability operates at the level of the wallet and credential standards; it does not remove national registration requirements, sector-specific legal obligations, or differences in how individual credentials are recognised across jurisdictions. Organisations working in financial services or government are particularly affected, as these sectors are among the first to integrate wallet-based interactions into their services.
What should organisations look for when selecting a wallet provider?
When selecting a wallet provider, organisations should prioritise certification status, interoperability, security architecture, and the provider’s ability to support integration with existing systems. A wallet that is not certified and notified under the eIDAS 2.0 framework will not be accepted by relying parties across the EU, which makes compliance the baseline requirement before anything else.
Beyond compliance, consider the following when evaluating wallet providers:
- Certification and recognition: Is the wallet officially certified by a national competent authority and notified under eIDAS 2.0? Does it meet the required assurance levels set out in the implementing acts?
- Interoperability: Does the wallet support the technical standards elaborated in the Architecture and Reference Framework, ensuring it works across borders and with different issuers and relying parties? Bear in mind that cross-border interoperability applies to the wallet and credential layer; sector-specific and national requirements at the relying-party level remain in place.
- Security model: How does the wallet protect credentials? Is security tied to the device through a Wallet Secure Cryptographic Device, or is there a backend architecture that provides resilience and flexibility?
- User experience: Will the wallet be easy for your end users or customers to use? Adoption depends heavily on simplicity and reliability.
- Integration support: Can the provider help you connect the wallet to your existing identity infrastructure, onboarding flows, or service delivery systems?
- Sector fit: Does the provider have a track record in the regulatory and operational context of your industry, whether that is healthcare, finance, or another regulated sector?
Choosing the right wallet provider is a strategic decision. The provider you work with will shape how your organisation participates in the European digital identity ecosystem for years to come.
How TrustTech supports wallet provider integration
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organisations preparing to work with wallet providers, the ID Connector handles the following:
- Wallet acceptance: Connecting your service to every notified wallet solution without building separate integrations for each.
- Verification against trusted lists: Checking issuer signatures against national trusted lists, brought together in the EU List of Trusted Lists, so your service can confirm that presented credentials come from a recognised source.
- Revocation checking: Querying issuer status information to confirm that a credential has not been revoked before your service relies on it.
- Wallet unit attestation validation: Confirming that the wallet presenting credentials runs on a certified wallet solution.
- Registered attribute scope: Ensuring that credential requests stay within the scope registered under CIR (EU) 2025/848, so your service requests only the attributes it is authorised to receive.
- Qualified signing: Connecting to a qualified trust service provider for qualified electronic signatures where your process requires them.
The ID Connector is relevant across financial services, healthcare, pharma, and government, where wallet-based interactions are moving into production. If your organisation is preparing for the EUDI Wallet and wants to understand how integration works in practice, get in touch with TrustTech.