ISO/IEC 18013-5 is the international standard that defines how a mobile driving licence (mDL) is structured, stored, and securely shared from a smartphone. It specifies the data format, cryptographic protocols, and communication methods that allow a digital licence to be presented and verified in a privacy-respecting, tamper-evident way. For organisations navigating eIDAS 2.0 and the European Digital Identity Wallet, ISO/IEC 18013-5 is one of the core technical building blocks that underpins how credentials are exchanged in the new digital identity ecosystem.
How does ISO/IEC 18013-5 actually work as a standard?
ISO/IEC 18013-5 defines the technical rules for issuing, presenting, and verifying a mobile driving licence on a smartphone or other mobile device. It covers the data model, encoding format, and the communication protocols used when a holder presents their mDL to a verifier, whether in person or online.
At its core, the standard uses a document format called mdoc, which structures identity attributes as cryptographically signed data elements. When a user presents their mDL, only the specific attributes requested by the verifier are disclosed, such as age or licence category, without exposing the full document. This selective disclosure is built into the standard by design.
Communication between the holder’s device and the verifier happens over two main channels: proximity-based, using Bluetooth Low Energy or NFC for in-person checks as defined in ISO/IEC 18013-5, and online, using a browser or app session for remote verification as defined in ISO/IEC TS 18013-7. In both cases, the data exchanged is encrypted and authenticated, ensuring that the credential and the communication are tamper-evident.
Verification of an mDL involves three distinct checks. First, the verifier validates the issuer’s signature against the relevant national trusted list, which can be done offline. Second, the verifier checks the revocation status using the issuer’s status information, which requires a connection to the issuer’s infrastructure. Third, the verifier checks the wallet unit attestation to confirm that the presenting wallet is running on a certified wallet solution. These three checks together constitute a complete verification, and only the first can be performed fully offline.
What is an mDL and how does it differ from a physical driving licence?
An mDL, or mobile driving licence, is a digital representation of a driving licence stored on a smartphone and issued by an authorised authority. Unlike a physical card, an mDL is cryptographically signed, can be selectively shared, and does not need to be physically handed over during a check.
The differences go beyond format. A physical driving licence is a static document: once issued, the data on it cannot be updated without reissuing the card, and presenting it always reveals all the information printed on it. An mDL, by contrast, can reflect real-time updates from the issuing authority, and the holder can choose which attributes to share in a given interaction.
Consider a simple age verification scenario. With a physical licence, a verifier sees your full name, address, date of birth, and licence number. With an mDL compliant with ISO/IEC 18013-5, the holder can present only a confirmed “over 18” attribute via selective disclosure, sharing nothing else. This is a meaningful privacy improvement with practical consequences for both consumers and organisations handling personal data.
What is the difference between ISO/IEC 18013-5 and SD-JWT VC?
ISO/IEC 18013-5 and SD-JWT VC are both credential formats supported in the EUDI Wallet Architecture and Reference Framework (ARF), but they use different data models, encoding formats, and are optimised for different contexts.
ISO/IEC 18013-5 (mdoc)
The mdoc format defined in ISO/IEC 18013-5 was originally designed for government-issued identity documents, particularly driving licences. It is optimised for proximity use cases, strong cryptographic binding, and integration with physical identity infrastructure. The trust model relies on issuer-signed certificates within a defined Public Key Infrastructure (PKI), making it well-suited for high-assurance government credentials. Proximity presentation follows ISO/IEC 18013-5, while online presentation follows ISO/IEC TS 18013-7.
SD-JWT VC
SD-JWT VC is a JSON-based credential format that supports selective disclosure and is well-suited to web-native environments. It is the other credential format prescribed in the EUDI Wallet ARF alongside mdoc. SD-JWT VC works with OpenID for Verifiable Credential Issuance (OID4VCI) for issuance and OpenID for Verifiable Presentations (OID4VP) for presentation. Both formats are part of the High Assurance Interoperability Profile (HAIP) that governs interoperability across EUDI Wallet implementations.
In practice, the EUDI Wallet architecture supports both mdoc and SD-JWT VC as valid credential formats. This means organisations may need to work with either or both, depending on the credential type and use case. Understanding the distinction helps organisations choose the right format for the right context.
How does ISO/IEC 18013-5 relate to eIDAS 2.0 and the EUDI Wallet?
ISO/IEC 18013-5 is one of the foundational technical standards referenced in the EUDI Wallet architecture. The European Digital Identity Wallet is designed to carry government-issued credentials, including the mobile driving licence, using the mdoc format defined in ISO/IEC 18013-5. This makes the standard directly relevant to any organisation preparing for eIDAS 2.0 compliance.
eIDAS 2.0, formally Regulation (EU) 2024/1183, amends Regulation (EU) 910/2014. Under eIDAS 2.0, EU Member States are each responsible for making a European Digital Identity Wallet available to their citizens, residents, and businesses by 24 December 2026. These wallets must support the secure presentation of identity attributes and qualified credentials to both public and private sector relying parties.
From 24 December 2026, public sector bodies must accept notified wallets for online services that require electronic identification. From 24 December 2027, Article 5f of eIDAS 2.0 extends acceptance obligations to relevant regulated private sectors where strong user authentication is legally or contractually required. These sectors include banking and financial services, healthcare, telecoms, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services. Micro and small enterprises, defined as organisations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros, are exempt. Very large online platforms fall under a separate provision of Article 5f: for those platforms, the obligation applies where the platform requires user authentication, on the user’s voluntary request and for the minimum necessary data.
The European Commission manages the legal framework and adopts implementing acts that set out the binding requirements. The ARF provides the technical elaboration of those requirements. The mdoc format and the communication protocols from ISO/IEC 18013-5 are embedded in the wallet’s technical specifications because they provide a proven, interoperable foundation for high-assurance credential exchange.
For organisations that will act as relying parties under eIDAS 2.0, their verification infrastructure will need to be capable of reading and validating mdoc credentials. Under CIR (EU) 2025/848, adopted on 6 May 2025, a relying party must register with the national authority of its Member State of establishment before it can request wallet data. Registration is per intended use, specifying which attributes and attestations will be requested. The wallet checks each request against this registered scope. Organisations in financial services and government are among those most directly affected by these requirements.
Which sectors and use cases does ISO/IEC 18013-5 apply to?
While ISO/IEC 18013-5 was originally developed for driving licences, its underlying mdoc format and protocols are now applied across a growing range of sectors and use cases wherever secure, privacy-preserving credential presentation is needed.
The following use cases illustrate where ISO/IEC 18013-5-based credentials are already in use or have been actively piloted:
- Transport and mobility: Digital driving licences accepted by traffic police, car rental companies, and border control agencies
- Financial services: Identity verification for account opening, KYC checks, and strong customer authentication under PSD2 and eIDAS 2.0
- Healthcare: Secure patient identification and sharing of health-related attributes without exposing unnecessary personal data
- Age verification: Selective disclosure of an “over 18” or “over 21” attribute without revealing full identity details
- Government services: Access to public sector portals and cross-border identity recognition within the EU
- Travel: Digital Travel Credentials for border crossings, piloted as part of the EWC Large Scale Pilot between April 2023 and 2025
The breadth of these use cases reflects the standard’s design philosophy: a secure, flexible credential format that works across sectors because the underlying cryptographic and communication mechanisms are robust and interoperable. Cross-border interoperability operates at the level of the wallet framework itself. Individual use cases may still be subject to national or sector-specific legislation, meaning that a credential that is technically valid in one Member State does not automatically carry identical legal consequences in another. Organisations in healthcare and other regulated industries should factor this into their planning as they evaluate how mDL-compatible infrastructure fits into their digital identity strategies.
What should organisations do to prepare for ISO/IEC 18013-5 adoption?
Organisations should start by assessing whether they will act as a credential issuer, a verifying relying party, or both under the emerging EUDI Wallet framework. This determines which parts of ISO/IEC 18013-5 are most immediately relevant and shapes the technical and compliance work required.
For most private sector organisations, the most pressing task is preparing to accept and verify mdoc credentials. This involves evaluating existing identity verification infrastructure against the standard’s requirements and identifying gaps. The steps below provide a practical starting point:
- Map your use cases: Identify which customer interactions currently involve identity verification and which of these could involve wallet-presented credentials under eIDAS 2.0
- Assess your technical stack: Determine whether your current systems can handle mdoc-formatted credentials, CBOR encoding, and the proximity or online communication protocols defined in ISO/IEC 18013-5 and ISO/IEC TS 18013-7
- Understand the trust model: Familiarise your team with the PKI-based trust infrastructure that underpins mDL verification, including how issuer certificates are validated against national trusted lists, how revocation status is checked, and how wallet unit attestations confirm that a presenting wallet runs on a certified wallet solution
- Review the EUDI Wallet ARF: The Architecture and Reference Framework published by the European Commission provides the technical elaboration of the implementing act requirements and details how ISO/IEC 18013-5 fits within the broader wallet ecosystem and what relying parties are expected to support
- Register as a relying party: Under CIR (EU) 2025/848, registration with the national authority of your Member State of establishment is required before you can request wallet data. Registration specifies the attributes and attestations you intend to request per use case
- Follow the completed pilots and the second wave: The four original Large Scale Pilots ran from April 2023 to 2025 and generated practical insights about real-world implementation. A second pilot wave started in 2025, including WE BUILD, focused on business wallets and payments, and APTITUDE, focused on travel, ticketing, vehicle registration, and payments. Following their outputs helps organisations stay ahead of emerging requirements
Organisations should also factor in the timeline carefully. The legal deadline for Member States to make EUDI Wallets available is 24 December 2026. This is a legal obligation on Member States, not a guarantee that every national wallet will reach the same level of maturity on that date or that every cross-border use case will be fully operational throughout Europe from that point. The private sector acceptance obligation under Article 5f applies from 24 December 2027 for the relevant regulated sectors. Practical interoperability and national rollout are likely to develop in phases, and acceptance by relying parties will follow its own trajectory. Early engagement with the standard reduces the risk of last-minute compliance pressure and positions organisations to benefit from faster, more trusted digital interactions as rollout progresses. For a broader view of how to approach this transition, exploring TrustTech’s implementation approach can offer useful framing for organisations at different stages of readiness.
How the ID Connector supports ISO/IEC 18013-5 and EUDI Wallet readiness
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
In the context of ISO/IEC 18013-5, the ID Connector handles the technical work that relying parties need to perform on every credential presentation. Specifically, it:
- Validates the issuer signature against the relevant national trusted lists, which are brought together in the EU List of Trusted Lists (LOTL)
- Checks revocation status using the issuer’s status information
- Validates the wallet unit attestation to confirm the presenting wallet runs on a certified wallet solution
- Enforces the registered attribute scope, so that only the attributes and attestations declared during relying party registration under CIR (EU) 2025/848 are requested and processed
- Supports both mdoc and SD-JWT VC credential formats, covering proximity and online presentation flows
- Connects to qualified signing via an integrated QTSP where a qualified electronic signature is required
Organisations in financial services, healthcare, and government are among those for whom ISO/IEC 18013-5 readiness is most pressing, given the acceptance obligations that apply from 24 December 2026 for public bodies and from 24 December 2027 for relevant regulated private sectors. To find out how the ID Connector fits your organisation’s verification infrastructure, get in touch with TrustTech.