A wallet provider and an issuer are two distinct roles in the eIDAS 2.0 ecosystem. The wallet provider builds and operates the digital identity wallet app that users carry on their devices. The issuer is the organisation that creates and signs the attestations stored inside that wallet. Understanding the difference matters for any organisation deciding how to position itself within the European Digital Identity framework.
Both roles are essential for the EUDI Wallet ecosystem to work, but they carry different responsibilities, different technical requirements, and different regulatory obligations. The sections below walk through each role, how they interact, and what this means for your organisation in 2026 and beyond.
What does a wallet provider actually do in eIDAS 2.0?
A wallet provider is the organisation responsible for developing, distributing, and maintaining the digital identity wallet solution that end users install on their devices as a wallet instance. Under eIDAS 2.0, wallet providers must meet strict certification requirements before their wallet solution can be officially recognised across EU Member States. The legal framework is set by the European Commission through implementing acts, while certification and notification are carried out by the relevant national competent authorities in each Member State.
In practical terms, the wallet provider handles everything related to the wallet solution itself as a secure container. This includes:
- Building and maintaining the wallet application (mobile app or other interface)
- Ensuring the wallet solution meets the technical specifications elaborated in the Architecture and Reference Framework (ARF), which provides the technical elaboration of the requirements set out in the implementing acts
- Managing the secure storage of attestations within the wallet unit on the user’s device
- Enabling users to present attestations to relying parties (services that request identity data)
- Protecting user privacy, including selective disclosure so users only share what is necessary
- Obtaining and maintaining official wallet certification
Wallet providers can be governments, public bodies, or private companies, as long as they are officially recognised by their Member State. Each EU Member State is legally required to make at least one certified wallet available to its citizens and residents by 24 December 2026. This is a legal deadline, not a guarantee that every national wallet will have reached the same level of maturity or that every cross-border use case will be fully operational throughout Europe on that date. Practical interoperability and national rollout are expected to develop in phases. Public authorities and public service providers must also accept notified wallets as a means of identification from that date. The wallet solution itself does not contain identity data by default. It is an empty, secure container until attestations are issued into it.
What is the role of an issuer under eIDAS 2.0?
An issuer is the organisation that creates and provides attestations to a user’s EUDI Wallet. These attestations are cryptographically signed digital documents that prove something about the holder, such as their nationality, age, professional qualification, or bank account ownership. The issuer takes responsibility for the accuracy of the data it puts into an attestation.
Issuers come from many different sectors. A government agency might issue a digital national ID or driving licence. A bank might issue an attestation confirming a customer’s identity has been verified to KYC standards. A university might issue a diploma attestation. A healthcare authority might issue a prescription or professional registration attestation.
For an organisation to act as an issuer under eIDAS 2.0, it must be listed on the relevant national trusted list so that relying parties can verify the attestation’s origin and authenticity. The attestation itself follows the technical standards elaborated in the ARF in line with the applicable implementing acts, using credential formats such as mdoc or SD-JWT VC. This means the issuer’s signature on an attestation can be verified by anyone receiving it by checking it against the national trusted lists, which are brought together in the EU List of Trusted Lists (LOTL). It is worth noting, however, that full verification involves three distinct checks: verifying the issuer’s signature against the relevant national trusted list, checking the revocation status of the attestation via the issuer’s status information, and validating the wallet unit attestation to confirm that the presenting wallet instance runs on a certified wallet solution. Only the first of these checks can be performed fully offline.
Issuers in regulated sectors such as finance, government, and healthcare are particularly well-positioned to issue high-value attestations, since they already hold verified identity and qualification data about their customers or citizens. It is also important to distinguish between the types of attestation an issuer can provide: a Qualified Electronic Attestation of Attributes (QEAA) issued by a qualified trust service provider, a Public Body Electronic Attestation of Attributes (PuB-EAA) issued by or on behalf of a public body, and a non-qualified Electronic Attestation of Attributes (EAA). PuB-EAA is a separate category and is not classified as a non-qualified EAA.
How do wallet providers and issuers interact in practice?
Wallet providers and issuers interact through a standardised attestation issuance flow. The user requests an attestation from an issuer, the issuer authenticates the user, creates the signed attestation, and delivers it directly into the user’s wallet unit via a standardised protocol such as OID4VCI. From that point on, the user holds the attestation and can present it to any relying party without involving the issuer in each transaction.
Here is how the process typically unfolds step by step:
- The user opens their certified EUDI Wallet instance and requests an attestation from an issuer (for example, a government portal or a bank).
- The issuer authenticates the user using an existing verified identity, such as a national eID or a prior KYC check.
- The issuer generates the attestation, signs it cryptographically, and sends it to the user’s wallet unit via OID4VCI.
- The wallet unit stores the attestation securely, with private keys held within the Wallet Secure Cryptographic Device.
- When the user needs to prove something to a service (a relying party), they approve the presentation of the relevant attestation from their wallet, which is transmitted via OID4VP.
- The relying party verifies the attestation’s signature against the issuer’s entry on the relevant national trusted list, checks the attestation’s revocation status, and validates the wallet unit attestation to confirm the wallet solution is certified.
This separation of roles is intentional. It means the issuer is not involved in every transaction, which supports user privacy and reduces the issuer’s operational burden. The wallet provider ensures the secure handling of attestations on the user’s side. Neither party sees what the user does with their attestations after issuance. If a user moves to a new device, attestations cannot simply be copied across, since private keys do not leave the Wallet Secure Cryptographic Device. The issuer must support re-issuance in that case.
Can the same organisation be both a wallet provider and an issuer?
Yes, the same organisation can hold both roles simultaneously, but only if it meets the separate requirements for each role independently. Being a certified wallet provider does not automatically qualify an organisation to act as an issuer, and vice versa. Each role carries its own technical, legal, and operational obligations under eIDAS 2.0.
In practice, some government bodies are positioned to do both. A national government might operate the official EUDI Wallet solution for its citizens while also issuing government-backed attestations such as national ID documents or driving licences. Similarly, a large financial institution could theoretically operate a recognised wallet solution and issue KYC attestations, though this would require significant investment in certification for both roles separately.
For most organisations, taking on both roles at once is neither practical nor necessary. The more common approach is to focus on the role that aligns with existing capabilities and regulatory position. A government body with existing eID infrastructure is a natural issuer. A technology company with experience in secure mobile applications might pursue wallet provider certification. Choosing the right focus is a strategic decision that benefits from a clear picture of your obligations and technical starting point.
Which role is most relevant for your organisation to consider?
The most relevant role depends on the type of data your organisation holds, your regulatory position, and your relationship with end users. Organisations that hold verified, high-value data about individuals are natural candidates for the issuer role. Organisations building secure digital infrastructure or mobile platforms may be better suited to the wallet provider path.
A few questions help clarify which role fits:
- Do you already verify identities or hold trusted data about individuals? If yes, the issuer role is likely the more natural fit. Banks, insurers, government agencies, healthcare providers, and educational institutions all sit in this category.
- Do you build or operate secure digital applications at scale? If yes, and if you have the capacity for the certification processes required by your national competent authority, the wallet provider role may be worth exploring.
- Are you primarily a service that needs to accept identity data from users? If so, you are most likely a relying party. Under CIR (EU) 2025/848, adopted on 6 May 2025, relying parties must register with the national authority of their Member State of establishment before requesting wallet data, and must specify per intended use which attributes and attestations they will request. The wallet checks each presentation request against this registered scope. Note that relying party registration applies within the EUDI Wallet framework and does not replace other applicable national registration requirements.
For organisations in regulated sectors, including government, healthcare, banking and financial services, telecoms, energy, transport, education, and digital services, the issuer role offers a direct path to providing users with reusable, trusted attestations that reduce friction across digital services. It is worth noting that attestations issued in one Member State may carry different legal consequences in another depending on sector-specific legislation, and that not every attestation will automatically have the same legal effect in every jurisdiction. Recognition of professional qualifications, for example, continues to be governed by Directive 2005/36/EC.
Many organisations will not take on either the wallet provider or issuer role directly. They will integrate with existing wallet infrastructure and work with established issuers to accept attestations. This is a valid and often the most efficient path, particularly for organisations that need to comply with eIDAS 2.0 without building identity infrastructure from scratch. Certain regulated private-sector organisations covered by Article 5f of eIDAS 2.0, which amends Regulation (EU) 910/2014, are required to accept notified EUDI Wallets where strong user authentication is legally or contractually required. This obligation applies from 24 December 2027 and covers banks, healthcare providers, telecoms operators, energy suppliers, transport providers, postal services, social security bodies, drinking water providers, digital infrastructure providers, and digital service providers. Micro and small enterprises, defined as organisations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros, are exempt. Very large online platforms (VLOPs) with more than 45 million users in the EU are covered by a separate provision of Article 5f: for VLOPs the obligation applies where the platform requires user authentication, on the voluntary request of the user and for the minimum necessary data, without the condition of legally or contractually required strong authentication.
How TrustTech supports wallet providers and issuers
TrustTech’s ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organisations working out their position in the eIDAS 2.0 ecosystem, whether as an issuer preparing to deliver attestations into certified wallets, or as a relying party preparing to accept them, the ID Connector handles the technical layer that connects both sides. Specifically, the ID Connector covers:
- Accepting every notified EUDI Wallet, regardless of the issuing Member State
- Verification of issuer signatures against national trusted lists, brought together in the EU List of Trusted Lists
- Revocation status checks via issuer-provided status information
- Validation of wallet unit attestations to confirm a presenting wallet runs on a certified wallet solution
- Enforcement of the registered attribute scope as required under CIR (EU) 2025/848
- Reuse of verified identity data across identification, login, and qualified signing flows
- Qualified signing via a connected qualified trust service provider
This applies across financial services, healthcare, pharma, and government, where high-assurance attestations and reliable verification are central to compliance. Ready to see what the ID Connector does for your specific setup? Get in touch with TrustTech.