Under eIDAS 2.0, which amends Regulation (EU) 910/2014 through Regulation (EU) 2024/1183, offline identity verification works through a proximity flow where the EUDI Wallet presents cryptographically signed attestations directly to a verifier’s device using short-range communication technologies such as Bluetooth Low Energy (BLE) or NFC, with no internet connection required. This approach is elaborated in the Architecture and Reference Framework (ARF), which provides the technical foundation for how EUDI Wallets must function across all EU Member States. The legally binding requirements are set out in the implementing acts adopted by the European Commission. The sections below unpack how this works in practice, which standards are involved, and what organizations need to do to support it.
How does the EUDI Wallet verify identity without an internet connection?
The EUDI Wallet verifies identity offline by presenting digitally signed attestations stored on the user’s device directly to a verifier using proximity protocols. For issuer signature verification, the verifier checks the cryptographic signature against the issuer’s public key, which can be retrieved from the relevant national trusted list or cached locally in advance. This makes verification fast and functional in environments where connectivity is limited or unavailable, though not all verification steps can be completed fully offline.
In practical terms, the wallet holder initiates a proximity flow by opening their EUDI Wallet app and sharing a specific attestation, such as a mobile driving licence or a national identity attribute, with a nearby reader device. The transfer happens over BLE or NFC, both of which operate without internet. The receiving device checks the attestation’s tamper-evident integrity using the issuer’s public key and verifies that the attestation has not been altered since it was issued.
This design reflects a deliberate architectural choice. Because the EUDI Wallet is intended to work in everyday physical settings, such as at a border crossing, a pharmacy counter, or a roadside check, relying solely on online verification would make it impractical. The offline flow ensures the wallet remains functional even in areas with poor connectivity or in scenarios where real-time server calls are not feasible.
What standards and protocols underpin eIDAS 2.0 offline verification?
eIDAS 2.0 offline verification relies on a combination of international standards that govern how attestations are structured, transferred, and verified in proximity settings. The core standards include ISO/IEC 18013-5 for proximity presentation of identity documents, with credential formats defined as mdoc and SD-JWT VC within the ARF. These standards ensure that wallets and verifiers from different vendors and Member States can work together reliably.
ISO/IEC 18013-5 is particularly important for offline scenarios. It defines the data model and communication protocol for presenting identity documents over BLE and NFC, and it specifies how the verifier authenticates the attestation without a live connection to the issuer. This standard was originally developed for mobile driving licences and has been adopted within the EUDI Wallet framework as the reference for offline proximity flows. For online presentation, ISO/IEC TS 18013-7 and OID4VP apply. The High Assurance Interoperability Profile (HAIP) is also relevant where high-assurance interoperability is required.
The Architecture and Reference Framework (ARF), developed by the eIDAS Expert Group, brings these standards together into a coherent technical blueprint that elaborates the requirements set out in the implementing acts. It defines which protocols are mandatory, how national trusted lists must be structured so that public keys can be retrieved or cached, and how wallets must handle attestation presentation in both online and offline modes. The ARF is not itself legislation, but it provides the technical detail that organizations building verifier infrastructure need to follow in order to achieve compliance and interoperability across the EU. Note that ARF version numbers change as the framework is updated; verify the current version before publication.
What is the difference between online and offline identity verification in eIDAS 2.0?
The key difference between online and offline identity verification in eIDAS 2.0 is how and when the verifier checks the attestation’s validity. In an online flow, the verifier can query the issuer’s systems in real time to confirm that an attestation is still valid and has not been revoked. In an offline flow, the verifier relies on the cryptographic signature embedded in the attestation and any revocation information that was included at the time of issuance or cached in advance.
Online verification offers more dynamic assurance. The verifier gets a live confirmation of attestation status, which is especially valuable in high-stakes transactions such as opening a bank account or initiating a payment. The EUDI Wallet supports this through OID4VP over HTTPS, where the wallet presents attestations to a web-based verifier in real time.
Offline verification prioritizes availability and speed over real-time status checks. It is better suited to physical interactions where a quick, low-friction check is needed and where the risk profile of the transaction is manageable without live revocation data. Both flows use the same underlying attestation formats and cryptographic mechanisms, which means a single attestation issued to a wallet can be used in either context depending on the situation.
How is credential revocation handled when there is no internet connection?
Attestation revocation in offline scenarios is handled through revocation mechanisms that are embedded in the attestation itself or distributed in advance to verifiers. The most common approaches include Status List attestations and short-lived attestations, both of which allow a verifier to assess whether an attestation remains valid without contacting the issuer at the moment of verification.
A Status List is a compact, signed data structure published by the issuer that maps attestation identifiers to their current revocation status. Verifiers can download and cache this list periodically, then check it locally during an offline interaction. As long as the cached list is reasonably fresh, the verifier can make an informed decision about whether to accept an attestation.
Short-lived attestations take a different approach. Instead of relying on revocation lists, the issuer issues attestations with a very short validity period, often measured in hours or days. If an attestation needs to be revoked, the issuer simply does not reissue it. This approach is simpler to implement and avoids the need for verifiers to manage revocation data, but it requires the wallet to refresh attestations regularly, which in turn requires periodic connectivity.
The right approach depends on the use case and the acceptable risk tolerance. For high-frequency, lower-risk interactions, short-lived attestations work well. For attestations that are issued infrequently and held for longer periods, a Status List approach gives verifiers more confidence during offline checks.
It is important to note that revocation status checking is one of three distinct verification steps. The first is verifying the issuer’s signature against the relevant national trusted list, which are brought together in the EU List of Trusted Lists (LOTL). The second is checking revocation status using the issuer’s status information. The third is validating the wallet unit attestation to confirm that the presenting wallet runs on a certified wallet solution. Only the first of these can be completed fully offline using cached data. The second depends on how fresh the cached status information is, and the third may require connectivity depending on implementation.
Which use cases require offline identity verification under eIDAS 2.0?
Several everyday scenarios require offline identity verification because they take place in physical environments where internet access cannot be guaranteed. The EUDI Wallet’s large-scale pilots, which ran from April 2023 to 2025, identified a clear set of use cases where proximity flows are essential to making the wallet practical and widely usable.
- Mobile driving licence checks: A driver presenting their licence at the roadside to a police officer or car rental agent needs a fast, reliable check that works without a data connection.
- Travel document presentation: Presenting identity or travel attestations at airport security or border control, where speed and reliability are critical and connectivity may be inconsistent. Digital Travel Credentials were piloted in the large-scale pilots; this use case is not yet operationally deployed across the EU.
- Prescription dispensing: A patient presenting a digital prescription at a pharmacy counter, where the pharmacist needs to verify the attestation quickly in a physical setting.
- Age and identity verification in retail: Confirming a specific attribute, such as age for age-restricted purchases, using selective disclosure from the wallet without revealing unnecessary personal data.
- Access to social security services: Presenting attestations to access benefits or healthcare entitlements in person at a government office or healthcare facility.
What these scenarios share is that they involve a person physically present at a location where the interaction needs to be completed quickly and where a failed internet connection would be unacceptable. The healthcare sector and government services are particularly dependent on offline capability, given the nature of their in-person service delivery.
What do organizations need to implement eIDAS 2.0 offline verification?
Implementing eIDAS 2.0 offline verification requires organizations to build or integrate verifier infrastructure that supports proximity protocols, manage trust anchors and public key distribution, and align their attestation formats with the Architecture and Reference Framework. This is not a trivial undertaking, but it is achievable with the right technical foundation and a clear implementation roadmap.
Governance of the EUDI Wallet ecosystem is a shared responsibility. The European Commission sets the legal framework and adopts implementing acts. EU Member States provide or mandate wallet solutions, certify and notify them, and supervise actors within their jurisdiction. National competent authorities and registrars manage registration at the national level. Wallet providers, issuers of Person Identification Data and attestations, qualified trust service providers, and relying parties each carry distinct obligations. No single central European authority operationally manages all EUDI Wallets. Organizations planning to act as relying parties must register with the national authority of their Member State of establishment under CIR (EU) 2025/848, adopted on 6 May 2025, before requesting wallet data. Registration is per intended use, specifying which attributes and attestations will be requested, and the wallet checks requests against this registered scope.
At a minimum, organizations acting as verifiers need the following:
- Proximity-capable reader devices or apps that support BLE and NFC communication and can interpret attestation formats defined in ISO/IEC 18013-5, including mdoc and SD-JWT VC formats as specified in the ARF.
- A local cache of trusted list data that allows the verifier to validate issuer signatures offline, drawn from the relevant national trusted lists and the EU List of Trusted Lists (LOTL).
- Revocation data management, either through periodic synchronization of Status Lists or a policy decision on acceptable attestation validity windows, with the understanding that revocation checking may not be fully offline in all scenarios.
- Staff training and process integration, so that the people operating verifier devices understand how to interpret results and handle edge cases such as expired or unverifiable attestations.
- Compliance with the ARF and relevant sector-specific requirements, particularly if the organization operates in a regulated sector such as finance, healthcare, or government.
Organizations that also issue attestations, such as government agencies or healthcare providers, face additional requirements around attestation lifecycle management, including how they publish revocation data and ensure their attestations are compatible with wallets from different Member States. Financial services organizations in particular need to consider how offline verification fits into their existing KYC and AML compliance frameworks, noting that sector-specific legislation continues to apply alongside the eIDAS 2.0 requirements. Relying parties do not need a qualified trust service provider (QTSP) solely to accept wallet attestations; a QTSP becomes relevant in scenarios involving qualified electronic attestations or qualified signing.
How TrustTech supports eIDAS 2.0 offline identity verification
Preparing for offline identity verification under eIDAS 2.0 involves navigating a complex combination of technical standards, regulatory requirements, and practical implementation challenges. Many organizations are still working out what the EUDI Wallet means for their existing systems and processes, and offline verification adds an additional layer of complexity that requires specialist knowledge to get right.
The legal deadline for Member States to make EUDI Wallets available is 24 December 2026. This date marks a legal obligation on Member States, not a predicted launch date or a guarantee that every national wallet will reach the same level of maturity simultaneously, or that every cross-border use case will be fully operational throughout Europe on that date. For relevant regulated private sectors, the acceptance obligation under Article 5f of eIDAS 2.0 applies from 24 December 2027. Practical interoperability and national rollout are likely to develop in phases, and organizations should plan their readiness accordingly.
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For offline verification specifically, the ID Connector handles trust management by verifying issuer signatures against national trusted lists drawn from the EU List of Trusted Lists (LOTL), checking revocation status using cached Status List data, and validating wallet unit attestations to confirm that the presenting wallet runs on a certified wallet solution. It also enforces the registered attribute scope so that only the attributes and attestations specified in the relying party’s registration under CIR (EU) 2025/848 are requested.
This is directly relevant for organizations in financial services, healthcare, pharma, and government, where offline verification scenarios are common and where compliance with both eIDAS 2.0 and sector-specific regulation must be maintained simultaneously.
Explore TrustTech’s digital identity solutions or learn more about our approach to implementation. Ready to take the next step? Get in touch with TrustTech to discuss how the ID Connector can support your eIDAS 2.0 offline verification needs.