The EU Digital Identity Wallet: who must accept it, and what it means for KYC

The legal framework

The European Digital Identity Wallet is a creation of Regulation (EU) 2024/1183 of 11 April 2024. That regulation amends the eIDAS Regulation, Regulation (EU) No 910/2014, and establishes what it calls the European Digital Identity Framework. It was published in the Official Journal on 30 April 2024 and entered into force on 20 May 2024. The new rules sit inside eIDAS itself, so the easiest way to read them is the consolidated eIDAS text. The article numbers below are those of eIDAS as amended.

What the wallet is

Each Member State must provide at least one wallet (Article 5a(1)). It can do so directly, under a mandate, or by recognising a wallet built independently of the State (Article 5a(2)). The source code of the application components must be open-source licensed (Article 5a(3)).

Under Article 5a(4) the wallet lets its user, among other things:

• request, store, select, combine and share person identification data and electronic attestations of attributes, online and where appropriate offline, with selective disclosure;
• generate pseudonyms, stored encrypted and locally;
• see a log of all transactions in a common dashboard, ask a relying party to erase personal data under Article 17 GDPR, and report a relying party to the data protection authority;
• sign with qualified electronic signatures or seal with qualified electronic seals;
• download their data and exercise data portability.

The wallet must be provided under an electronic identification scheme with assurance level high (Article 5a(11)). Issuance, use and revocation are free of charge for natural persons (Article 5a(13)), and natural persons can sign with qualified electronic signatures by default and free of charge, although Member States may limit free use to non-professional purposes (Article 5a(5)(g)). Use is voluntary. Nobody may be refused or disadvantaged for not using a wallet, and other identification means must remain available (Article 5a(15)). The wallet provider may not collect usage information it does not need, and must keep wallet data logically separate from its other data (Article 5a(14)). Wallets are certified by conformity assessment bodies, for up to five years, with a vulnerability assessment every two years (Article 5c). Wallets must also be accessible for persons with disabilities in line with the European Accessibility Act (Article 5a(21)).

When wallets must be available

The text does not give a calendar date. Member States must provide a wallet "within 24 months of the date of entry into force of the implementing acts" referred to in Article 5a(23) and Article 5c(6). The Commission adopted a first set of implementing regulations on 28 November 2024, published on 4 December 2024 and each in force on the twentieth day after publication: 2024/2977 on person identification data and attestations, 2024/2979 on integrity and core functionalities, 2024/2980 on notifications, 2024/2981 on certification (under Article 5c(6)) and 2024/2982 on protocols and interfaces. Because the deadlines run from "the implementing acts" and not from a fixed day, check the Commission's announcements before you plan around a specific date.

Who must accept the wallet

This is the part that matters for most businesses. Article 5f sets out three groups.

• Public sector bodies (Article 5f(1)). Where a Member State requires electronic identification and authentication to access an online public service, it must also accept the wallet.
• Private relying parties that need strong authentication (Article 5f(2)). A private party must accept the wallet if it is required by Union or national law, or by contract, to use strong user authentication for online identification. The text names, by way of example, transport, energy, banking, financial services, social security, health, drinking water, postal services, digital infrastructure, education and telecommunications. The duty applies "no later than 36 months" from the entry into force of the same implementing acts, and "only upon the voluntary request of the user". Micro and small enterprises within the meaning of Commission Recommendation 2003/361/EC are excluded.
• Very large online platforms (Article 5f(3)). Where a very large online platform under Article 33 of the Digital Services Act requires user authentication, it must also accept and facilitate the wallet, at the user's voluntary request and only for the minimum data necessary for that service.

Any other business may choose to accept the wallet. If it does, the relying-party rules below apply.

Duties of relying parties

A relying party is the business or body that relies on the wallet to provide a service. Under Article 5b:

• it must register in the Member State where it is established (Article 5b(1));
• the registration states at least its name, Member State, registration number where applicable, contact details and the intended use of the wallet, including the data it will request (Article 5b(2));
• it may not ask users for any data beyond what it registered (Article 5b(3));
• it must report changes to its registration without delay (Article 5b(6));
• it must identify itself to the user (Article 5b(8));
• it is responsible for authenticating and validating the data it requests, and may not refuse pseudonyms where Union or national law does not require identification (Article 5b(9));
• an intermediary acting for a relying party counts as a relying party and may not store data about the content of the transaction (Article 5b(10)).

Member States publish the registration information online (Article 5b(5)), and users can check a relying party's identity through the free validation mechanisms of Article 5a(8).

Attestations of attributes

The wallet does not only hold identity data. It can also hold electronic attestations of attributes: a diploma, a licence, a power of representation, proof of age. Under Article 45b such an attestation cannot be denied legal effect only because it is electronic. A qualified attestation, or one issued by or for a public body responsible for an authentic source, has the same legal effect as a lawfully issued paper attestation, and a public-sector attestation from one Member State is recognised in all others. Providers of attestations must let wallet users obtain and manage them wherever the wallet was issued (Article 45g) and may not combine the related personal data with data from their other services (Article 45h).

KYC under the Anti-Money Laundering Regulation

Regulation (EU) 2024/1624, the AMLR, applies from 10 July 2027 (Article 90), with a later date of 10 July 2029 for two categories of obliged entities. Obliged entities must apply customer due diligence in the situations of Article 19, such as when establishing a business relationship, and the measures of Article 20 start with identifying the customer and verifying their identity.

Article 22(6) gives two ways to verify identity: an identity document, passport or equivalent, with information from reliable and independent sources where relevant, or "the use of electronic identification means which meet the requirements of Regulation (EU) No 910/2014 with regard to the assurance levels 'substantial' or 'high' and relevant qualified trust services". The wallet is provided at assurance level high (Article 5a(11) eIDAS), so it fits the second route. The AMLR does not name the wallet by name, and it does not oblige a bank or other obliged entity to use it. Banks and financial institutions that need strong user authentication fall under the acceptance duty in Article 5f(2) eIDAS, at the user's request. The recitals add that eIDAS identification should be taken into account and accepted for customer identification.

Where an obliged entity relies on another obliged entity for due diligence, the documents it can request include data obtained through electronic identification means and relevant trust services under eIDAS (Article 49(2)(b)).

Age verification

Commission Recommendation (EU) 2026/1035 of 29 April 2026 recommends that Member States make an EU age verification solution available by 31 December 2026, either integrated in the wallet or as a stand-alone application, or both (point 5). A recommendation does not bind businesses, but it shows that proof of age is expected to run on the same attestation model.

In practice

A Belgian energy supplier lets customers sign in with two-factor authentication because its contracts require it. That is strong user authentication required by contract, so once the Article 5f(2) deadline is reached it must also accept the wallet when a customer asks to use it. It keeps its existing login for everyone else, since use of the wallet is voluntary.

A ten-person software start-up wants to let customers prove their age with the wallet. It is a small enterprise, so the acceptance duty does not apply, but as soon as it chooses to rely on wallets it must register, declare which data it will ask for and stick to that list.

A payment institution onboards customers remotely. From 10 July 2027 the AMLR lets it verify identity through eIDAS identification means at assurance level substantial or high. A wallet presentation can be one of those means, as an alternative to an identity document for customers who choose it. The institution still has to identify beneficial owners, check sanctions and keep records under Articles 20 and 22.

Contract and compliance checklist

• Determine whether you are caught by Article 5f(2): do law or your contracts require strong user authentication for online identification? Check your size against Recommendation 2003/361/EC.
• If you will accept the wallet, prepare the registration: intended use and the exact list of data per use case. Your request flows may not ask for more.
• Update the privacy notice and the record of processing. Wallet users see every request in their dashboard and can report you to the authority directly.
• Run a data protection impact assessment where you combine wallet data with profiling or large-scale processing.
• Review contracts with identity verification and onboarding providers. An intermediary counts as a relying party and may not store transaction content (Article 5b(10)), so the contract should reflect that, next to the data processing terms under Article 28 GDPR.
• For AML onboarding, write the wallet route into your AML policies and risk assessment before 10 July 2027.

Frequently asked questions

Must every business accept the wallet?

No. Public bodies, private parties that must use strong user authentication by law or contract (other than micro and small enterprises), and very large online platforms that require authentication must accept it. Everyone else may choose to. In all cases the user decides whether to use the wallet.

Can we refuse customers who do not have a wallet?

No. Article 5a(15) says access to public and private services may not be restricted or made disadvantageous for people who do not use a wallet, and other identification means must remain possible.

Is a wallet presentation enough for KYC?

It covers identity verification under Article 22(6)(b) AMLR if it meets assurance level substantial or high, which the wallet does by design. It does not replace the rest of due diligence: beneficial ownership, purpose of the relationship, sanctions and politically exposed person checks and ongoing monitoring remain.

How this connects

The wallet changes how you identify customers, which ties in with sanctions screening and anti-money laundering. For companies, the same building blocks return in the proposed European Business Wallets. We help you decide whether you must accept the wallet, and prepare the registration, privacy notice and records as part of our DPO as a service. Contracts with onboarding and identity providers belong in data processing agreements and commercial contracts and transactions. Our Data Protection Impact Assessment tool structures the risk analysis, and the records of processing and compliance registers document what you collect through the wallet.

Cited provisions. eIDAS Regulation (EU) No 910/2014 as amended by Regulation (EU) 2024/1183: Articles 5a, 5b, 5c, 5f, 45b, 45g and 45h. Implementing Regulations (EU) 2024/2977, 2024/2979, 2024/2980, 2024/2981 and 2024/2982. AMLR (EU) 2024/1624: Articles 19, 20, 22(6), 49(2) and 90. Commission Recommendation (EU) 2026/1035, point 5.

Key dates. 20 May 2024: Regulation (EU) 2024/1183 in force. 4 December 2024: first wallet implementing regulations published. Wallets: within 24 months of the entry into force of the implementing acts under Articles 5a(23) and 5c(6). Private acceptance: within 36 months of that date. 31 December 2026: recommended date for an EU age verification solution. 10 July 2027: AMLR applies.

Further reading. European Business Wallets · Sanctions screening and anti-money laundering