---
title: "The EU Digital Identity Wallet: who must accept it, and…"
description: "What the amended eIDAS Regulation requires of Member States, relying parties and online platforms around the European Digital Identity Wallet, and how the…"
url: https://pitch.law/academy/eu-digital-identity-wallet
---

[pitch](https://pitch.law/) [Academy](https://pitch.law/academy) [Data](https://pitch.law/academy/topics/information-technology)

# The EU Digital Identity Wallet: who must accept it, and what it means for KYC

What the amended eIDAS Regulation requires of Member States, relying parties and online platforms around the European Digital Identity Wallet, and how the wallet fits customer due diligence under the new Anti-Money Laundering Regulation.

- - By [Bart Lieben](https://pitch.law/team/bart-lieben), Attorney-at-Law
  - 13 November 2026

- Updated

  13-11-2026

## The legal framework

The European Digital Identity Wallet is a creation of [Regulation (EU) 2024/1183](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1183) of 11 April 2024. That regulation amends the eIDAS Regulation, [Regulation (EU) No 910/2014](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32014R0910), and establishes what it calls the European Digital Identity Framework. It was published in the Official Journal on 30 April 2024 and entered into force on 20 May 2024. The new rules sit inside eIDAS itself, so the easiest way to read them is the [consolidated eIDAS text](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02014R0910-20241018). The article numbers below are those of eIDAS as amended.

### What the wallet is

Each Member State must provide at least one wallet ([Article 5a(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02014R0910-20241018#art_5a)). It can do so directly, under a mandate, or by recognising a wallet built independently of the State (Article 5a(2)). The source code of the application components must be open-source licensed (Article 5a(3)).

Under Article 5a(4) the wallet lets its user, among other things:

- request, store, select, combine and share person identification data and electronic attestations of attributes, online and where appropriate offline, with selective disclosure;
- generate pseudonyms, stored encrypted and locally;
- see a log of all transactions in a common dashboard, ask a relying party to erase personal data under Article 17 GDPR, and report a relying party to the data protection authority;
- sign with qualified electronic signatures or seal with qualified electronic seals;
- download their data and exercise data portability.

The wallet must be provided under an electronic identification scheme with assurance level high (Article 5a(11)). Issuance, use and revocation are free of charge for natural persons (Article 5a(13)), and natural persons can sign with qualified electronic signatures by default and free of charge, although Member States may limit free use to non-professional purposes (Article 5a(5)(g)). Use is voluntary. Nobody may be refused or disadvantaged for not using a wallet, and other identification means must remain available (Article 5a(15)). The wallet provider may not collect usage information it does not need, and must keep wallet data logically separate from its other data (Article 5a(14)). Wallets are certified by conformity assessment bodies, for up to five years, with a vulnerability assessment every two years ([Article 5c](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02014R0910-20241018#art_5c)). Wallets must also be accessible for persons with disabilities in line with the European Accessibility Act (Article 5a(21)).

### When wallets must be available

The text does not give a calendar date. Member States must provide a wallet "within 24 months of the date of entry into force of the implementing acts" referred to in Article 5a(23) and Article 5c(6). The Commission adopted a first set of implementing regulations on 28 November 2024, published on 4 December 2024 and each in force on the twentieth day after publication: [2024/2977](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2977) on person identification data and attestations, [2024/2979](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2979) on integrity and core functionalities, [2024/2980](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2980) on notifications, [2024/2981](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2981) on certification (under Article 5c(6)) and [2024/2982](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2982) on protocols and interfaces. Because the deadlines run from "the implementing acts" and not from a fixed day, check the Commission's announcements before you plan around a specific date.

### Who must accept the wallet

This is the part that matters for most businesses. [Article 5f](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02014R0910-20241018#art_5f) sets out three groups.

- **Public sector bodies (Article 5f(1)).** Where a Member State requires electronic identification and authentication to access an online public service, it must also accept the wallet.
- **Private relying parties that need strong authentication (Article 5f(2)).** A private party must accept the wallet if it is required by Union or national law, or by contract, to use strong user authentication for online identification. The text names, by way of example, transport, energy, banking, financial services, social security, health, drinking water, postal services, digital infrastructure, education and telecommunications. The duty applies "no later than 36 months" from the entry into force of the same implementing acts, and "only upon the voluntary request of the user". Micro and small enterprises within the meaning of Commission Recommendation 2003/361/EC are excluded.
- **Very large online platforms (Article 5f(3)).** Where a very large online platform under Article 33 of the Digital Services Act requires user authentication, it must also accept and facilitate the wallet, at the user's voluntary request and only for the minimum data necessary for that service.

Any other business may choose to accept the wallet. If it does, the relying-party rules below apply.

### Duties of relying parties

A relying party is the business or body that relies on the wallet to provide a service. Under [Article 5b](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02014R0910-20241018#art_5b):

- it must register in the Member State where it is established (Article 5b(1));
- the registration states at least its name, Member State, registration number where applicable, contact details and the intended use of the wallet, including the data it will request (Article 5b(2));
- it may not ask users for any data beyond what it registered (Article 5b(3));
- it must report changes to its registration without delay (Article 5b(6));
- it must identify itself to the user (Article 5b(8));
- it is responsible for authenticating and validating the data it requests, and may not refuse pseudonyms where Union or national law does not require identification (Article 5b(9));
- an intermediary acting for a relying party counts as a relying party and may not store data about the content of the transaction (Article 5b(10)).

Member States publish the registration information online (Article 5b(5)), and users can check a relying party's identity through the free validation mechanisms of Article 5a(8).

### Attestations of attributes

The wallet does not only hold identity data. It can also hold electronic attestations of attributes: a diploma, a licence, a power of representation, proof of age. Under [Article 45b](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02014R0910-20241018#art_45b) such an attestation cannot be denied legal effect only because it is electronic. A qualified attestation, or one issued by or for a public body responsible for an authentic source, has the same legal effect as a lawfully issued paper attestation, and a public-sector attestation from one Member State is recognised in all others. Providers of attestations must let wallet users obtain and manage them wherever the wallet was issued (Article 45g) and may not combine the related personal data with data from their other services (Article 45h).

### KYC under the Anti-Money Laundering Regulation

[Regulation (EU) 2024/1624](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1624), the AMLR, applies from 10 July 2027 ([Article 90](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1624#art_90)), with a later date of 10 July 2029 for two categories of obliged entities. Obliged entities must apply customer due diligence in the situations of [Article 19](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1624#art_19), such as when establishing a business relationship, and the measures of [Article 20](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1624#art_20) start with identifying the customer and verifying their identity.

[Article 22(6)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1624#art_22) gives two ways to verify identity: an identity document, passport or equivalent, with information from reliable and independent sources where relevant, or "the use of electronic identification means which meet the requirements of Regulation (EU) No 910/2014 with regard to the assurance levels 'substantial' or 'high' and relevant qualified trust services". The wallet is provided at assurance level high (Article 5a(11) eIDAS), so it fits the second route. The AMLR does not name the wallet by name, and it does not oblige a bank or other obliged entity to use it. Banks and financial institutions that need strong user authentication fall under the acceptance duty in Article 5f(2) eIDAS, at the user's request. The recitals add that eIDAS identification should be taken into account and accepted for customer identification.

Where an obliged entity relies on another obliged entity for due diligence, the documents it can request include data obtained through electronic identification means and relevant trust services under eIDAS ([Article 49(2)(b)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1624#art_49)).

### Age verification

[Commission Recommendation (EU) 2026/1035](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32026H1035) of 29 April 2026 recommends that Member States make an EU age verification solution available by 31 December 2026, either integrated in the wallet or as a stand-alone application, or both (point 5). A recommendation does not bind businesses, but it shows that proof of age is expected to run on the same attestation model.

## In practice

A Belgian energy supplier lets customers sign in with two-factor authentication because its contracts require it. That is strong user authentication required by contract, so once the Article 5f(2) deadline is reached it must also accept the wallet when a customer asks to use it. It keeps its existing login for everyone else, since use of the wallet is voluntary.

A ten-person software start-up wants to let customers prove their age with the wallet. It is a small enterprise, so the acceptance duty does not apply, but as soon as it chooses to rely on wallets it must register, declare which data it will ask for and stick to that list.

A payment institution onboards customers remotely. From 10 July 2027 the AMLR lets it verify identity through eIDAS identification means at assurance level substantial or high. A wallet presentation can be one of those means, as an alternative to an identity document for customers who choose it. The institution still has to identify beneficial owners, check sanctions and keep records under Articles 20 and 22.

### Contract and compliance checklist

- Determine whether you are caught by Article 5f(2): do law or your contracts require strong user authentication for online identification? Check your size against Recommendation 2003/361/EC.
- If you will accept the wallet, prepare the registration: intended use and the exact list of data per use case. Your request flows may not ask for more.
- Update the privacy notice and the record of processing. Wallet users see every request in their dashboard and can report you to the authority directly.
- Run a data protection impact assessment where you combine wallet data with profiling or large-scale processing.
- Review contracts with identity verification and onboarding providers. An intermediary counts as a relying party and may not store transaction content (Article 5b(10)), so the contract should reflect that, next to the data processing terms under Article 28 GDPR.
- For AML onboarding, write the wallet route into your AML policies and risk assessment before 10 July 2027.

## Frequently asked questions

### Must every business accept the wallet?

No. Public bodies, private parties that must use strong user authentication by law or contract (other than micro and small enterprises), and very large online platforms that require authentication must accept it. Everyone else may choose to. In all cases the user decides whether to use the wallet.

### Can we refuse customers who do not have a wallet?

No. Article 5a(15) says access to public and private services may not be restricted or made disadvantageous for people who do not use a wallet, and other identification means must remain possible.

### Is a wallet presentation enough for KYC?

It covers identity verification under Article 22(6)(b) AMLR if it meets assurance level substantial or high, which the wallet does by design. It does not replace the rest of due diligence: beneficial ownership, purpose of the relationship, sanctions and politically exposed person checks and ongoing monitoring remain.

## How this connects

The wallet changes how you identify customers, which ties in with [sanctions screening and anti-money laundering](https://pitch.law/academy/sanctions-screening-and-anti-money-laundering-what-every-business-needs-to-know). For companies, the same building blocks return in the proposed [European Business Wallets](https://pitch.law/academy/european-business-wallets). We help you decide whether you must accept the wallet, and prepare the registration, privacy notice and records as part of our [DPO as a service](https://pitch.law/solutions/dpo-as-a-service). Contracts with onboarding and identity providers belong in [data processing agreements](https://pitch.law/solutions/data-processing-agreements) and [commercial contracts and transactions](https://pitch.law/solutions/commercial-contracts-transactions). Our [Data Protection Impact Assessment](https://pitch.law/technologies/digital-data-protection-impact-assessment) tool structures the risk analysis, and the [records of processing and compliance registers](https://pitch.law/technologies/privacy-register) document what you collect through the wallet.

> **Cited provisions.** eIDAS Regulation (EU) No 910/2014 as amended by Regulation (EU) 2024/1183: Articles 5a, 5b, 5c, 5f, 45b, 45g and 45h. Implementing Regulations (EU) 2024/2977, 2024/2979, 2024/2980, 2024/2981 and 2024/2982. AMLR (EU) 2024/1624: Articles 19, 20, 22(6), 49(2) and 90. Commission Recommendation (EU) 2026/1035, point 5.
>
> **Key dates.** 20 May 2024: Regulation (EU) 2024/1183 in force. 4 December 2024: first wallet implementing regulations published. Wallets: within 24 months of the entry into force of the implementing acts under Articles 5a(23) and 5c(6). Private acceptance: within 36 months of that date. 31 December 2026: recommended date for an EU age verification solution. 10 July 2027: AMLR applies.
>
> **Further reading.** [European Business Wallets](https://pitch.law/academy/european-business-wallets) · [Sanctions screening and anti-money laundering](https://pitch.law/academy/sanctions-screening-and-anti-money-laundering-what-every-business-needs-to-know)

## In short

- Who must accept the wallet, and who may choose to
- Registration and data limits for relying parties
- The wallet as an identification means for KYC under the AMLR
- Attestations of attributes and their legal effect
- Dates and deadlines as set out in the texts

## Related solutions

- [Solutions](https://pitch.law/solutions/dpo-as-a-service)
  ### [Data Protection Officer as a Service](https://pitch.law/solutions/dpo-as-a-service)
  [An external Data Protection Officer who advises, monitors and documents your GDPR compliance, with a register, calendar and portal behind the advice.](https://pitch.law/solutions/dpo-as-a-service)
- [Solutions](https://pitch.law/solutions/data-processing-agreements)
  ### [Data Processing Agreements](https://pitch.law/solutions/data-processing-agreements)
  [Article 28 GDPR agreements drafted, reviewed and negotiated for controllers and processors, including sub-processors and international transfers.](https://pitch.law/solutions/data-processing-agreements)
- [Solutions](https://pitch.law/solutions/commercial-contracts-transactions)
  ### [Commercial Contracts & Transactions](https://pitch.law/solutions/commercial-contracts-transactions)
  [Supply, distribution, services, SaaS and procurement contracts, and the deals around them, drafted and reviewed with the IP, data and tax angles in view.](https://pitch.law/solutions/commercial-contracts-transactions)

## Our proprietary Legal Tech

- [Technology](https://pitch.law/technologies/digital-data-protection-impact-assessment)
  ### [Data Protection Impact Assessment](https://pitch.law/technologies/digital-data-protection-impact-assessment)
  [Guided data protection impact assessments, kept as working records that you and your attorney complete together in the client portal.](https://pitch.law/technologies/digital-data-protection-impact-assessment)
- [Technology](https://pitch.law/technologies/privacy-register)
  ### [Records of Processing and Compliance Registers](https://pitch.law/technologies/privacy-register)
  [One register engine for the GDPR record of processing activities and for the AI Act, NIS2 and DORA registers, with article references, evidence and attorney or DPO approval.](https://pitch.law/technologies/privacy-register)

## More in Data

- ### [Children Online: the EU KIDS Act Proposal and Age Verification](https://pitch.law/academy/children-online-kids-act-and-age-verification)
  [What the Digital Services Act already requires to protect minors, what the EU KIDS Act proposal of 17 September 2026 would add for social networks, video platforms, games, app stores and chatbots, and how the EU age verification framework fits in.](https://pitch.law/academy/children-online-kids-act-and-age-verification)
- ### [The Cloud and AI Development Act: sovereignty rules for cloud and AI procurement](https://pitch.law/academy/cloud-and-ai-development-act)
  [What the Commission's proposal for a Cloud and AI Development Act would require of cloud providers that sell to the public sector, of contracting authorities, and of bidders for cloud and AI contracts, and how it sits next to the Data Act and the procurement Directive.](https://pitch.law/academy/cloud-and-ai-development-act)
- ### [Cyber Resilience Act III: importers, distributors, open source and contracts](https://pitch.law/academy/cyber-resilience-act-importers-distributors-open-source)
  [The duties of importers, distributors and authorised representatives under Articles 18 to 23 of Regulation (EU) 2024/2847, when a reseller becomes a manufacturer, how free and open-source software and its stewards are treated, and the clauses that follow.](https://pitch.law/academy/cyber-resilience-act-importers-distributors-open-source)
- ### [Cyber Resilience Act I: which products are caught, and in which class](https://pitch.law/academy/cyber-resilience-act-products-and-classes)
  [How to tell whether hardware or software you sell falls under Regulation (EU) 2024/2847, whether it is a default, important (class I or II) or critical product, and which conformity route follows from that, with the dates up to 11 December 2027.](https://pitch.law/academy/cyber-resilience-act-products-and-classes)
- ### [Cyber Resilience Act II: vulnerability handling and reporting since 11-09-2026](https://pitch.law/academy/cyber-resilience-act-vulnerability-handling-and-reporting)
  [What manufacturers must report under Article 14 of Regulation (EU) 2024/2847 since 11 September 2026, within 24 hours, 72 hours, 14 days and one month, and the vulnerability handling duties of Annex I, Part II, that follow from 11 December 2027.](https://pitch.law/academy/cyber-resilience-act-vulnerability-handling-and-reporting)
- ### [Cyber incidents across borders: the Cyber Solidarity Act](https://pitch.law/academy/cyber-solidarity-act)
  [What Regulation (EU) 2025/38 sets up, the European Cybersecurity Alert System, the Cybersecurity Emergency Mechanism with the EU Cybersecurity Reserve and the incident review mechanism, how a company hit by a major incident can benefit, and what it means for managed security service providers.](https://pitch.law/academy/cyber-solidarity-act)

## Let’s talk

Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free.

[Schedule a meeting](https://pitch.law/schedule)