European Business Wallets

The legal framework

Status

On 19 November 2025 the European Commission proposed a Regulation on the establishment of European Business Wallets, reference COM(2025) 838 final, procedure 2025/0358(COD). It is a proposal under the ordinary legislative procedure. Nothing in it binds anyone yet, and the article numbers below are those of the proposal. They may change before adoption.

In the European Parliament the file sits with the Committee on Industry, Research and Energy (ITRE). The committee voted on 10 September 2026 and tabled its report (A10-0240/2026) on 23 September 2026. Its decision to enter interinstitutional negotiations was announced in plenary on 5 October 2026 and confirmed by plenary on 7 October 2026. The Legislative Observatory shows the stage as "Awaiting Parliament's position in 1st reading".

The proposal builds on the eIDAS Regulation, Regulation (EU) No 910/2014, as amended by Regulation (EU) 2024/1183.

What a European Business Wallet is

Article 3(1) defines the wallet as a digital solution that lets its owner securely store, manage and present its identification data and electronic attestations of attributes. The owner uses it to authenticate and give the proofs a relying party needs, to use attestations, signatures, seals, registered delivery and time stamps, and to create, manage and delegate mandates to authorised representatives.

The owner can be an economic operator (any natural or legal person acting for purposes related to its trade, business, craft or profession) or a public sector body (Article 3(4), (5) and (7)). A sole trader is therefore an economic operator too.

The principle of equivalence (Article 4)

When an owner uses one of the core functionalities, the result has the same legal effect as if the action had been lawfully carried out in person, on paper or by any other compliant means. A sole trader using the qualified electronic registered delivery service under Article 5(3) gets the same equivalence.

Core functionalities (Article 5)

Every wallet must let its owner, among other things:

• issue, request, obtain, store, delete, share and present electronic attestations of attributes, and disclose only selected attributes (Article 5(1)(a) and (b));
• exchange identification data and attestations with other business wallets, with European Digital Identity Wallets and with relying parties (Article 5(1)(c));
• sign with qualified electronic signatures and seal with qualified electronic seals, and use qualified time stamps (Article 5(1)(d) and (e));
• issue attestations itself, including attestations linked into a chain (Article 5(1)(f) and (g));
• send and receive documents and data through a qualified electronic registered delivery service (Article 5(1)(i));
• authorise several users to operate the wallet, and manage and revoke those authorisations (Article 5(1)(j));
• authorise relying parties to request attestations, and revoke that (Article 5(1)(k));
• export all its data in a structured, commonly used and machine-readable format, on request or when the provider stops (Article 5(1)(l));
• see a log of all transactions and a common dashboard for registered communications (Article 5(1)(m) and (n)).

Providers may add functions, as long as these do not compromise the core ones (Article 5(2)). They must also offer the registered delivery service as a standalone service to users of European Digital Identity Wallets (Article 5(3)). That is the route for a self-employed person who does not need a full business wallet.

Technical features (Article 6)

Wallets must support common protocols, for example for remote onboarding by an authorised representative with an electronic identification means at assurance level "substantial" or "high" (Article 6(1)(e)) and a unique digital address per owner (Article 6(1)(j)). For delegated access, role mappings must be verifiable, auditable and revocable, and over-delegation or expired authorisations must be detected and blocked in real time (Article 6(2)(b)). A wallet can be revoked at the owner's request, after a security compromise, when the owner ceases its activity, or when the provider drops off the list (Article 6(2)(f)).

Identification data and the unique identifier (Articles 8 and 9)

Identification data are issued to the wallet by a qualified trust service provider, by a public sector body responsible for an authentic source, or by the Commission for Union entities (Article 3(3) and Article 8(1) and (3)). They contain at least the official name as recorded in the relevant register and a unique identifier (Article 8(5)). Where a company has a European Unique Identifier (EUID) under Directive (EU) 2017/1132, that EUID is used. Others receive an identifier created under an implementing act (Article 9).

The European Digital Directory (Article 10)

The Commission would run a directory with an API and a web portal, accessible only to wallet owners, their authorised representatives and wallet providers (Article 10(1) and (4)). Providers send the required information when they provide a wallet and report changes within one working day (Article 10(2) and (5)).

Providers: notification and supervision (Articles 7 and 11 to 15)

Only providers on the Commission's list may offer wallets (Article 7(1)). They must be established in the Union, have their principal place of business and main operations there and not be controlled by a third country or third-country entity (Article 7(2)). They must meet the NIS2 Directive (Directive (EU) 2022/2555) and, unless they are qualified trust service providers, the requirements of Article 19a eIDAS (Article 7(3) and (4)). Article 7(6) adds information duties towards owners and representatives, cooperation with supervisors and data transfer or deletion when a provider stops.

A provider notifies the supervisory body with its details, a description of how it offers the core functions and a declaration of conformity (Article 11(2)). Qualified trust service providers are listed without review. Others face a review of up to 30 days; silence counts as a positive outcome (Article 11(3) to (6)). The supervisory bodies already designated under Article 46a eIDAS supervise ex post (Article 13). Member States set penalties, with administrative fines for providers of up to 2% of total worldwide annual turnover in the preceding financial year (Article 13(8)).

Obligations on public sector bodies (Article 16)

This is the core of the "acceptance" chapter. By 24 months after entry into force, public sector bodies must let economic operators use the wallet's core functionalities to identify and authenticate, sign or seal, submit documents and send or receive notifications, when they meet a reporting obligation or follow an administrative procedure. For submissions and notifications, public bodies must have business wallets themselves, including the registered delivery service. Until 36 months after entry into force they may instead use existing alternatives that meet the eIDAS requirements for qualified registered delivery and offer a gateway to the wallets.

The explanatory memorandum is explicit: the proposal does not impose any obligation on economic operators to use a business wallet. Public bodies must accept it; companies choose. The review clause asks the Commission to assess, three years after entry into force, whether an obligation to use the wallets is needed (Article 21).

Third countries (Articles 17 and 18)

The Commission may recognise equivalent third-country wallets or frameworks (Article 17). EU providers may also supply wallets to operators established outside the Union, after identity proofing under Article 24(1a) eIDAS and with only one set of identification data per operator (Article 18).

Link with the EU Digital Identity Wallet (Article 20)

Article 20 would amend Article 5a eIDAS. The European Digital Identity Wallet would then be aimed at natural persons only: the words "and legal persons" disappear from Article 5a(1) and from the voluntary-use rule in Article 5a(15). Companies would use business wallets instead. We explain the personal wallet in the EU Digital Identity Wallet.

Dates

Entry into force 20 days after publication, application one year later (Article 22). Penalty rules are due within 12 months (Article 13(7)).

In practice

A Belgian manufacturer with a subsidiary in the Netherlands files annual statements, VAT returns and permit applications in both countries. With a business wallet, its finance team could sign filings with the company's qualified seal, send them through the registered delivery channel and receive the authorities' decisions in one dashboard. Each filing would have the same legal effect as a paper one.

A company gives its external accountant a mandate to file tax returns, and gives its HR officer a separate mandate for social security filings. In the wallet, the company manages both mandates, can see every action in the transaction log and can revoke a mandate the day the accountant changes (Article 5(1)(j) and (m), Article 6(2)(b)).

A freelance consultant does not need a full business wallet. Through the standalone registered delivery service in Article 5(3), the consultant can use a personal EU Digital Identity Wallet to receive official notifications from the tax administration.

Contracts and practical steps

• Choose a provider with care. The wallet would be a contract with a listed provider. Check that the provider is on the Commission's list, how it handles data export and termination (Article 5(1)(l) and Article 7(6)(f)), its security commitments and where its operations sit.
• Map who acts for the company. Mandates in the wallet should match the powers in your articles of association, board decisions and powers of attorney. Signing powers that are joint in the articles should not become individual in the wallet.
• Update internal rules. Decide who may use the company seal, who receives official notifications and how quickly someone must read them, since a notification received through the wallet would have the same legal effect as one received on paper.
• Watch your authorities. Public bodies get 24 months after entry into force. Plan your own adoption around the authorities you deal with most.

Frequently asked questions

Will we have to use a business wallet?

Under the proposal, no. The explanatory memorandum states that it does not impose any obligation on economic operators. Public sector bodies would have to accept the wallet, and the Commission would review after three years whether use should become mandatory.

Does a business wallet replace the EU Digital Identity Wallet?

They work together. The personal wallet identifies a natural person, for example the director who acts for the company. The business wallet identifies the company itself and holds its attestations, seals and mandates. Article 5(1)(c) requires the two to exchange data.

Who can offer business wallets?

Entities established in the Union that notify the supervisory body and are put on the Commission's list. Qualified trust service providers are listed without review. Where a Union entity provides wallets, the Commission supervises it (Article 15).

When could this apply?

Not before the Parliament and the Council agree a text and it is published. The proposal would then apply one year after entry into force, with 24 months for public bodies to accept the wallets.

How this connects

The business wallet sits next to the personal EU Digital Identity Wallet. Wallet attestations will also matter for customer checks, which we cover in sanctions screening and anti-money laundering, and for the way you contract, see our commercial contracts overview. When we incorporate a company in Belgium, we align signing powers and mandates from day one. We review wallet provider terms as part of commercial contracts and transactions, using Contract Review, and prepare mandates and internal rules with Document Studio.

Cited provisions. Proposal COM(2025) 838 final: Articles 1 (subject matter), 3 (definitions), 4 (equivalence), 5 (core functionalities), 6 (technical features), 7 (provider requirements), 8 and 9 (identification data, unique identifier), 10 (European Digital Directory), 11 to 15 (notification, list, supervision, penalties), 16 (public sector bodies), 17 and 18 (third countries), 20 (amendment of Article 5a eIDAS), 21 (review), 22 (entry into force and application). Regulation (EU) No 910/2014, Articles 5a, 19a, 24(1a) and 46a.

Key dates. 19-11-2025: proposal published. 10-09-2026: ITRE committee vote. 23-09-2026: committee report tabled. 07-10-2026: plenary confirms the decision to enter negotiations. After adoption: entry into force 20 days after publication, application one year later, acceptance by public bodies within 24 months and the registered delivery service within 36 months.

Further reading. The EU Digital Identity Wallet · Interoperable Europe: what suppliers to government should know · Sanctions screening and anti-money laundering · Commercial contracts overview · Proposal on EUR-Lex · Legislative Observatory