---
title: "European Business Wallets | Pitch, European law firm"
description: "What the Commission's proposal for European Business Wallets would give companies and public bodies, what it would require of authorities and wallet providers,…"
url: https://pitch.law/academy/european-business-wallets
---

[pitch](https://pitch.law/) [Academy](https://pitch.law/academy) [Data](https://pitch.law/academy/topics/information-technology)

# European Business Wallets

What the Commission's proposal for European Business Wallets would give companies and public bodies, what it would require of authorities and wallet providers, and where the file stands in November 2026.

- - By [Bart Lieben](https://pitch.law/team/bart-lieben), Attorney-at-Law
  - 13 November 2026

- Updated

  13-11-2026

## The legal framework

### Status

On 19 November 2025 the European Commission proposed a [Regulation on the establishment of European Business Wallets](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52025PC0838), reference COM(2025) 838 final, procedure [2025/0358(COD)](https://oeil.europarl.europa.eu/oeil/en/procedure-file?reference=2025/0358%28COD%29). It is a proposal under the ordinary legislative procedure. Nothing in it binds anyone yet, and the article numbers below are those of the proposal. They may change before adoption.

In the European Parliament the file sits with the Committee on Industry, Research and Energy (ITRE). The committee voted on 10 September 2026 and tabled its report (A10-0240/2026) on 23 September 2026. Its decision to enter interinstitutional negotiations was announced in plenary on 5 October 2026 and confirmed by plenary on 7 October 2026. The Legislative Observatory shows the stage as "Awaiting Parliament's position in 1st reading".

The proposal builds on the eIDAS Regulation, [Regulation (EU) No 910/2014](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32014R0910), as amended by [Regulation (EU) 2024/1183](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1183).

### What a European Business Wallet is

Article 3(1) defines the wallet as a digital solution that lets its owner securely store, manage and present its identification data and electronic attestations of attributes. The owner uses it to authenticate and give the proofs a relying party needs, to use attestations, signatures, seals, registered delivery and time stamps, and to create, manage and delegate mandates to authorised representatives.

The owner can be an _economic operator_ (any natural or legal person acting for purposes related to its trade, business, craft or profession) or a _public sector body_ (Article 3(4), (5) and (7)). A sole trader is therefore an economic operator too.

### The principle of equivalence (Article 4)

When an owner uses one of the core functionalities, the result has the same legal effect as if the action had been lawfully carried out in person, on paper or by any other compliant means. A sole trader using the qualified electronic registered delivery service under Article 5(3) gets the same equivalence.

### Core functionalities (Article 5)

Every wallet must let its owner, among other things:

- issue, request, obtain, store, delete, share and present electronic attestations of attributes, and disclose only selected attributes (Article 5(1)(a) and (b));
- exchange identification data and attestations with other business wallets, with European Digital Identity Wallets and with relying parties (Article 5(1)(c));
- sign with qualified electronic signatures and seal with qualified electronic seals, and use qualified time stamps (Article 5(1)(d) and (e));
- issue attestations itself, including attestations linked into a chain (Article 5(1)(f) and (g));
- send and receive documents and data through a qualified electronic registered delivery service (Article 5(1)(i));
- authorise several users to operate the wallet, and manage and revoke those authorisations (Article 5(1)(j));
- authorise relying parties to request attestations, and revoke that (Article 5(1)(k));
- export all its data in a structured, commonly used and machine-readable format, on request or when the provider stops (Article 5(1)(l));
- see a log of all transactions and a common dashboard for registered communications (Article 5(1)(m) and (n)).

Providers may add functions, as long as these do not compromise the core ones (Article 5(2)). They must also offer the registered delivery service as a standalone service to users of European Digital Identity Wallets (Article 5(3)). That is the route for a self-employed person who does not need a full business wallet.

### Technical features (Article 6)

Wallets must support common protocols, for example for remote onboarding by an authorised representative with an electronic identification means at assurance level "substantial" or "high" (Article 6(1)(e)) and a unique digital address per owner (Article 6(1)(j)). For delegated access, role mappings must be verifiable, auditable and revocable, and over-delegation or expired authorisations must be detected and blocked in real time (Article 6(2)(b)). A wallet can be revoked at the owner's request, after a security compromise, when the owner ceases its activity, or when the provider drops off the list (Article 6(2)(f)).

### Identification data and the unique identifier (Articles 8 and 9)

Identification data are issued to the wallet by a qualified trust service provider, by a public sector body responsible for an authentic source, or by the Commission for Union entities (Article 3(3) and Article 8(1) and (3)). They contain at least the official name as recorded in the relevant register and a unique identifier (Article 8(5)). Where a company has a European Unique Identifier (EUID) under [Directive (EU) 2017/1132](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32017L1132), that EUID is used. Others receive an identifier created under an implementing act (Article 9).

### The European Digital Directory (Article 10)

The Commission would run a directory with an API and a web portal, accessible only to wallet owners, their authorised representatives and wallet providers (Article 10(1) and (4)). Providers send the required information when they provide a wallet and report changes within one working day (Article 10(2) and (5)).

### Providers: notification and supervision (Articles 7 and 11 to 15)

Only providers on the Commission's list may offer wallets (Article 7(1)). They must be established in the Union, have their principal place of business and main operations there and not be controlled by a third country or third-country entity (Article 7(2)). They must meet the NIS2 Directive ([Directive (EU) 2022/2555](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022L2555)) and, unless they are qualified trust service providers, the requirements of Article 19a eIDAS (Article 7(3) and (4)). Article 7(6) adds information duties towards owners and representatives, cooperation with supervisors and data transfer or deletion when a provider stops.

A provider notifies the supervisory body with its details, a description of how it offers the core functions and a declaration of conformity (Article 11(2)). Qualified trust service providers are listed without review. Others face a review of up to 30 days; silence counts as a positive outcome (Article 11(3) to (6)). The supervisory bodies already designated under Article 46a eIDAS supervise ex post (Article 13). Member States set penalties, with administrative fines for providers of up to 2% of total worldwide annual turnover in the preceding financial year (Article 13(8)).

### Obligations on public sector bodies (Article 16)

This is the core of the "acceptance" chapter. By 24 months after entry into force, public sector bodies must let economic operators use the wallet's core functionalities to identify and authenticate, sign or seal, submit documents and send or receive notifications, when they meet a reporting obligation or follow an administrative procedure. For submissions and notifications, public bodies must have business wallets themselves, including the registered delivery service. Until 36 months after entry into force they may instead use existing alternatives that meet the eIDAS requirements for qualified registered delivery and offer a gateway to the wallets.

The explanatory memorandum is explicit: the proposal does not impose any obligation on economic operators to use a business wallet. Public bodies must accept it; companies choose. The review clause asks the Commission to assess, three years after entry into force, whether an obligation to use the wallets is needed (Article 21).

### Third countries (Articles 17 and 18)

The Commission may recognise equivalent third-country wallets or frameworks (Article 17). EU providers may also supply wallets to operators established outside the Union, after identity proofing under Article 24(1a) eIDAS and with only one set of identification data per operator (Article 18).

### Link with the EU Digital Identity Wallet (Article 20)

Article 20 would amend Article 5a eIDAS. The European Digital Identity Wallet would then be aimed at natural persons only: the words "and legal persons" disappear from Article 5a(1) and from the voluntary-use rule in Article 5a(15). Companies would use business wallets instead. We explain the personal wallet in [the EU Digital Identity Wallet](https://pitch.law/academy/eu-digital-identity-wallet).

### Dates

Entry into force 20 days after publication, application one year later (Article 22). Penalty rules are due within 12 months (Article 13(7)).

## In practice

A Belgian manufacturer with a subsidiary in the Netherlands files annual statements, VAT returns and permit applications in both countries. With a business wallet, its finance team could sign filings with the company's qualified seal, send them through the registered delivery channel and receive the authorities' decisions in one dashboard. Each filing would have the same legal effect as a paper one.

A company gives its external accountant a mandate to file tax returns, and gives its HR officer a separate mandate for social security filings. In the wallet, the company manages both mandates, can see every action in the transaction log and can revoke a mandate the day the accountant changes (Article 5(1)(j) and (m), Article 6(2)(b)).

A freelance consultant does not need a full business wallet. Through the standalone registered delivery service in Article 5(3), the consultant can use a personal EU Digital Identity Wallet to receive official notifications from the tax administration.

### Contracts and practical steps

- **Choose a provider with care.** The wallet would be a contract with a listed provider. Check that the provider is on the Commission's list, how it handles data export and termination (Article 5(1)(l) and Article 7(6)(f)), its security commitments and where its operations sit.
- **Map who acts for the company.** Mandates in the wallet should match the powers in your articles of association, board decisions and powers of attorney. Signing powers that are joint in the articles should not become individual in the wallet.
- **Update internal rules.** Decide who may use the company seal, who receives official notifications and how quickly someone must read them, since a notification received through the wallet would have the same legal effect as one received on paper.
- **Watch your authorities.** Public bodies get 24 months after entry into force. Plan your own adoption around the authorities you deal with most.

## Frequently asked questions

### Will we have to use a business wallet?

Under the proposal, no. The explanatory memorandum states that it does not impose any obligation on economic operators. Public sector bodies would have to accept the wallet, and the Commission would review after three years whether use should become mandatory.

### Does a business wallet replace the EU Digital Identity Wallet?

They work together. The personal wallet identifies a natural person, for example the director who acts for the company. The business wallet identifies the company itself and holds its attestations, seals and mandates. Article 5(1)(c) requires the two to exchange data.

### Who can offer business wallets?

Entities established in the Union that notify the supervisory body and are put on the Commission's list. Qualified trust service providers are listed without review. Where a Union entity provides wallets, the Commission supervises it (Article 15).

### When could this apply?

Not before the Parliament and the Council agree a text and it is published. The proposal would then apply one year after entry into force, with 24 months for public bodies to accept the wallets.

## How this connects

The business wallet sits next to the personal [EU Digital Identity Wallet](https://pitch.law/academy/eu-digital-identity-wallet). Wallet attestations will also matter for customer checks, which we cover in [sanctions screening and anti-money laundering](https://pitch.law/academy/sanctions-screening-and-anti-money-laundering-what-every-business-needs-to-know), and for the way you contract, see our [commercial contracts overview](https://pitch.law/academy/commercial-contracts-overview). When we [incorporate a company in Belgium](https://pitch.law/solutions/incorporation), we align signing powers and mandates from day one. We review wallet provider terms as part of [commercial contracts and transactions](https://pitch.law/solutions/commercial-contracts-transactions), using [Contract Review](https://pitch.law/technologies/clause-library-risk-review), and prepare mandates and internal rules with [Document Studio](https://pitch.law/technologies/contract-studio).

> **Cited provisions.** Proposal COM(2025) 838 final: Articles 1 (subject matter), 3 (definitions), 4 (equivalence), 5 (core functionalities), 6 (technical features), 7 (provider requirements), 8 and 9 (identification data, unique identifier), 10 (European Digital Directory), 11 to 15 (notification, list, supervision, penalties), 16 (public sector bodies), 17 and 18 (third countries), 20 (amendment of Article 5a eIDAS), 21 (review), 22 (entry into force and application). Regulation (EU) No 910/2014, Articles 5a, 19a, 24(1a) and 46a.
>
> **Key dates.** 19-11-2025: proposal published. 10-09-2026: ITRE committee vote. 23-09-2026: committee report tabled. 07-10-2026: plenary confirms the decision to enter negotiations. After adoption: entry into force 20 days after publication, application one year later, acceptance by public bodies within 24 months and the registered delivery service within 36 months.
>
> **Further reading.** [The EU Digital Identity Wallet](https://pitch.law/academy/eu-digital-identity-wallet) · [Interoperable Europe: what suppliers to government should know](https://pitch.law/academy/interoperable-europe-act) · [Sanctions screening and anti-money laundering](https://pitch.law/academy/sanctions-screening-and-anti-money-laundering-what-every-business-needs-to-know) · [Commercial contracts overview](https://pitch.law/academy/commercial-contracts-overview) · [Proposal on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52025PC0838) · [Legislative Observatory](https://oeil.europarl.europa.eu/oeil/en/procedure-file?reference=2025/0358%28COD%29)

## In short

- One digital wallet to identify, sign, submit and receive official documents
- The same legal effect as acting on paper or in person
- Public bodies must accept the wallet; companies choose whether to use it
- Mandates for employees and advisers managed in the wallet
- Status of the proposal as of 13-11-2026

## Related solutions

- [Solutions](https://pitch.law/solutions/incorporation)
  ### [Incorporate a Company in Belgium](https://pitch.law/solutions/incorporation)
  [Setting up a Belgian company means choosing the right form, a sound financial plan, articles and a shareholders' agreement, and making sure the company owns the IP behind the business. We prepare everything and work with your notary.](https://pitch.law/solutions/incorporation)
- [Solutions](https://pitch.law/solutions/commercial-contracts-transactions)
  ### [Commercial Contracts & Transactions](https://pitch.law/solutions/commercial-contracts-transactions)
  [Supply, distribution, services, SaaS and procurement contracts, and the deals around them, drafted and reviewed with the IP, data and tax angles in view.](https://pitch.law/solutions/commercial-contracts-transactions)

## Our proprietary Legal Tech

- [Technology](https://pitch.law/technologies/clause-library-risk-review)
  ### [Contract Review](https://pitch.law/technologies/clause-library-risk-review)
  [Send us the contract the other side drafted and we check it clause by clause against our playbook, with a risk ranking an attorney has verified.](https://pitch.law/technologies/clause-library-risk-review)
- [Technology](https://pitch.law/technologies/contract-studio)
  ### [Document Studio](https://pitch.law/technologies/contract-studio)
  [Our Document Studio drafts and analyses legal documents in a secure, on-premise environment, and keeps the documents behind your matters up to date as new data comes in and procedural steps fall due.](https://pitch.law/technologies/contract-studio)

## More in Data

- ### [Children Online: the EU KIDS Act Proposal and Age Verification](https://pitch.law/academy/children-online-kids-act-and-age-verification)
  [What the Digital Services Act already requires to protect minors, what the EU KIDS Act proposal of 17 September 2026 would add for social networks, video platforms, games, app stores and chatbots, and how the EU age verification framework fits in.](https://pitch.law/academy/children-online-kids-act-and-age-verification)
- ### [The Cloud and AI Development Act: sovereignty rules for cloud and AI procurement](https://pitch.law/academy/cloud-and-ai-development-act)
  [What the Commission's proposal for a Cloud and AI Development Act would require of cloud providers that sell to the public sector, of contracting authorities, and of bidders for cloud and AI contracts, and how it sits next to the Data Act and the procurement Directive.](https://pitch.law/academy/cloud-and-ai-development-act)
- ### [Cyber Resilience Act III: importers, distributors, open source and contracts](https://pitch.law/academy/cyber-resilience-act-importers-distributors-open-source)
  [The duties of importers, distributors and authorised representatives under Articles 18 to 23 of Regulation (EU) 2024/2847, when a reseller becomes a manufacturer, how free and open-source software and its stewards are treated, and the clauses that follow.](https://pitch.law/academy/cyber-resilience-act-importers-distributors-open-source)
- ### [Cyber Resilience Act I: which products are caught, and in which class](https://pitch.law/academy/cyber-resilience-act-products-and-classes)
  [How to tell whether hardware or software you sell falls under Regulation (EU) 2024/2847, whether it is a default, important (class I or II) or critical product, and which conformity route follows from that, with the dates up to 11 December 2027.](https://pitch.law/academy/cyber-resilience-act-products-and-classes)
- ### [Cyber Resilience Act II: vulnerability handling and reporting since 11-09-2026](https://pitch.law/academy/cyber-resilience-act-vulnerability-handling-and-reporting)
  [What manufacturers must report under Article 14 of Regulation (EU) 2024/2847 since 11 September 2026, within 24 hours, 72 hours, 14 days and one month, and the vulnerability handling duties of Annex I, Part II, that follow from 11 December 2027.](https://pitch.law/academy/cyber-resilience-act-vulnerability-handling-and-reporting)
- ### [Cyber incidents across borders: the Cyber Solidarity Act](https://pitch.law/academy/cyber-solidarity-act)
  [What Regulation (EU) 2025/38 sets up, the European Cybersecurity Alert System, the Cybersecurity Emergency Mechanism with the EU Cybersecurity Reserve and the incident review mechanism, how a company hit by a major incident can benefit, and what it means for managed security service providers.](https://pitch.law/academy/cyber-solidarity-act)

## Let’s talk

Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free.

[Schedule a meeting](https://pitch.law/schedule)