EU Digital Identity Wallets: banks must accept them

The European Digital Identity Wallet is a digital wallet, provided or recognised by each Member State, that lets a person prove who they are and share verified personal data online. Regulation (EU) 2024/1183 (external site) adds it to the eIDAS Regulation, the EU law on electronic identification and trust services.

Using the wallet is optional for citizens. The rule tracked here is the duty of banks and other private services that require strong authentication to accept the wallet when a user asks for it (EUR-Lex (external site)).

Before the wallet, a person proved identity online with whatever method each service offered. Under Article 5f(2), private relying parties, other than micro and small enterprises, accept the wallet where Union or national law, or a contract, requires strong user authentication for online identification (EUR-Lex (external site)).

Strong user authentication combines at least two independent factors from knowledge, possession and inherence, the same structure as strong customer authentication in payments. The text names banking and financial services among the areas covered, and acceptance applies only at the user's voluntary request (EUR-Lex (external site)).

As an example, a customer opening an account online could present person identification data from the wallet instead of uploading a scan of an identity card (EUR-Lex (external site)).

Relying parties are informed of security breaches that affect wallets. Their registration can be suspended or cancelled in case of illegal or fraudulent use of the wallet (EUR-Lex (external site)).

The duty reaches banks, payment institutions, insurers and investment firms wherever they use strong user authentication for online identification (EUR-Lex (external site)). The roles most directly concerned:

• KYC Analyst: accepts wallet identity data as one source in onboarding checks.
• Fraud Analyst: adds wallet-based logins and identity data to fraud monitoring rules.
• Retail Banking Advisor: supports customers who choose the wallet to open an account or to log in.
• Operational Risk Analyst: covers wallet acceptance and breach notices in controls and incident processes.
• Cyber Risk Consultant (Banking): assesses the security of the wallet integration with existing authentication.

Regulation (EU) 2024/1183 entered into force on 20 May 2024 (EUR-Lex (external site)). The deadlines run from the entry into force of the first implementing regulations, adopted on 28 November 2024 and published on 4 December 2024. They entered into force on the twentieth day after publication, 24 December 2024 (EUR-Lex (external site)).

Member States provide wallets within 24 months of that date, so by 24 December 2026. Private relying parties accept them within 36 months, so by 24 December 2027 (EUR-Lex (external site)).

Both dates are calculated from the legal text, so they are marked expected. A Commission page describes the private acceptance duty as applying by the end of 2027 (Commission (external site)).

The eIDAS Regulation of 2014 set common rules for electronic identification and for trust services such as electronic signatures (EUR-Lex (external site)).

The 2024 amendment added the wallet, so that people can use one secure tool to reach public and private services across the EU while keeping control of their data (EUR-Lex (external site)).