EUDI Wallet: Credentials instead of documents

A bank account can often be opened in a few minutes today: a photo of the ID card and a short video are enough to prove one’s identity digitally. For an address change with the health insurer, by contrast, the effort can be considerably greater: proof of registration of residence may be required, which first has to be requested from the municipality and then submitted by post.

Two everyday processes, but two completely different ways of proving personal details. What has long been possible digitally still ends elsewhere in paper, stamps and manual checks. Why, actually? And how could this change?

This is exactly where the EUDI Wallet comes in. It is meant to make it possible to use digital identities and credentials across Europe securely, uniformly and verifiably. There is more behind it than just another app on the smartphone: it is about common standards and an infrastructure intended to facilitate the exchange of digital credentials between citizens, companies and authorities.

The initiative is still barely known, however. In a representative Bitkom survey from spring 2026, 52% of respondents said they had never heard of the EUDI Wallet. A further 18% know the term but do not know what it is about. 20% say they know what the wallet is, and another 5% feel able to explain it well. The EUDI Wallet can therefore be placed by only about a quarter of the population.¹

This gap between low awareness and far-reaching significance is the reason for our blog series. In this first post, we give an overview of what the EUDI Wallet actually is, how it works in principle, which timeline applies and whom it affects. The following posts explore the individual aspects in more depth.

The starting problem: Documents are snapshots

Anyone who opens an account online, takes out insurance or applies for a loan today submits documents: a copy of an ID card, a residence registration certificate, proof of salary or an insurance confirmation. These documents are snapshots. They are photographed, uploaded, stored and forwarded, and every body files its own copy. Nobody knows exactly whether the data is still correct. A registration certificate from eight months ago may long be out of date.

For customers, this means obtaining the same information again and again and sending it to different bodies. In doing so, they must trust that their documents are processed securely and not stored longer than necessary. Companies, in turn, must receive the documents, check authenticity and currency, reconcile data manually and archive the documents or delete them on time.

This process is expensive, slow and error-prone. In addition, there is a data protection problem: often, more personal data is passed on and stored than the respective purpose requires. These are precisely the weaknesses the EUDI Wallet aims to remedy.

What is the EUDI Wallet?

The European Digital Identity Wallet, EUDI Wallet for short, is a digital wallet for identity data and credentials. With it, users can store their digital identity, for example the data from their ID card, on their smartphone and present it when needed. Further digital credentials come on top, such as a driving licence, registered address, educational qualifications or confirmations from an employer.

Every EU member state must provide at least one such wallet. For citizens, use is voluntary and free of charge. In Germany, the state EUDI Wallet is, as things currently stand, due to launch on 2 January 2027.

The real significance of the EUDI Wallet becomes apparent only when looking at the infrastructure underlying the app: The app on the smartphone is only the visible access point. Behind it, a Europe-wide uniform rail network is emerging, over which credentials are exchanged securely between different parties. Technical standards, security requirements and rules of the game are the same for all member states. That is why a credential issued in Germany can also be verified by a bank in Spain.

What is transported over this network are not documents in the traditional sense but digital credentials. A trusted body issues them and confirms information, such as the legal age of a person, possession of a driving licence or employment. Unlike with a document copy, a digital credential allows you to check who issued it and whether it has been altered since.

The basic principle can be explained through three roles:

• The Issuer issues a credential and thereby confirms a specific piece of information. This can be an authority confirming the registered address, a university certifying a degree or an employer proving an employment relationship.
• The Holder – that is, the person who uses the wallet – receives the credential, manages it in their wallet and decides for themselves to whom to present it.
• The Verifier (Relying Party), such as a bank, an insurer, a landlord or a retailer, checks the credential for authenticity and validity and uses the information it contains for its business processes, such as identifying persons.

These roles already exist today. So far, however, the exchange runs via paper, scans and manual checks. The EUDI Wallet transfers this process into a standardised digital process. The process itself is therefore not new; what is new is the form in which credentials are transmitted and verified.

What the EUDI Wallet is not

Anyone hearing about the EUDI Wallet for the first time usually files it under something familiar: another app, a new login or a kind of Apple Pay for your ID. These comparisons are obvious but fall short. The following overview contrasts the most common assumptions with the actual function:

The point of payments in particular often causes misunderstandings. Authorising a payment is something different from proving an identity. Separate regulatory and technical requirements apply to the authorisation and processing of payments. Payment processing itself continues to run via banks, payment service providers and existing payment systems. We will look more closely in a later post at where the EUDI Wallet can nevertheless play a role in payment processes, for example in authentication.

How the EUDI Wallet works in everyday life

A vivid example is moving house. Today, you register your new address with the municipality and receive a registration certificate. You then submit it wherever proof of address is required: at your bank, your insurer, your employer or your energy supplier. Each of these bodies receives the same information as its own copy.

With the EUDI Wallet, the process would look like this: The municipality, as issuer, issues a digital credential of your registered address. You, as holder, receive this credential in your wallet. If your bank needs current proof of address, it requests the relevant information via a digital process. In your wallet, you can see who is requesting which data for what purpose, and you decide whether to release it. The bank receives the digital credential and can check technically whether it actually comes from the municipality and is unchanged.

Here an important principle of the EUDI Wallet comes into play: data minimisation. A digital credential can be designed so that the holder does not have to disclose the entire document, only the information actually needed. This principle is referred to as selective disclosure. Anyone who has to prove that they are of legal age transmits the information “over 18” without revealing the exact date of birth. Anyone who proves an address discloses the address and not the entire registration history. Today it is different: anyone who shows an ID card generally reveals considerably more than the specific check requires.

The same principle can be applied to many other situations. When renting a vehicle, you could prove your driving entitlement in a targeted way without submitting a full copy of your driving licence. When taking out insurance, identity could be confirmed via a digital credential without an ID copy being necessary. Other documents that are required on substantive grounds remain unaffected.

The use cases differ, the basic principle remains the same: a trusted issuer confirms a piece of information, the holder provides it in a targeted way, and the recipient verifies the credential. Customers have to obtain fewer documents and disclose less data. Companies can support or automate technically the verification steps that today are carried out manually at the counter or in the back office.

EUDI Wallet timeline: Who has to act and when?

The EUDI Wallet is not a future concept but rests on a binding European legal framework with concrete deadlines. The basis is the eIDAS 2.0 Regulation (legal text (EU) 2024/1183), which entered into force in May 2024. Two milestones in time should be highlighted:

24 December 2026: Provision of the EUDI Wallet by the member states. By this date, every EU member state must provide at least one EUDI Wallet with which citizens can receive, manage and present digital credentials.²

24 December 2027: Entry into force of the acceptance obligation for the private sector. From this date, private companies, except microenterprises and small enterprises, must accept the EUDI Wallet at the user’s request if strong user authentication is prescribed by law or by contract for online identification. This applies whenever the user wishes to use the wallet. The areas generally affected include banks, insurers, payment and e-money institutions as well as providers from transport, energy, telecommunications and health. Additional requirements apply to very large online platforms.²

Two points are often misunderstood. First, being affected does not depend solely on the sector but on which services and processes a company offers and which legal requirements apply to them. What matters in particular is whether digital identification or strong authentication is required and whether an obligation to accept the EUDI Wallet follows from it. Second, a distinction must be made between accepting and issuing credentials. Most companies will initially act as verifiers and check credentials from the wallet. Whether they additionally want or need to issue their own credentials is a separate strategic question.

Between the provision of the wallets and the acceptance obligation there is thus about one year. This period is meant to enable the companies concerned to prepare their processes and systems. For the necessary substantive and technical adjustments, little time remains.

What does the EUDI Wallet mean for banks and insurers?

For banks and insurers, it is not just a matter of accepting existing documents in digital form in future. The EUDI Wallet brings concrete regulatory obligations and at the same time changes how identities are verified and credentials are integrated into processes.

Regulatory obligations

At the centre is the acceptance obligation under Article 5f(2) eIDAS: From 24 December 2027, private companies (except microenterprises and small enterprises) must accept the EUDI Wallet at the user’s request if they are required by law or by contract to use strong authentication for online identification. For banks, this concerns, for example, access to online banking, for which the Payment Services Directive 2 (PSD2) currently prescribes strong customer authentication.⁴ The requirements are to be continued and further developed in future in the Payment Services Regulation (PSR), which will replace PSD2.

For insurers, it depends on whether such an obligation exists for customer portals or individual products.

The wallet can also be used for identification under anti-money laundering law; however, the acceptance obligation for this does not arise from the AMLR.

Several tasks follow from this:

• Registration as a relying party: Anyone who wants to query data from the EUDI Wallet must register in the respective member state and state what the wallet is used for and which data is requested. More data than registered may not be requested.
• Integration into identification processes: The EUDI Wallet must be integrated into onboarding journeys as an additional identification method alongside existing solutions such as VideoIdent, eID or in-branch identification.
• Ensuring KYC compliance: Institutions must clarify how identification via the wallet meets anti-money laundering requirements, how it is documented and how it fits into existing control and audit processes.
• Data protection assessment: Presenting a credential does not in itself create a legal basis for processing the data it contains. Whether a company may store and further process data continues to be governed by the GDPR and sector-specific rules. The wallet is the transport route, not the permission.⁵

Opportunities for Processes and Customer Experience

Anyone who views the EUDI Wallet solely as a regulatory obligation is wasting potential. Used correctly, it can noticeably improve existing customer and verification processes:

• fewer manual steps in document verification
• faster and more highly automated onboarding processes
• more verifiable information that can be traced directly to the respective issuer
• less need to store full copies of sensitive documents
• new design options for KYC and KYB processes

In the medium term, banks and insurers can also become issuers themselves. Conceivable examples are digital account confirmations or insurance confirmations that customers keep in their wallet and present to third parties.

Why companies should act now

Preparing for the EUDI Wallet is not a purely IT task. Affected are customer onboarding, the design of verification processes, compliance and data protection, the cost structure and, not least, the customer experience. This puts the topic on management’s agenda.

The deadlines are fixed; the central challenge therefore lies less in the timeline than in the substantive assessment: Which processes fall under the acceptance obligation? Where is it worth going beyond the mandatory minimum? And how does the interaction with customers change when account openings, contract conclusions or address changes are no longer based on documents but on verified digital credentials?

This is exactly where msg provides support. Together with banks and insurers, we analyse the regulatory requirements, assess substantive and technical impacts and develop practical approaches for integrating the EUDI Wallet into existing business processes.

Outlook on Part 2

In future, digital credentials will be transmitted from the issuer via the holder to the verifier. But how exactly does this interplay work? In the next post, we look more closely at the roles in the EUDI ecosystem: Who may issue digital credentials? How can a bank check whether a credential actually comes from a trustworthy issuer? And what information may a verifier request in the first place?