What the EUDI Wallet is and why it matters for KYC

The European Digital Identity Wallet is a government-backed app, issued or recognised by each Member State, that lets a person store and selectively share verified identity data: a Person Identification Data (PID) credential with name, date of birth and nationality, plus attestations such as a driving licence, diplomas or proof of address. The legal basis is Regulation (EU) 2024/1183, known as eIDAS 2.0, which entered into force on 20 May 2024. The first implementing acts that define the wallet’s technical requirements entered into force on 24 December 2024 and started the countdown for national rollouts.

For a regulated business, the wallet matters because the identity data it presents is issued at assurance level “high”. Instead of reading a photo of an ID card and inferring whether it is genuine, the relying party receives cryptographically signed attributes that can be checked against the issuer. This removes several hard problems in remote onboarding, from document forgery to manual data entry.

Key dates compliance teams should track

• 20 May 2024: eIDAS 2.0 (Regulation (EU) 2024/1183) enters into force.
• 24 December 2024: first implementing acts on wallet integrity, core functions, protocols and certification enter into force.
• By 24 December 2026: each Member State must provide at least one EUDI Wallet (Article 5a).
• 10 July 2027: the AML Regulation (EU) 2024/1624 becomes applicable across the EU.
• By 24 December 2027: regulated private relying parties, including banks and payment providers that must apply strong user authentication, must accept the wallet when the user requests it (Article 5f).

Micro and small enterprises are excluded from the mandatory acceptance duty, but most banks, larger fintechs, insurers and telecom operators fall squarely within scope.

What AMLR and the new AMLA standards say about electronic identification

The AML Regulation sets out how obliged entities verify a customer’s identity. Article 22(6) gives two routes: checking an identity document (passport, national ID or equivalent), or using electronic identification means that meet the eIDAS requirements for assurance levels “substantial” or “high”. A notified EUDI Wallet meets that bar, which makes it a first-class verification method under the new single rulebook.

On 1 October 2026, AMLA announced its final draft Regulatory Technical Standards (RTS) on customer due diligence and submitted them to the European Commission for adoption. Based on public analyses of the final text, the draft goes further than the regulation itself in several practical ways:

• eID first: electronic identification and qualified trust services should be used wherever possible.
• Attribute gaps: where an eID credential does not contain a required data point, the firm must obtain and verify that attribute by other reliable means.
• Remote document checks as a justified fallback: remote verification of documents is allowed where the customer cannot reasonably present a document face to face and has no access to suitable eID, with controls proving that the person presenting the document is its rightful holder.
• Existing tools: firms may continue to use remote onboarding solutions that meet these requirements.

The RTS still need to be adopted by the Commission and published in the Official Journal, and are expected to apply six months after entry into force. Wording may still change, but the direction is clear: eID where it exists, robust and auditable remote verification where it does not.

Why document and biometric verification will still carry most of the load

It is tempting to read the 2027 deadline as the end of document-based onboarding. The rollout data says otherwise. Public trackers show national projects at very different stages in autumn 2026, from public sandboxes to announcements without testable releases. Analysts expect only part of the Union to have fully notified wallets with complete feature sets by the end of 2026, and the Commission itself has signalled that not every Member State will be on time.

Even once wallets exist, adoption is voluntary for citizens. Several groups will keep relying on other routes for years:

• Non-EU customers, including expatriates, students and cross-border workers, who have no EUDI Wallet at all.
• Customers who do not install or activate the wallet, or who decline to use it for a given service.
• Legal entities, since business wallets for KYB use cases are progressing more slowly than wallets for natural persons.

For all of these, firms still need reliable KYC identity verification built on document authentication, data extraction and biometric checks. Because AMLA’s fallback route explicitly requires controls showing that the person presenting the document is its holder, liveness detection and face matching become compliance requirements rather than nice-to-have security layers. Deepfakes and injection attacks make that requirement harder, not easier, to meet.

How to design a wallet-ready onboarding flow

The goal is an orchestration layer that offers the strongest available method first, falls back cleanly and records why.

1. Register and integrate as a relying party

To request data from wallets, a business must register as a relying party in the relevant national register and obtain a relying-party access certificate, as set out in Implementing Regulation (EU) 2025/848. Registration involves declaring which attributes you intend to request and why, and lead times can run to several months. Starting in 2027 is late for a December 2027 obligation.

2. Request only the attributes you need

Wallets are built around selective disclosure. Map your AMLR data requirements (full name, date and place of birth, nationality, address, identity document number where required) to the attributes available in the PID and any additional attestations. Over-requesting is a data-protection problem the user will see in the wallet’s consent screen.

3. Build the fallback path to the same standard

When the wallet is unavailable, declined or incomplete, route the customer to document capture with authenticity checks, OCR, liveness and face matching. Our guide on how face matching works in remote onboarding covers the technical side of that step. Record why the fallback was used, because the draft RTS expect firms to justify why a customer could not be verified through eID.

4. Keep one decision engine and one audit trail

Whether identity was proven by a wallet presentation or by a document plus biometrics, risk scoring, sanctions and PEP screening and ongoing monitoring should consume the same normalised customer record.

Business impact: cost, conversion and fraud

Done well, the dual-route model can lower onboarding cost and improve conversion for customers who have a wallet, while keeping the document path for everyone else. The economics resemble the shift we describe in our analysis of KYC and AML compliance cost automation: savings come less from any single technology and more from removing manual review, rework and inconsistent decisions.

Fraud also shifts: wallet credentials are hard to forge, so attackers will target the weakest remaining path, usually the fallback flow or account recovery. Treat document and biometric verification as a hardened, continuously tested control, not a legacy channel.

What to do in the next 12 months

1. Map AMLR Article 22 data points against PID attributes and identify gaps.
2. Confirm whether your organisation falls under the eIDAS Article 5f acceptance duty and start relying-party registration.
3. Review your remote onboarding against the draft AMLA RTS, especially holder-binding controls, record keeping and fallback justification.
4. Test liveness and face matching against current deepfake and injection attack techniques.
5. Choose verification partners that can support both routes behind a single integration and keep pace with national wallet rollouts.

Prepare your onboarding for eIDAS 2.0 and AMLR with aIDentix

aIDentix helps banks, fintechs and telecom operators verify customers remotely with AI-driven document verification, OCR, liveness detection and face matching, delivered as a configurable onboarding flow. If you are planning how wallet-based identification and document verification will work side by side in your KYC process, book a demo with the aIDentix team to review your current flow and the steps to get ready for 2027.

FAQ

What is the EUDI Wallet?

The EUDI Wallet (European Digital Identity Wallet) is a government-backed digital identity app introduced by eIDAS 2.0. It lets EU citizens and residents store verified identity data and attestations and share only the attributes a service needs, with assurance level high.

When do banks have to accept the EUDI Wallet?

Under Article 5f of Regulation (EU) 2024/1183, regulated private relying parties that must apply strong user authentication, including banks and payment providers, must accept the wallet at the user’s request no later than 36 months after the relevant implementing acts entered into force, which is generally calculated as 24 December 2027.

Does the EUDI Wallet satisfy KYC requirements under AMLR?

AMLR Article 22(6) allows identity verification through electronic identification means meeting eIDAS assurance level substantial or high, so a notified EUDI Wallet qualifies. If the wallet does not provide every required data point, the missing attributes must be obtained and verified by other means.

Will document-based identity verification still be allowed?

Yes. Identity documents remain a valid verification route under AMLR, and AMLA’s final draft RTS permit remote document verification where eID is not available, provided firms have controls confirming the person is the document’s rightful holder and can justify why eID was not used.

What do we need to do to accept the EUDI Wallet?

You need to register as a relying party in the national register, obtain a relying-party access certificate, integrate the presentation protocols defined in the implementing acts and limit requests to the attributes you genuinely need. Registration can take several months, so planning should start well before December 2027.

How does the EUDI Wallet affect identity fraud?

Signed wallet credentials are much harder to forge than document images, which reduces document fraud on the wallet route. Fraud pressure is likely to move to fallback flows, account recovery and social engineering, which makes strong liveness detection and face matching more important in the remaining channels.