The EU Digital Identity Wallet is coming. Here's what it means for your business.

Walletap Verify on a phone checking EUDI Wallet credentials — identity verified, age over 18, selective disclosure

Sometime next year, a customer will walk up to your counter — or land on your checkout — and offer to prove who they are with their phone. Not a photo of a plastic card. A cryptographically signed credential, issued by their government, shared in seconds with their explicit consent. The EU has decided this is how identity will work, and for a long list of industries, accepting it won't be optional.

The legal machinery is already in motion. eIDAS 2.0 — Regulation (EU) 2024/1183, the update to Europe's electronic-identity framework — entered into force in May 2024, and the implementing acts that pin down the technical detail followed. It creates two obligations that matter to businesses. First, every member state must offer its citizens a free digital identity wallet by the end of 2026 — Croatia included. Second, once the wallets are out there, acceptance becomes mandatory: from 2027 onwards, companies in regulated sectors must take the EUDI Wallet as valid proof of identity whenever they are legally required to identify a customer.

A wallet for identity, not payments

The EUDI Wallet is a state-backed app that carries verifiable credentials: your national ID, driving licence, and over time diplomas, prescriptions, powers of attorney. The design principle underneath it is selective disclosure — a business asks for exactly the attribute it needs, and nothing else travels.

A shop selling age-restricted products needs one fact: that the customer is over 18. Not a name, not an address, not even a date of birth — the wallet proves the threshold and keeps the rest private. A bank opening an account needs verified identity data, and receives it as a signed credential rather than a photo of a document that someone then has to inspect, retype, and store. Every presentation is cryptographically verifiable, which means the days of squinting at a plastic card — or paying someone to squint at it over a video call — are numbered.

Who will be required to accept it

The regulation targets the places where identity checks are already a legal requirement. Banks and payment institutions, telecom operators, energy and water utilities, transport and postal services, and healthcare providers are all named in the framework — as is the public sector, and the internet's largest platforms, which will have to accept the wallet for login and age verification. The simplest test: if your onboarding today involves "bring your ID," a video-identification session, or a photocopy in a drawer, you should assume you're in scope.

And even where acceptance isn't mandated, the pull will be commercial. A customer who has opened a bank account with one tap will have little patience for photographing both sides of their ID card to join a gym.

The timeline is tighter than it reads

2024 — eIDAS 2.0 enters into force; implementing acts follow.
2025 — technical standards mature; large-scale pilots run across member states, covering account opening, SIM registration, mobile driving licences and e-prescriptions.
End of 2026 — every member state must have a wallet available to its citizens.
From 2027 — acceptance obligations phase in for regulated sectors.

On paper, that looks like plenty of time. In practice it isn't. Accepting the wallet means becoming a relying party: registering with a national authority, standing up the verification protocols (OpenID4VP for online flows, ISO/IEC 18013-5 for in-person proximity), handling consent and data minimisation correctly, and testing against wallets that are still landing. Organisations that start when the obligation bites will be doing all of that in a queue behind everyone else who waited.

What actually changes day to day

Account opening. The form-filling and the video-identification session collapse into a single wallet interaction. What took minutes — and lost a measurable share of applicants along the way — takes seconds.
Age-restricted sales. Online and at the counter, "are you over 18?" becomes a provable yes/no, with no full identity document handed over and nothing extra to store.
Events and travel. Where a ticket must match a person, the match happens digitally at purchase. At the door, staff scan a ticket instead of checking documents against names.
Enrolments of every kind. Memberships, SIM cards, rentals, deliveries of restricted goods — one verified interaction, no photocopies, no retyping, no compliance drawer.

Identity wallets and payment wallets will work together

A common misreading is that the EUDI Wallet replaces Apple Wallet and Google Wallet. It doesn't — they solve different problems. Government credentials will live in the state wallet; tickets, memberships, loyalty cards and access badges will keep living where they live today, with the push notifications and NFC convenience users already expect.

The flows that win will chain the two. Verify the customer once against their EUDI Wallet at enrolment or purchase, then issue the thing they actually carry — the ticket, the membership, the badge — straight into the wallet they open every day. Verified at the start, frictionless ever after.

That combination is exactly what we build.

Where Walletap is today

Walletap Verify is our verification product for EUDI Wallet credentials, and it runs today — not on a roadmap slide. It performs age checks (18+, 21+, 65+) and full identity verification over OpenID4VP, exchanging ISO/IEC 18013-5 mDoc credentials — the same standards every national wallet is required to implement — and it round-trips end-to-end against the EU's reference wallet. It embeds into any website, so an online shop or booking flow can add a wallet-based identity check without rebuilding anything. And because it's part of the same platform that issues and manages wallet passes, the verify-then-issue flow above is one integration, not two vendors.

We're building it around the regulation's intermediary model, so the heavy compliance surface — relying-party plumbing, consent handling, data minimisation — sits with us rather than with every business that integrates.

How to get ahead of it

Map your identity moments. List every point where you check who someone is or how old they are — onboarding, checkout, the counter, the door.
Price the status quo. Each of those checks costs staff time, per-verification fees, and abandoned customers. That number is your business case.
Decide who owns the compliance. Registering and operating as a relying party yourself is a real engineering and legal project; going through an intermediary makes it an integration instead.
Pilot now, against the reference wallet. The tooling to test exists today. Teams piloting in 2026 will be quietly live when their competitors are reading documentation in 2027.

2027 sounds far away. It's one integration-and-testing cycle away, and the sectors involved don't move fast. If you'd rather see a live verification than a slide deck, get in touch — we're onboarding pilot partners now.