The EUDI Wallet and European Business Wallet

The EUDI Wallet in brief

The EUDI Wallet — the European Digital Identity Wallet — will give every EU citizen, resident and business the option of a secure app to identify themselves online and offline, store and present digital credentials such as driving licences, diplomas or company attestations, and sign documents with qualified electronic signatures. It is the centrepiece of the revised eIDAS Regulation (Regulation (EU) 2024/1183, "eIDAS 2"), which entered into force on 20 May 2024 and amended Regulation (EU) No 910/2014.

Each Member State must provide at least one EUDI Wallet within 24 months of the entry into force of the Commission's implementing acts on wallet integrity, core functionalities and certification (Article 5a(1)).

Those implementing acts were adopted on 28 November 2024, published on 4 December 2024 and entered into force 20 days later, which puts the deadline for wallets at the end of December 2026. Consistent with this, the implementing regulation on the registration of wallet-relying parties (Implementing Regulation (EU) 2025/848) applies from 24 December 2026. For businesses in Germany, the key questions are when they must accept the wallet, what they need to do to become a registered relying party, and how the planned European Business Wallet will change dealings with authorities.

What the EUDI Wallet can do

Under Article 5a(4) eIDAS, the wallet must enable users, under their sole control, to:

• request, obtain, store, combine and present person identification data and electronic attestations of attributes, with selective disclosure of only the data needed;
• generate pseudonyms for use with services;
• authenticate to relying parties online and, where appropriate, offline;
• view a log of all transactions and of the relying parties they have connected with, request erasure of data and report suspicious data requests to the data protection authority;
• sign by means of qualified electronic signatures, which natural persons must be able to use free of charge for non-professional purposes.

For businesses, this means that customer onboarding, age verification, proof of qualifications or address, and contract signature could in future be handled through a single, standardised interface accepted across the EU.

Who must accept the EUDI Wallet and when

The obligation for private relying parties is significant: a bank, insurer, energy supplier, telecoms provider or online service that uses strong customer authentication because the law or a contract requires it will have to accept the EUDI Wallet as an option by the end of 2027, unless it is a micro or small enterprise. Very large online platforms designated under the Digital Services Act must accept the wallet for user authentication when users ask for it.

Becoming a relying party

Relying parties that intend to rely on EUDI Wallets must register in the Member State where they are established and state the intended use of the wallet, including the data they will request (Article 5b). The registration rules are set out in Implementing Regulation (EU) 2025/848. Relying parties receive access certificates and, where applicable, registration certificates that allow wallets to verify their identity and the data they are entitled to request. Requesting more data than registered is not allowed, and users can see in their wallet which relying party requested which data.

For German companies, this has several practical implications:

• Data minimisation by design: onboarding flows must be designed to request only the attributes needed, using selective disclosure rather than a full identity record where possible.
• Anti-money laundering: the wallet can support customer identification under the German Money Laundering Act (Geldwäschegesetz, GwG), but internal procedures must be adapted to the new identification method and its assurance level.
• Contracts and signatures: qualified electronic signatures created with the wallet satisfy the written form where German law allows electronic form under § 126a of the Civil Code, which can simplify contract conclusion.
• Liability: reliance on the wallet's high level of assurance allocates certain risks differently from video identification or postal identification procedures; terms and internal controls should reflect this.

Illustration

Illustration (hypothetical): a German online bank currently onboards new customers by video identification. From the end of 2027 at the latest, it must also accept the wallet at the customer's request, because it is required by law to apply strong customer authentication. The bank registers as a relying party, declaring that it will request name, date of birth, nationality and address for identification.

A new customer opens the bank's app, chooses the wallet option, sees exactly which data the bank requests, and approves. The bank receives verified data with a high level of assurance, documents the identification for anti-money laundering purposes and lets the customer sign the account agreement with a qualified electronic signature from the wallet. Video identification remains available as an alternative.

Data protection and age verification

The wallet is designed around user control. Users see every transaction and every relying party in a dashboard, can ask relying parties to erase data and can report suspicious requests to the data protection authority. Relying parties remain controllers under the GDPR for the data they receive, so privacy notices, legal bases and retention periods must cover the new channel. Selective disclosure also makes it possible to prove a single attribute, such as being over 18, without revealing a date of birth. This is relevant for online shops selling age-restricted products and for online platforms implementing measures to protect minors under Article 28 of the Digital Services Act.

Electronic attestations of attributes

Beyond identity, the wallet can store electronic attestations of attributes (EAAs) — digital certificates of facts such as professional qualifications, licences, membership, age or address. Qualified EAAs issued by qualified trust service providers have the same legal effect as lawfully issued paper attestations. Public authorities and private issuers, including universities, chambers and companies, can become issuers. For businesses, attestations open new possibilities: verifying a supplier's licence, an employee's qualification or a customer's age without manual checks.

Issuers of attestations must meet requirements depending on the type of attestation. Qualified attestations may only be issued by qualified trust service providers, which are supervised and must verify attributes against authentic sources where the law provides for this. Non-qualified attestations can be issued by any provider but do not benefit from the same legal effect. Companies considering issuing attestations — for example training certificates for employees or loyalty status for customers — should assess which level is appropriate, how revocation will work and how liability for incorrect attestations is allocated.

New trust services

eIDAS 2 also extends the trust services framework. It introduces electronic attestations of attributes, qualified electronic archiving services for the long-term preservation of electronic documents, and qualified electronic ledgers, which establish a legal presumption of the unique and accurate chronological ordering and integrity of data records. It also strengthens the rules on qualified certificates for website authentication. For companies, these services can support digital document retention, supply chain records and the authentication of their websites towards customers.

The European Business Wallet

On 19 November 2025, the Commission proposed a regulation on the establishment of European Business Wallets (COM(2025) 838). The proposal would give companies and public sector bodies a wallet to identify and authenticate, sign and seal, exchange official documents and receive notifications, and to manage representation rights and authorisations, building on the EUDI framework. As proposed, public sector bodies would have to allow economic operators to identify, sign, submit documents and send or receive notifications using European Business Wallets within 24 months of entry into force for reporting obligations and administrative procedures.

In the Council, the presidency prepared a compromise text for a general approach at the Telecommunications Council of 9 June 2026 (Council document 9684/26); the European Parliament's rapporteur published a draft report on 20 March 2026. At the time of the latest sources we reviewed, the regulation had not been adopted. For German companies, the business wallet could significantly simplify interaction with registers, tax and customs authorities and cross-border procedures, and it would interact with company law processes such as commercial register filings.

In Germany, many filings with the commercial register still require notarial involvement. According to the Council's compromise text, national administrative and procedural requirements would continue to apply, so such requirements would not simply disappear. Its value lies rather in day-to-day interactions: proving the identity of a company and its representatives, presenting register extracts and tax attestations as verifiable credentials, managing powers of attorney for employees, and receiving official notifications through a qualified electronic registered delivery service. Companies with cross-border activities could benefit most, because the same credentials would be recognised in all Member States.

A roadmap for companies

1. Determine whether the company is a private relying party subject to the acceptance obligation, taking into account the exemption for micro and small enterprises.
2. Identify the processes where wallet use makes sense: onboarding, login, age checks, signatures, proof of qualifications.
3. Define the minimum data set for each use case and prepare the registration as a relying party.
4. Adapt anti-money laundering procedures, terms and conditions and privacy notices.
5. Plan the technical integration with authentication and customer relationship systems.
6. Monitor the German national wallet and its timetable, as well as guidance from the competent German authorities.
7. Assess whether the company could act as issuer of attestations, for example for employee qualifications or customer status.

Early movers can turn the obligation into an advantage: faster onboarding, fewer abandoned sign-ups and lower fraud risk are among the benefits the European Digital Identity Framework is intended to deliver.

How TRW & Co helps with the EUDI Wallet

We advise banks, insurers, energy, telecommunications and digital companies on EUDI Wallet acceptance obligations, relying party registration, onboarding and authentication processes, anti-money laundering identification, electronic signatures and data protection. We also advise issuers of electronic attestations and companies preparing for the European Business Wallet. See our pages on data and digital and GDPR and data protection, or contact us.