EU digital identity wallet for payments: interpretation and feasibility assessment

The eIDAS 2.0 regulation introduces the European digital identity wallet (EUDIW). This digital wallet is to be issued by all EU Member States and made available to both natural and legal persons for voluntary use. The EUDIW will be a complementary tool for identification and authentication, for both public and private services across the EU.

The regulation requires certain types of private service providers – including those in the payments industry – to integrate and accept EUDIWs. Although the legal text is final, an unambiguous interpretation of the scope of mandatory acceptance and the impact on payments remains unclear.

In cooperation with the eIDAS 2.0 Taskforce and INNOPAY, Dutch Payments Association therefore assessed the legislator’s intentions for eIDAS 2.0 and EUDIW in payment processes. The Taskforce provides guidance to the payments industry with an interpretation of the intended scope of mandatory EUDIW acceptance in payments.

Our public interpretation and assessment highlights three key findings:

1. Interpreting the legislator’s intentions
   It is the legislator’s intention that EUDIW be compulsorily accepted as an alternative two-factor authentication (2FA) when ‘strong user authentication’ (SUA) is required in online identification. In the context of payments and PSD2, it is important to realise that ‘strong customer authentication’ (SCA) involves much more than just 2FA. SCA imposes additional requirements.
2. Doubts about feasibility
   The legislator’s intended scope for accepting EUDIW as an alternative 2FA tool does not seem feasible in the current payments regulatory context. It seems impossible for PSPs to accept the EUDIW for 2FA while fully complying with the SCA requirements in PSD2 and the regulatory technical standards (RTS) for SCA. More clarity and guidance is needed to determine how to use the EUDIW for payments in line with PSD2/RTS.
3. Scope of obligations
   Besides accepting EUDIW for 2FA, eIDAS 2.0 does not impose obligations on PSPs for the use of other wallet functionality, such as accepting electronic signatures or ‘electronic attestations of attributes’ (EAAs). Nor are PSPs obliged to issue EAAs.

The Payments Association is working with stakeholders and regulators to ensure a secure, interoperable, legal and practical framework for use of digital identity in European payments.

NB: our document does not provide a legal interpretation!

Read our full interpretation and assessment..