EU Digital Identity Wallet in payments: interpretation and feasibility assessment
Source : Dutch Payments AssociationThe eIDAS 2.0 Regulation introduces the European Digital Identity Wallet (EUDIW). The wallet must be issued by all EU Member States and made available to both natural persons and legal entities, for voluntary use. The EUDIW is intended as an additional means of identification and authentication for both public and private services across the EU.
The regulation requires designated private service providers — including those in the payments sector — to integrate and accept EUDIWs. However, while the legal text is final, a conclusive interpretation of the scope of acceptance and impact on payments remains unclear.
In collaboration with the Taskforce eIDAS 2.0 and INNOPAY, the Dutch Payments Association has therefore assessed the legislators’ intended implications of eIDAS 2.0 and the EUDIW for payment processes. The Taskforce provides guidance for the payments industry by interpreting the intended scope of acceptance of the EUDIW in payments.
Our public interpretation and assessment highlights three key takeaways:
- Interpretation of legislators’ intention
It is the intention of the legislator that acceptance of the EUDIW is mandatory for alternative two-factor authentication (2FA) where ‘strong user authentication’ (SUA) is required for online identification.
In the context of payments and PSD2, it is important to recognize that ‘strong customer authentication’ (SCA) entails much more than just 2FA. SCA has additional requirements. - Feasibility concerns
The intended scope of the legislator for accepting the EUDIW as alternative 2FA tool, seems unfeasible in today’s regulatory context for payments. Accepting the EUDIW for 2FA while also fully adhering to SCA requirements in PSD2 and to the Regulatory Technical Standards (RTS) for SCA appears impossible for PSPs. More clarity and guidance is needed to determine how to use the EUDIW for payments in compliance with PSD2/RTS. - Scope of obligations
Beyond accepting EUDIW for 2FA, eIDAS 2.0 does not impose obligations for PSPs for using other wallet functionality, such as accepting electronic signatures or ‘electronic attestations of attributes’ (EAAs). PSPs are also not required to issue EAAs.
The Payments Association engages with stakeholders and regulators to ensure a secure, interoperable, compliant and practical digital identity framework for European payments.
Please note that our paper does not provide a legal interpretation!