1. Betaalvereniging Nederland
  2. Payments Association
  3. Society, politics and legislationSubmenu
  4. eIDAS 2.0 and paymentsSubmenu

eIDAS 2.0 – Digital identity and payments

The revised EU-regulation eIDAS 2.0 regulates ‘Electronic Identification and Trust Services’. Among others, the legislation has electronic identification in scope. As such, it introduces the ‘European Digital Identity Wallet’ (EUDIW). This digital identity card holder can be used by citizens and organizations to identify themselves reliably and securely at a counter or on the Internet. The regulation, more specifically the EUDIW, also has an impact on payments in Europe.

The revised regulation entered into force on the 20th of May 2024. There are three important milestones for the development of EUDIWs:

  1. The European Commission develops so-called implementing acts (IAs). These are uniform technical specification and procedures for an EUDIW. This contributes to interoperability and acceptance of EUDI-wallets throughout Europe. The first set of IAs were published on 4 December 2024 and entered into force on 24 December 2024.
  2. Each Member States is required to provide at least one national EUDIW within 24 months after entry into force of the first set of IAs. As a result, Member States will have to offer an EUDIW to citizens and businesses in Europe the latest on 24 December 2026.
  3. So-called relying parties – natural or legal persons that rely upon electronic identification – that are required by law or contractual obligation to perform strong user authentication for online identification, are required to accept EUDIWs within 36 months after entry into force of the first set of IAs, i.e. 24 December 2027. Importantly, relying parties include banks, payment- and electronic money institutions.

Impact of eIDAS 2.0 on payments - Launch TFeIDAS

While the text of the eIDAS 2.0 regulation and the first set of implementing acts regarding the EUDIW are finalised, a conclusive interpretation of the scope of acceptance and impact on payments remains unclear. The Dutch Payments Association therefore established the taskforce “TFeIDAS” with several members to assess the impact of the EUDIW on payment processes. This assessment led to the drafting of an industry guidance paper.

Industry guidance paper: The EU Digital Identity Wallet in payments: Interpretation of legislators’ intention and feasibility assessment

The Dutch Payments Association drafted the industry guidance paper together with the TFeIDAS. The goal of the paper is to provide guidance to members of the Dutch Payments Association and other (public and private) stakeholders by interpreting the intended scope of acceptance of the EUDIW in payments, required by eIDAS 2.0. Importantly, this paper is not a legal interpretation on the scope of acceptance of the EUDIW in payments and should not be viewed as one. The TFeIDAS reached several conclusions:

  • Strong user authentication (SUA) under eIDAS 2.0 refers to the concept of two-factor authentication (2FA), but 2FA is only a small part of the complex concept that is strong customer authentication (SCA) for payment services (under PSD2). The EUDIW is intended to be accepted as a 2FA tool in online (payment) processes where SCA is required (defined in art. 97(1) PSD2) and the specific authentication falls in scope of ‘online identification’.
  • It seems impossible for PSPs to adhere to both the intended acceptance of the EUDIW mandated by eIDAS 2.0, namely as 2FA tool, while adhering to the SCA requirements laid down in PSD2 and the dedicated Regulatory Technical Standard on SCA ((EU) (2018/389)). More clarity and guidance from the legislator is required to determine how to utilise the EUDIW within the payment context while complying with PSD2 RTS requirements.
  • In addition to accepting the EUDIW as a 2FA tool in processes where SCA for online identification is required, eIDAS 2.0 does not impose any additional acceptance obligations of other wallet functionalities on PSPs, such as acceptance of electronic attestations of attributes (EAAs) or electronic signatures. Moreover, PSPs are not mandated to issue EAAs.

Large Scale Pilots

TThe European Commission launched four large scale pilots (LSPs) where public and private stakeholders collectively explore a whole range of possible use cases around the EUDIW, including payments. The four LSPs are Potential, DC4EU, NOBID consortium and EWC. The latter two are relevant for payments. The European Commission recently launched a new call for LSPs, in which payments is again one of the use cases.

Contact regarding eIDAS 2.0 and payments

Do you have questions about digital identity with eIDAS 2.0 and payments? Please fill out this contact form.

    Sluiten
    Woordenlijst bekijken