The EUDI Wallet mandate: what regulated payment companies need to know before December 2026

Europe is about to give every citizen and resident a government identity wallet, and then require regulated companies to accept it. For payment companies, this is not a future consideration. The first deadline is this December. The second, the one that binds you directly, follows twelve months later.

What eIDAS 2.0 is

eIDAS 2.0 is Regulation (EU) 2024/1183, which amends the original 2014 eIDAS regulation on electronic identification and trust services. Its centre is the European Digital Identity Wallet: an app, provided or recognised by each member state, that holds a person's identification data and other signed attestations, such as a driving licence, a diploma, or proof of address.

The wallet is built around selective disclosure. A relying party asks for specific attributes, the user sees who is asking and why, and only the approved attributes are shared, each still signed by the issuer. Relying parties register in their member state and receive an access certificate before they can request anything.

Deadline one: December 2026

Each member state must provide at least one EUDI Wallet within 24 months of the implementing acts entering into force. Those acts took effect on 24 December 2024, so the deadline is 24 December 2026. National rollouts vary in timing and polish, but by the end of this year, every EU market should have a government wallet available to its population.

Deadline two: December 2027

Article 5f is where payment companies come in. Private relying parties that are required by law or by contract to use strong user authentication for online identification must accept the EUDI Wallet when a user chooses to use it. The regulation names banking and financial services explicitly. The deadline is 36 months after the implementing acts: 24 December 2027. Micro and small enterprises are exempt.

Payment institutions already apply strong customer authentication under PSD2, so they sit squarely in scope. In practice, a customer in any member state will be able to open an account with you by presenting their wallet, and you will need to be able to receive it. The new EU Anti-Money Laundering Regulation, applicable from July 2027, points the same direction for customer due diligence.

What to do before December

Register as a relying party in your home member state and decide exactly which attributes each flow needs. Expect 27 wallets sharing common protocols but launching on different schedules, with different issuers behind them. Update your onboarding policy so a wallet presentation is a first-class verification method, not an exception routed to manual review.

And treat it as a chance to stop storing what you do not need. A wallet presentation gives you signed attributes, not a passport scan and a selfie. Our comparison with legacy KYC walks through what that changes for fraud and data retention.

Europe is not alone

The same shift is happening in the US, where regulators confirmed in September that government-issued digital credentials satisfy the CIP rule, and in India, where DigiLocker is already live. A payment company that serves all three should not build three integrations. Syntex aggregates EUDI Wallets alongside DigiLocker and the US state schemes behind one API.