The EUDI Wallet in Banking: Onboarding, Authentication, Payments and Liability

Banks will meet the European Digital Identity Wallet in three places: when a customer opens an account, when they log in or approve an operation and, possibly, when they pay. Each use falls under a different law, with a different deadline and a different set of open questions.

This article separates the three uses, sets out what each law requires and lists what banks are still asking regulators.

Three Uses, Three Laws

What Changes for the Customer

It helps to picture the customer side before looking at the law.

A customer in 2028 wants to open an account with a bank in another member state. Today, that usually means photographing a passport, taking a selfie and sometimes waiting for a manual review. With a wallet, the bank’s app shows a request: the bank asks for name, date of birth, nationality and address for account opening. The customer sees exactly what is requested, approves on the phone and the account opening continues. No document photo is uploaded.

A week later, the customer logs in to the bank’s app. Alongside the bank’s own login, there is an option to authenticate with the wallet. The customer chooses it, confirms with the phone’s biometrics and is in.

Later, the customer approves a large transfer. The bank shows the amount and the payee. The customer confirms in the wallet, which binds the approval to those details.

Each step falls under a different rule. The first is due diligence under the AML Regulation. The second is strong authentication under eIDAS 2.0. The third is payment authorisation under PSD2 and, later, the Payment Services Regulation. Banks need to handle all three, even though the customer sees one wallet.

Account Opening

AMLA’s final draft due diligence standards accept electronic identification at eIDAS assurance level substantial or high, including the EUDI Wallet, to verify a customer. Several providers reading the text describe remote document and selfie checks as a fallback that banks must justify.

For banks, the wallet offers a cleaner onboarding route: identity data signed by a member state, shared with the customer’s consent, with no document photo to inspect. The limit is coverage. Wallets will arrive country by country from December 2026, and adoption will take time.

Strong Customer Authentication

Article 5f of eIDAS 2.0 is the hard obligation. By 24 December 2027, private relying parties that must use strong user authentication by law or contract have to accept the wallet when a user asks to use it. Banks, payment service providers and electronic money institutions are clearly in scope.

This raises practical questions. Can a bank let a customer use the wallet as one of its authentication factors? Does the bank need an outsourcing agreement with every wallet provider? OneSpan has argued that one could read the rules that way. Stibbe notes that PSD2 also requires dynamic linking, where the amount and payee are bound to the authentication. Wallets have to support that for payments.

Payments

The wallet’s payment specification, known as TS12, defines how a wallet performs strong customer authentication for card and account payments and for payment mandates. That gives banks a standard way to accept a wallet-based approval.

The Payment Services Regulation will replace much of PSD2. Its political agreement dates from 27 November 2025. According to Sopra Steria, the Council and the Parliament’s ECON committee endorsed the final compromise in spring 2026, with publication expected in the second half of the year and compliance projected for around 2028. Several providers describe the PSR as allowing delegated authentication, where a payment provider relies on a third party such as a wallet. Confirm the final text once it is published.

How Integration Works

For a bank’s technology team, accepting the wallet involves a few building blocks.

• Registration. The bank registers as a relying party in its home member state and declares which data it will request and why. It receives credentials that prove its registration to the wallet.
• Presentation protocol. Wallets present data using standard protocols based on OpenID for Verifiable Presentations, for online use, and ISO standards for in-person use. The bank’s systems send a request and receive a signed response.
• Trust lists. To check that data was issued by a legitimate member state or provider, the bank checks signatures against trusted lists maintained under eIDAS. This replaces the visual inspection of documents with cryptographic verification.
• Data handling. The bank stores the evidence of verification and the data it needs, in line with AML record-keeping and data protection rules.

Most banks will not build all of this themselves. Identity verification providers, trust service providers and core banking vendors are adding wallet acceptance to their products. The practical choice for many banks is which partner to use and how to keep the option to switch.

Two Payment Models

There are two broad ways the wallet can enter payments.

• Cards inside the wallet. Existing payment cards are digitised and stored in the wallet, much as commercial phone wallets do today. The wallet becomes another place to hold a card. This model fits existing card schemes but adds little that commercial wallets do not already offer.
• The wallet as the authentication layer. The customer pays with existing methods, such as a card, a bank transfer or an instant payment. The wallet is used to authenticate and approve the payment. TS12 is designed for this case, including payment mandates.

Most banks see the second model as more realistic in the short term. It reuses the wallet’s strongest feature, trusted identity and authentication, without competing head-on with established payment apps.

What German Banks Said

On 16 October 2026, the Deutsche Kreditwirtschaft, the umbrella body of German banking associations, set out its position on Germany’s d-you wallet. It accepts the wallet for account opening and as strong customer authentication. It wants clear rules on who is liable when the wallet fails. It rejects any obligation to offer payments through the wallet.

That position is a useful summary of where many European banks stand. Identity and authentication: yes. Liability: unresolved. Payments: not an obligation.

Industry Views from the Pilots

Large-scale pilots have tested banking and payment uses since 2023. At the Global Digital Collaboration Conference in Geneva in September 2026, Marie Austenaa, SVP Identity Solutions at Mastercard and co-lead of the payments domain in the WE BUILD consortium, spoke on the wallet in consumer banking and payments. Banca Transilvania presented its view on how the wallet could change card authentication and checkout.

The common thread is that payments are possible with the wallet but not yet a business model. Identity and authentication come first.

What Customers Know

Awareness is low. In a 2026 Fourthline survey of 6,000 adults in six countries, only 3% said they knew something about the EUDI Wallet. The same survey found that 78% would accept a slower check if it reduced fraud risk. Banks will need to explain the wallet, not only integrate it.

Liability Options on the Table

Liability is the question banks raise most often. When a customer authenticates with a wallet and the operation turns out to be fraudulent, who pays?

Several options are being discussed in the industry.

• The bank bears the risk, as today. The wallet is treated as one more authentication method. The bank remains responsible to the customer under payment rules. This is simple but makes banks wary of relying on a tool they do not control.
• Liability follows the failure. If the wallet or its issuer failed, they bear the loss. If the bank’s systems failed, the bank does. This is fairer but needs clear rules and evidence to decide where the failure happened.
• Contractual allocation. Banks agree terms with wallet providers or member states. With 27 national wallets, negotiating separately with each is heavy.

The Payment Services Regulation also shifts responsibility in some fraud cases. According to Sopra Steria’s analysis, successful strong customer authentication will no longer count as proof of customer negligence. That raises the stakes for any authentication method a bank accepts, including the wallet.

The Business Case

Compliance is the reason most banks will accept the wallet. It is not the only benefit.

• Lower onboarding cost. Signed data from a member state needs less manual review than a document photo and a selfie.
• Fewer abandoned applications. A short approval on the phone is faster than capturing documents in good light.
• Cross-border reach. A bank can onboard customers from other member states with the same flow, which supports growth beyond the home market.
• Less fraud at onboarding. Cryptographic verification is harder to fake than images, as deepfakes and injection attacks grow.
• Better data quality. Names, dates and addresses arrive in a structured, verified form, so fewer records need correcting later.

The case depends on adoption. In the first years, most customers will not have a wallet. Banks that build acceptance early will capture the benefits as adoption grows, rather than starting from zero in December 2027.

What It Means for Portuguese Banks

Portuguese banks start ahead of many European peers. Their customers already use the Chave Móvel Digital and the citizen card, both notified at high assurance and available through Autenticação.gov. Remote account opening with these credentials is familiar to customers and to compliance teams.

Three things still need work. First, Portugal had not published a name or launch date for its EUDI Wallet by October 2026, so banks cannot yet test against a national wallet. Second, the acceptance obligation covers wallets from every member state, not only Portugal’s, so banks serving foreign residents or the Portuguese diaspora need cross-border testing. Third, the payment side of the Portuguese ecosystem, built around SIBS and its national schemes, will need to decide how wallet-based authentication fits alongside existing methods.

Multicert, the SIBS trust services company, has already integrated remote identity proofing into its qualified services and prepared for the new ETSI biometric testing rules. That kind of local infrastructure gives Portuguese banks options when they choose partners.

Questions to Ask a Wallet Integration Partner

• Which national wallets have you tested against and in which sandboxes?
• How do you handle relying-party registration in each member state where we operate?
• Do you support both online presentation and in-person use?
• How will you support TS12 payment authentication and dynamic linking?
• What evidence of each verification do you store, where and for how long?
• How quickly can you add a new national wallet when it launches?

A 2027 Action Plan for Banks

• Run a gap analysis. Compare current onboarding and authentication flows with what the AMLR and Article 5f require.
• Register as a relying party in your home member state and decide which attributes you need.
• Test in sandboxes against more than one national wallet. Interoperability gaps will show up there first.
• Decide your scope. Onboarding and authentication are required. Payments are optional for now. Make that a deliberate choice.
• Work through liability with legal and risk teams. Map what happens when a wallet credential is wrong, compromised or revoked.
• Prepare customer communication. With 3% awareness, the bank’s app and branch staff will be where most customers first hear about the wallet.
• Keep the fallback. Customers without a wallet will need another route for years.
• Measure from day one. Track how many customers choose the wallet, how many complete each journey and how fraud rates compare with other routes. Those numbers will decide how much further to invest after December 2027.
• Share what you learn. The banks that move first will shape how supervisors and wallet providers see the issues. Industry forums, pilots and conferences such as LisbonID in May 2027 are where those lessons spread. Banks that only watch will inherit decisions made by others.

Frequently Asked Questions