eIDAS 2.0 and AMLR will reshape digital onboarding in Europe

At a glance

What this is: This analysis says Europe is moving from fragmented KYC and identity onboarding toward wallet-based, attribute-driven trust flows under eIDAS 2.0 and AMLR.

Why it matters: IAM, fraud and compliance teams need to prepare for identity proofing, wallet acceptance and ongoing monitoring to converge into one regulated onboarding model.

Context

Europe’s onboarding and identity verification model is shifting from document collection toward reusable, wallet-based credentials and selectively disclosed attributes. The regulatory driver is not just one law, but the convergence of digital identity, anti-money laundering obligations and AI-enabled fraud pressures that now affect onboarding design across sectors.

The practical issue is governance, not availability. A wallet can reduce friction, but it does not remove accountability for identity assurance, customer due diligence or ongoing risk decisions, especially where regulated firms must reconcile national eID schemes, biometric verification and cross-border acceptance. The question for practitioners is how to build trust flows that are interoperable, risk-based and auditable, not merely compliant on paper.

Key questions

Q: How should organisations design onboarding when digital wallets, KYC and AML controls converge?

A: Treat onboarding as a governed decision chain, not a document collection exercise. Define which identity attributes are sufficient for each risk tier, log the evidence behind every acceptance decision and keep a supervised fallback for cases where wallet-based verification is unavailable or inappropriate. The goal is proportional assurance, not uniform friction.

Q: Why do digital identity wallets change the privacy risk model?

A: Wallets reduce privacy risk because they can share only the minimum claim needed for a transaction instead of exposing a full identity record. The trade-off is that relying parties must stop defaulting to broad data collection and instead enforce purpose-limited access to only the attributes required for the service.

Q: What breaks when organisations treat a wallet as a compliance checkbox?

A: The onboarding model becomes rigid and brittle. If the wallet is treated as a fixed control instead of part of a risk-based workflow, teams lose the ability to use fallback identity methods, document supervisory justification or adapt to different customer journeys. That creates both operational failure and compliance exposure.

Q: Should identity teams prioritise wallet readiness or fraud controls first?

A: They should do both in sequence, but fraud resilience must come first where remote onboarding is already exposed to synthetic identity and deepfake abuse. Wallet readiness matters for interoperability and future acceptance, but a wallet does not by itself prove that the verification stack can resist manipulation.

Technical breakdown

How eIDAS 2.0 changes identity assurance architecture

eIDAS 2.0 changes the architecture of assurance by shifting verification from one-off document checks to reusable digital credentials held in a European Digital Identity Wallet. The important technical change is selective disclosure: a relying party can receive specific attributes such as age, role or residency without collecting the full identity record. That reduces data exposure and onboarding friction, but it also introduces new trust dependencies around issuer assurance, wallet integrity, credential presentation and verification policy. Identity proofing, authentication and attribute verification become parts of one orchestration layer rather than separate steps. See the Digital Identity, eID and Identity Wallets Guide.

Practical implication: Design onboarding so wallet assertions, fallback eID flows and internal policy checks are all governed as one assurance chain.

Why AMLR pushes identity verification into a regulated workflow

The AMLR makes identity verification part of a supervised compliance workflow rather than a local business choice. Customer due diligence now depends on how firms justify identification methods, verify beneficial owners and document the use of digital identification means or trust services. That means the technical control surface expands from front-end onboarding into evidence handling, audit trails, risk scoring and exception management. A wallet may supply higher-quality identity attributes, but the institution still has to prove that the chosen flow was proportionate to the risk and appropriate to the customer journey. See the Financial Services Identity Security Guide.

Practical implication: Tie KYC method selection, evidence retention and escalation rules to explicit AML risk criteria and supervisory review.

How AI-driven fraud changes remote identity proofing

AI-generated deepfakes, synthetic identities and automated phishing are changing the attacker model for remote onboarding. Traditional checks that relied on static document inspection are weaker when adversaries can generate convincing artefacts and adapt quickly. That is why modern identity proofing increasingly combines liveness detection, behavioural signals, device intelligence and presentation-attack detection. The technical point is that fraud prevention is no longer a single control but a layered decision engine that must distinguish genuine users from engineered personas in real time. See the Identity Proofing and KYC Guide.

Practical implication: Harden remote proofing with layered fraud signals instead of relying on document capture alone.

Threat narrative

Attacker objective: The attacker’s objective is to pass onboarding controls with a false or manipulated identity and convert that trust into account access, financial abuse or regulatory evasion.

1. Entry begins with synthetic identities, deepfake-supported onboarding attempts or automated phishing against identity flows.
2. Credential_harvested or manipulated identity material is then used to satisfy weak proofing steps or influence wallet and KYC processes.
3. Escalation occurs when attackers obtain accepted identity attributes or onboarding approval that lets them open accounts, move funds or impersonate legitimate entities.
4. Impact is fraudulent account creation, compliance failure, or trusted access into regulated services at scale.

Breaches seen in the wild

• Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Attribute-based verification is becoming the new control plane for digital onboarding. The article is right to treat attributes as the real architectural shift, not simply wallet adoption. Once organisations rely on selective disclosure for role, residence, qualification or beneficial ownership, the governance problem moves from collecting identity data to deciding which attributes are sufficient for which trust decision. Practitioners should redesign onboarding policy around attribute authority, not just identity source.

AML and digital identity are converging into one evidence chain. The article shows that wallet acceptance, customer due diligence and supervisory justification now sit in the same operating model. That means identity teams can no longer treat KYC, trust services and audit evidence as separate workstreams. The practical implication is a unified control model that traces how a credential was issued, presented, accepted and recorded.

AI fraud is forcing identity assurance to become adaptive, not static. Deepfakes and synthetic identities break assumptions that once made remote proofing predictable. The right response is not to over-trust biometrics or wallets, but to design layered decisioning that can react to fraud signals without collapsing user experience. Practitioners should assume the attacker will target the weakest point in the identity journey, not the strongest.

KYB and emerging KYA flows will expose a new governance gap. The article’s discussion of business wallets and agent identity is important because it extends onboarding beyond human customers. Once organisations must verify companies and autonomous actors, lifecycle, authority and monitoring controls become as important as initial proofing. Practitioners should start mapping which non-human or delegated actors will inherit trust from the same onboarding stack.

Scaled trust infrastructure will become a competitive filter, not just a compliance cost. The article points to a market where interoperability, auditability and resilience determine who can operate at continental scale. That favours organisations that can govern identity issuance, verification and acceptance as a durable service model rather than a set of isolated projects. The lesson for practitioners is to treat trust architecture as strategic infrastructure, not a bolt-on control.

What this signals

Identity orchestration will replace point-solution onboarding. The operational shift is not simply adopting a new credential format. It is building a control plane that can route a customer through wallet-based verification, biometric fallback, enhanced due diligence and audit capture without breaking policy consistency. Organisations that still manage each path separately will struggle to keep pace with supervisory scrutiny.

Business wallets will extend the identity problem into organisational trust. Once companies and autonomous actors need verifiable credentials, the same governance logic used for customers will have to cover delegated authority, lifecycle control and revocation. That is a material change for IAM and KYC teams because the trust boundary now includes entities that are not human and may not behave like traditional accounts.

Europe’s shift is toward evidence-led identity governance. The practical implication for programmes is clear: every acceptance decision will need to be explainable, proportionate and retraceable. Teams should expect greater pressure to prove why a specific identity method was used, what alternatives were rejected and how fraud signals were handled across the journey.

For practitioners

• Map onboarding journeys by assurance level Separate flows for low-risk, standard and high-risk onboarding so that wallet-based verification, biometric proofing and enhanced due diligence are only used where policy justifies them.
• Build a unified evidence trail for KYC decisions Record which identity method was used, why it was chosen, what attributes were accepted and how the decision was validated for audit and supervisory review.
• Test fraud controls against AI-generated attacks Red-team onboarding with synthetic identities, deepfake media and automated phishing to verify that liveness, behavioural and exception controls still hold.
• Prepare for wallet acceptance at service boundaries Review which authentication and onboarding systems will need to accept external identity credentials, then define fallback paths for users who cannot or will not use the wallet.

Key takeaways

• Europe’s onboarding model is moving toward wallet-based and attribute-based identity verification, with stronger links between digital identity and AML governance.
• The main risk is not the absence of technology, but the failure to govern which identity method is used for which risk scenario and how that choice is evidenced.
• Practitioners should prepare for layered assurance, stronger fraud detection and auditable decision chains rather than treating wallet adoption as a standalone project.

Related NHI Mgmt Group resources: Identity Proofing and KYC Guide · Financial Services Identity Security Guide · NHI Lifecycle Management Guide · Ultimate Guide to NHIs: Regulatory and Audit Perspectives

Key terms

• Digital Identity Wallet: A digital identity wallet is software that stores and presents credentials for a person or organisation. It is a portability layer, not an authorization system. The wallet moves verified proof between parties, while the relying party still has to decide whether the proof is sufficient for the requested action.
• Attribute-Based Identity Verification: A verification approach that confirms specific claims such as age, address, or residency rather than exposing full identity documents. It improves privacy and data minimisation, but governance must still prove that each attribute is trusted, current, and sufficient for the regulated decision being made.
• Customer Due Diligence: Customer due diligence is the process of verifying a customer’s identity and understanding the risk attached to that relationship. Wallet-based presentations can streamline it, but the institution remains accountable for deciding which attributes are trusted and how exceptions are handled.
• Remote Identity Proofing: Remote identity proofing is the process of verifying that a person is who they claim to be without meeting in person. It combines document checks, biometric comparison, device and signal analysis, and fraud screening to establish confidence in identity remotely. It is used before account creation, recovery, or high-risk access.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle and secrets management in a way that helps practitioners connect identity controls to broader security programmes. It is useful for teams that need to align governance, access and assurance across modern identity ecosystems.