Notifications
Clear all
Topic starter
06/06/2026 11:25 am
TL;DR: European banks face a converging set of EUDI wallet obligations under eIDAS 2.0, AMLR and the emerging PSR/PSD3 text, with voluntary wallet acceptance for strong customer authentication due by 24 December 2027, according to OneSpan. The unresolved issue is not whether banks must adapt, but how they will govern authentication assurance, outsourcing boundaries and fraud accountability as wallet diversity expands.
NHIMG editorial — based on content published by OneSpan: Pourquoi les banques européennes doivent agir dès maintenant concernant les portefeuilles EUDI
By the numbers:
- 24 December 2027: the date by which large and medium-sized relying parties in banking and other sectors must support EUDI wallets for strong user authentication.
- At least 27 EUDI wallets will exist, and probably many more, which makes outsourcing and assurance governance materially harder for banks.
- The final PSR text is expected around May 2026, leaving banks with a short planning window before implementation clarity arrives.
Questions worth separating out
Q: How should banks prepare for EUDI wallet support in customer authentication?
A: Banks should start by mapping every login and onboarding flow that may need to accept an EUDI wallet, then identify the assurance evidence each step requires.
Q: Why do EUDI wallets create governance complexity for banking identity teams?
A: EUDI wallets split the authentication experience across the bank, the wallet issuer and the trust framework behind the credential.
Q: What should organisations get wrong about using digital wallets for onboarding?
A: The common mistake is treating wallet acceptance as a front-end user experience change.
Practitioner guidance
- Map wallet-driven authentication dependencies Inventory every customer authentication and onboarding flow that could be touched by EUDI wallets, then document which steps rely on bank control, wallet issuer control or qualified trust service control.
- Redesign onboarding around verified attributes Replace document capture as the primary design assumption with attribute verification flows that can accept QEAA or equivalent high-assurance evidence.
- Test outsourcing thresholds against wallet integration Review whether any wallet-related integration creates a contractual outsourcing obligation under your internal policy or the final payment framework.
What's in the full article
OneSpan's full article covers the regulatory detail this post intentionally leaves for the source:
- Article-by-article breakdown of eIDAS 2.0, AMLR and PSR/PSD3 obligations affecting banks
- Interpretation of the DG Connect position on wallet acceptance and outsourcing boundaries
- Discussion of QEAA use in customer due diligence and the practical effect on onboarding design
- Timeline view of the 2026 and 2027 milestones that banking identity teams must plan against
👉 Read OneSpan's analysis of EUDI wallet requirements for banking identity →
EUDI wallets in banking: what identity teams need to prepare for?
Explore further
06/06/2026 12:12 pm
EUDI wallet support is a human identity governance change, not just a payments update. The article is about regulated customer authentication, so the core programme impact sits in human IAM, not NHI or autonomous identity. Banks will need to reconcile wallet-mediated assurance with existing authentication policy, customer enrolment and fraud controls. The practitioner conclusion is that wallet readiness belongs in identity architecture planning now, not after the final payment text lands.
A few things that frame the scale:
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The state of non-human identity security.
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, which shows how quickly trust boundaries become opaque when identity is delegated across systems.
A question worth separating out:
Q: Who is accountable when wallet-based authentication fails in a regulated bank?
A: Accountability should sit with the bank for the authentication decision, but the wallet ecosystem may own parts of the evidence chain and user credential handling. Until the final payment rules clarify liability, banks need explicit internal ownership for incident triage, customer remediation and vendor escalation.
👉 Read our full editorial: European EUDI wallet mandates are reshaping banking identity
