Skip to content

Build1 publisher3 min readPublished

The EUDI Wallet hands your KYC pipeline a signature instead of a document photo

Regulation (EU) 2024/1183 obliges large regulated relying parties to accept wallet presentations by December 2027. The work is a second verification path whose input an OCR stack was never built to receive.

The Engineer · Build desk

What happened

  • eIDAS 2.0, Regulation (EU) 2024/1183, entered into force in 2024 and requires every EU Member State to offer citizens a government-backed European Digital Identity Wallet.
  • Member States are expected to have wallets available by the end of 2026, with cross-border interoperability testing already running in several countries.
  • By December 2027, large regulated private-sector relying parties including banks, fintechs, insurers and telecoms must accept the EUDI Wallet for authentication.
  • The EU's Anti-Money Laundering Regulation reaches full application on a similar 2027 timeline and limits reliance to notified national digital ID schemes, the wallet, or qualified trust services.

Compiled by The EngineerSomething wrong?How this is made

Why it matters

  • cost The write-off lands on the most expensive parts of a document-based stack: image capture and OCR, hologram and microprint detection, and human review queues for ID photos.
  • constraint Attribute-level disclosure caps what a risk engine can see, so scoring models keyed on document fields have to be rebuilt around whatever few claims the relying party is entitled to request.
  • decision Budgets have to carry two verification paths at once through 2027, because the acceptance obligation adds a verifier without switching anything off.
  • exposure The regulated firm keeps the relying-party registration and the legal reading of its own AMLR duties, so outsourcing the cryptography does not move the liability for getting the status wrong.

Take the input first. What the wallet hands over is a signed attestation, a W3C Verifiable Credential or an mDL-style object issued by a trusted authority, with the holder choosing which attributes go into any given presentation [5]. Verifying it is signature validation plus a walk up the issuer chain to a registry of trusted issuers [6]. Nothing in that path resembles image capture, and physical security-feature detection has nothing left to inspect [7]. A manual document-review queue built to stare at ID photos will be very fast at reviewing zero of them.

One item on the post's requirements list constrains the design rather than describing it: revocation status has to be checkable without a synchronous callback to the issuer [10]. That rules out the obvious implementation. A verifier that calls the issuer at presentation time puts another organisation's uptime inside its own latency budget, and it tells that issuer which relying party is checking which subject. The post specifies the property; it leaves the mechanism that delivers it unstated.

The carry-over list is where I would push back. Fraud and risk scoring, AML and sanctions screening, case management and audit logging all survive, the post says, running against a different kind of verified input [8]. They survive as boxes on a diagram. Attribute-level selective disclosure means the relying party receives the claim it asked for and nothing more, in line with the data-minimisation principle the post ties to both AMLR and eIDAS 2.0 [9]. Any risk feature derived from the document image, or from fields you never asked for but always got, leaves with the image. Re-keying a scoring model onto a handful of asserted attributes is a modelling project, not an integration.

The deadline does less work than it first appears to. The December 2027 obligation, as the post states it, is that large regulated relying parties accept the wallet for authentication [3]. Acceptance is additive: it obliges a verifier path while leaving the existing stack in place. What would actually retire document scanning is AMLR's narrowing of permitted verification methods to eIDAS-notified national schemes, the wallet, or qualified trust services [4], and that reading is carried by this one post. The integration window is the tighter number. Wallets are expected to be available across Member States by the end of 2026 [2], which leaves twelve months to test against real presentations before the obligation binds [15], out of three years total since the regulation entered into force in 2024 [14].

The mapping in the post is to Hypersign, a DID Core and VC 1.1/2.0 stack with EdDSA/Ed25519, ES256K/Secp256k1 and BBS+ signatures, which the post says issues credentials aligned with the eIDAS 2.0 framework and the EUDI Wallet specification [13]. A feature list can claim alignment; only a conformance result proves it. For that claim to transfer to your build, presentations would have to verify against an actual national trust registry, and interoperability would have to be shown against a wallet reference implementation rather than against the vendor's own issuer.

What to watch

  • Whether Member States actually ship usable wallets by the end of 2026, since the twelve-month test window depends on it.
  • Supervisory guidance under AMLR that confirms or contradicts the reading that passport-scan flows fall outside the three permitted methods.
  • Published conformance results against a national trust registry, as opposed to vendor claims of alignment with the EUDI Wallet specification.
Loading claim ledger
Loading source directory links
Loading share composer
Loading topic controls
Loading related stories