The European Digital Identity Wallet is entering one of the most consequential phases of its rollout, and few people are closer to the work than Esther Makaay, VP of Digital Identity at Signicat. After spending the last three years at the center of the European Identity Wallet Consortium (EWC), Esther joined us for a deep-dive presentation on what the Large-Scale Pilots have actually delivered, and how ready Europe truly is for the 2026 deadline.
Across payments, travel, and organizational identity, Esther walked through the key results from the pilots: what worked, what didn’t, which technical and regulatory pieces are still missing, and the biggest barriers to adoption that Member States and the private sector now need to solve. She also examined interoperability tests, trust infrastructure gaps, signing flows, business models, governance frameworks, and the early findings from user adoption research.
Below are the core takeaways from her presentation, distilled into the critical insights anyone working in digital identity, payments, or IAM needs to understand as Europe moves into the final countdown toward the EUDI Wallet becoming a reality.
Here are Esther's slides in pdf.
Big Picture: What the EUDI Wallet Is & Why It Matters
- A mandatory, government-issued digital identity wallet for all EU/EEA residents by Dec 2026 (with EEA nations getting +1 year).
- Provides national PID (core ID attributes).
- Usable across borders, public and private sector.
- Extensible with verified attributes (attestations).
- Wallets will become central to payments, travel, organizational identity, and trust services under eIDAS2.
State of Readiness: Europe Is Not on Track
- Many Member States haven’t announced how they’ll deliver wallets.
- The Netherlands already confirmed they will miss the 2026 deadline.
- Expect 30–50 wallets across the EU, including:
- At least one per Member State.
- Multiple certified wallets in countries with “open certification.”
- Dozens of “wild wallets” aligning to ARF but not fully certified.
- Commercial apps claiming “EUDI capabilities.”
- Key concern: non-interoperable dialects of the wallet will emerge.
- The biggest unknown: Can the trust infrastructure actually scale?
Payments: Feasible Today, but Major Gaps Remain
- Fraud drops 96–98% when identity + payments are combined (Scandinavian evidence).
- EWC proved card and account-to-account payments work with the wallet in real pilots.
- Two tested models:
- Bank-led flow: authenticate payments using the wallet (performed 49 live transactions).
- Merchant-captured flow: fast checkout + share PhotoID/loyalty credentials (performed 12 live transactions).
- User research:
- 80% found wallet checkout easier than standard banking flows.
- 59% preferred the wallet over bank authentication apps.
- Major blockers:
- Seamless UX (no app-switch) not yet possible.
- Liability unclear. This is a major issue for banks.
- No built-in mechanism for issuer monetization (getting paid for attestations).
Long-Term Payments Vision: One-Step Identity + Payment
- Future experience aims for:
- “EUDI Wallet Trust Mark” recognized by merchants.
- Combined presentation of payment credential + driving license.
- Biometric authentication triggering payment and compliance checks.
- No app switching (via Digital Credentials APIs).
- Technology is not ready yet, but the direction is clear.
Travel: High-Impact but Technically Constrained
- Travel is global → requires many ecosystem actors (airlines, hotels, ferries, airports, border control).
- Border control is a closed ecosystem; they don’t collaborate with private-sector travel actors.
- Core issue:
- PID has no photo and no unique identifiers → unusable for regulated travel sectors.
- ICAO DTC Type 1 (digital passport) doesn’t support selective disclosure → not GDPR compliant.
- DTC Type 2 specs are still unavailable.
- The realistic solution:
- Governments must issue a PhotoID attestation into the wallet (ISO/IEC TS 23220-2:2024).
- Without PhotoID issuance, travel use cases stall.
Travel pilots: real results
- Airline check-in using self-service flows.
- Off-airport biometric enrolment for passenger facilitation.
- Ferry booking, payment, and boarding (demonstrated publicly).
- ZKP age verification for discounted venue entry.
- Hotel guest registration reduced from 15 minutes → 2 minutes, saving ~10 staff hours/day for a 200-room hotel.
Organizational Identity & Business Wallets: Huge Value, High Complexity
- B2B and B2G (Business to Government) identity is mostly paper-based today. There’s enormous inefficiency.
- Business wallets are fundamentally different from personal wallets:
- Not mobile; cloud/on-prem/shared systems.
- Hold issuer, verifier, and holder roles simultaneously.
- Need semi-automated data exchange and system integrations.
- The EU is releasing separate legislation defining business wallets.
- Legal entity identity is difficult because:
- No biometrics.
- Every country registers companies differently.
- Many identifiers exist (VAT, LEI, tax IDs, etc).
Business wallet pilots showed clear wins:
- Automated public procurement (ESPD).
- Opening a corporate bank account.
- Supplier onboarding (KYS).
- PEPPOL e-receipt issuance.
- Cross-border company branch creation.
- Company-authorized business travel.
- Reduced admin load, faster onboarding, stronger fraud prevention.
Interoperability: Achievable But Only If Standards Freeze
- Cross-LSP interoperability was achieved once specs were precisely aligned.
- The hard part wasn’t the technology, it was agreeing on exact specification subsets.
- A continuously available EU-wide conformance testing environment is essential.
- Major open issue:
- Trust infrastructure scalability remains untested.
Signing: Complex, Fragmented, and Varies by Member State
- The wallet may support qualified signatures, but device capabilities are often insufficient.
- Most wallets will invoke an external QSCD (Qualified Signature and Seal Creation Device).
- Signing flows differ per country, per wallet, per device.
- Signing allows embedding:
- User identity
- Organizational roles/mandates
- Permission levels (e.g., spending limits)
Trust Infrastructure: The Weakest Link
EWC’s whitepaper identified major issues:
- Scalability: current eIDAS trust lists are not built for wallets.
- Availability: trust list outages today go unnoticed; future outages halt all transactions.
- Third-party trust (banks, IATA, ICAO, etc.) must be anchored, but no mechanism exists.
- Business wallets require different trust models than personal wallets.
This is one of the biggest existential risks to the EU digital identity ecosystem.
Governance: The Ecosystem Needs Sub-System Rulebooks
- eIDAS covers identity; but payments, travel, supply chain, and education all need additional governance frameworks.
- Existing regulatory overlaps (DORA, DMA, DSA, AMLR, NIS2) create compliance uncertainty.
- Expect sector-specific “mini-governance” models to emerge (similar to PSD2/SEPA rulebooks).
Business Models: The Elephant in the Room
- No clear mechanism for issuers or QTSPs to get paid.
- Privacy rules (unlinkability & untraceability) make monetization more difficult.
- Liability framework unclear → commercial actors hesitant to participate.
- Without monetization:
- Wallets risk becoming “minimal viable compliance” tools for government services.
- The broader private-sector value proposition won’t materialize.
Adoption: Current Expected Adoption is Only 29%
- Biggest barriers:
- User experience
- Privacy & security concerns
- Lack of trust
- Adoption varies heavily by region and culture:
- Nordics: “Why do we need this? We already have BankID.”
- Sweden: More optimistic/curious about new tech.
- Need sector-specific communication to clarify benefits (payments, travel, government, education).
Looking Ahead: New LSPs (2025–2027)
Two new mega-pilots have started:
WE BUILD (Dutch Chamber of Commerce)
- Focus: organizational identity, supply chain, business workflows, payments.
- An even larger consortium than EWC.
Aptitude (France)
- Focus: travel, payments, vehicle registration.
AI Agents & Delegated Authority (Q&A Highlights)
- Esther believes AI agents will need wallets to prove:
- Who authorized them
- What they are allowed to do
- Under which constraints
- Without wallets as a trust anchor, personal AI agents will not safely operate in regulated contexts.
- But wallet infrastructure itself still needs to mature before serious agent integration begins.
