Identities and attestations

Digital interactions depend upon trust. Indeed, trust forms the bedrock of this new world where people don’t actually meet each other. Given the lack of the other person or entity’s physical presence, both parties in a digital interaction must accept the other’s assertion that they are indeed who they claim to be. Yet so much of the infrastructure that underpins this new reality is based upon scans of PDFs such as national IDs, renter contracts, and diplomas; easily cracked passwords that people struggle to remember; or storing your precious data – including financials such as payment cards – on third-party sites and hoping for the best. 

For users, the European Union’s eIDAS 2.0 regulation mandating all member states to offer their citizens access to the EU Digital Identity Wallet, or EUDI Wallet, by the end of 2026 probably comes as welcome news. Businesses and entities that require strong customer authentication (SCA) have to accept these wallets as valid proofs of identity by the end of 2027.

The idea is to provide a functional framework for a new kind of ecosystem, where one’s digital ID opens the door to a world of services with the least possible friction. But when the time comes, what will that actually mean for all participants in the new ecosystem? Let’s start by looking at the wallet itself.

What’s in your wallet?

The new EUDI Wallet will contain reusable verified credentials (VCs). As they reside in the user’s digital wallet, they are decentralized. They’re digitally signed proofs issued by a trusted party, and they work as a physical document would, establishing whether a person is a resident of a particular place, for instance, or what their age is at the time of asking. 

The base or identity layer is the Person Identification Data, or PID, such as the user’s name, age, and address, verified by a governmental agency. However, a wealth of further data can be added to the EUDI Wallet, such as your academic status, professional title, or nationality. These data points, or attributes, need to be electronically “attested.” These electronic attestations of attributes, or EAA, are issued by an authorized provider and confirm the accuracy of the specific claim. Once added, they can be stored and presented with the EUDI Wallet.¹ (Attestations represent a crucial business opportunity in this new ecosystem: we’ll return to this below.)

Crucially, the user can share these credentials as they see fit. The emphasis is shifting from the platform determining and storing a user’s identity, to the user taking control of how their identity is presented and verified. In essence, the user “proves who they are, on their own terms.” Among other things, the user decides:

• Which credential to share: for instance, one that proves they are an adult, or a citizen of an EU member state, or the possessor of a college degree, depending upon the situation and the question asked
• Whom to share the credential with
• When to share that credential 

These decentralized credentials establish who the user is, and can be used across banking, health, and education services – to name just a few sectors. Placing those VCs in the user’s control is a core part of the move toward self-sovereign identities, or SSI. Companies and other organizations that operate in fields requiring SCA should take note, as their identity infrastructure needs to be able to deal with the variety of credentials that will soon be presented. Organizational onboarding flows will have to accept EUDI Wallet–based identities; this includes banks, health insurance issuers, very large online platforms (VLOPS, which include social media giants and shopping platforms), and the like.

One field that is going to be heavily impacted is payments. In fact, payments and identities are on the path to convergence as the focus for payment service providers (PSPs) shifts from proving whether a user can pay, to proving who they are. Once the user’s identity is established, payment will follow automatically.

This isn’t just an IT upgrade. It is a fundamental reimagining of the flow of trust through the digital world. Agile organizations should treat this as an opportunity to rethink the entire journey, including their identity infrastructure.

The triggers for an ID infrastructure reset

As stated above, eIDAS 2.0 provides a regulatory deadline for acceptance of the EUDI Wallets. Further, identity verification during digital onboarding continues to be a relatively painful process, with a high percentage of abandonment. Additionally, you don’t have to be an IT expert to know that AI is fundamentally reshaping identity verification. Freely available software functioning on commercial machines can deliver deepfakes capable of defeating most video and photo ID checks. 

For companies, these checks are already a financial burden. The price rules out their application in cost-sensitive use cases, potentially keeping the company out of those sectors entirely. 

These existing technologies rely on visual examination. A verifiable credential cannot be faked in that way. It is either signed and ready to use, or not. A cryptographically verifiable decentralized identity changes the parameters of the game and moves the needle for your organization toward both 

1. compliance with eIDAS 2.0, and
2. dealing with the AI specter 

Once the infrastructure is in place, cryptographic verification of decentralized identities will be more cost-efficient than video checks. This opens a range of cost-sensitive use cases. Take micro-transaction gaming wallets: they may deliver low revenue, but deliver high value in future loyalty to your brand from a tech-forward user demographic. They also smooth digital onboarding.

Better user journeys

Among other ways the new EUDI Wallets will make life easier for users, consider the impact on what they’re obliged to hand over. Privacy is designed into these wallets. Selective disclosure is one guiding principle: a use case that requires a person to be 18, for instance to pick up certain medications, will be answered with a simple “yes/over 18” response. No physical ID needs to be displayed, which may have other information the user would rather keep private. The minimum data required to answer the question is shared.

Relatedly, filling out tedious forms could become a thing of the past. Verified data is shared with a tap of the wallet, at the required time. Questions of eligibility are answered as they arise, and the onboarding is completed. Less friction is good for the user and means less abandonment and thus higher conversions for the provider. Who doesn’t like a relationship where everybody wins?

Attestations: a new opportunity

Let’s return to attestations here: specifically, the further data we mentioned above that can be stored on the EUDI Wallet, in addition to the PID. Consider what happens when you’re issued a digital key to a hotel room on your phone. When you let yourself in, you’ve used the attestation issued by the hotel that you are that room’s inhabitant. Similarly, a university can offer a graduate the same service, an attestation they carry in a digital wallet that they can use when filling out a job application. 

The hotel and the university have turned the data they hold into attestations. Now, consider the data a bank holds about its clients, or a health insurance provider, or a gaming/gambling company. Are you insured in a particular place, and do you have travel coverage? Do you have an IBAN? Are you old enough to gamble in a particular place?

All of these can be issued quickly. A bank attestation and a hotel key can nestle next to a diploma and a membership card in a single wallet. Further, they can be monetized in ways that industry may not even have started to think of yet. Let’s return to the hotel key, or rather the hospitality sector. An agile operator could issue attestations for the user’s entire journey, from flight ticket, check-in, and room key to payment, travel eSIM, and loyalty program – all in the same wallet.

There is also a huge market of clubs, organizations, and associations that a user may belong to, and have physical cards for. Naturally, these can be issued as attestations as well. That same wallet lets you into a gym, gets you a tow if your car breaks down, and books – and pays for – your child’s tennis lesson.

The user doesn’t mind this burgeoning of credentials in their wallet, because each attestation is portable, reuseable, and fully in their control. As users are added, the ecosystem only grows, benefiting everyone.

As pointed out earlier, the hard deadline of the end of 2027 for acceptance of the EUDI Wallet extends to industries such as banking and payments, and to VLOPs. In effect, organizations in those sectors will be regulated into being compliant. But compliance brings readiness, and those companies will be well equipped in terms of infrastructure to pivot to use cases involving attestations. For everyone else, exploring attestations as a source of revenue in the new ecosystem should be an area of strategic focus. 

The market will only really open once relying parties integrate wallet acceptance into their operations. But once the ecosystem is up and running, enterprises that understand attestations will be ready. Everyone else could be playing catch-up.

The right partner

G+D Netcetera Identity operates where trust and compliance meet in the field of digital identities. For us, digital identities are a core business, and not a pivot. We offer an integrated suite of solutions, including connecting organizations to EUDI Wallets, enabling user-controlled decentralized identity exchange, and managing customer access, authentication, and the life cycle management. We are positioned to address the gap between where the market is and where regulation wants to drive it. 

As a European company, our solutions are independent of big-tech platforms. Given that EUDI Wallets stem from a standpoint of giving citizens back control over their data, this is a unique strength.

Further, G+D Netcetera’s solutions offer expertise in both identity management and decentralized identities. Our solution brIDge accepts incoming identities and verifies them against the anchoring registry. 

Once the entity is verified, mySSI steps in and “creates” the customer, including customer ID and payment credentials. The solution provides its own status list and is a software-as-a-service (SaaS) product. It enhances interoperability across the identity space, which in turn unlocks business opportunities, especially as the ecosystem gathers momentum as users are added. Finally, CIAM (customer identity and access management) enrolls the customer into an integrated system.

Published: 22/09/2026