The regulation and what it brings
Under eIDAS 2.0, the EU digital identity regulation, every EU country must offer its citizens at least one EU Digital Identity Wallet by Dec 24, 2026.
From Dec 24, 2027, banks and payment service providers (PSPs) must accept the identity wallet when a customer chooses to use it for strong authentication. This includes Strong Customer Authentication (SCA), as stated by the European Commission. The EU’s payment services rules (PSD2) require SCA for logging in, authorising payments and other sensitive actions (such as changing transaction limits or the residential address).
Wallet-based authentication must meet the same SCA requirements that PSD2 already mandates.
How the EUDI Wallet meets SCA requirements
The EUDI Wallet is designed to meet PSD2’s SCA requirements in two ways:
- Two factors: the customer authenticates with:
- Something they have: a secure key that resides in the mobile phone
- Something they know or are: a PIN, fingerprint or face scan.
- Dynamic linking: for online payments, the authentication must be linked to the exact amount and payee. If these payment details are altered during the authentication process, the dynamic link becomes void and the payment is rejected.
To use the EUDI Wallet for SCA and without reading out the Person Identification Data (PID) for data privacy reasons, the bank first needs to issue an attestation into the customer’s wallet. This is a digital proof, signed by the bank, that links the wallet to a specific customer. The European Commission’s technical specification TS12 sets out how this works.
The integration challenge for banks
Although banking channels already support SCA, accepting the wallet adds meaningful new work for banks, including:
- Dynamic linking: each online payment authorised through the wallet must carry the amount and payee information, and, after authorisation, the bank must check whether these details still match or have been altered
- Multi-device journeys: a customer may start on a laptop and approve on their phone by scanning a QR code. The handover between the two devices must be secure, so no one can intercept or reuse the response
- Many wallets: every EU country offers at least one wallet, and certified private providers can add more. The bank must work with whichever wallet the customer chooses and test each one
- Attestation management: the bank must issue its attestation into the wallet of each customer who opts in, renew it, and withdraw it when needed
Banfico Identity Connect takes away the complexity of connecting to EU identity wallets. It covers all four challenges listed above, so the bank connects to a single API rather than to every wallet. Banfico keeps it up to date as standards and rulebooks evolve and ensures that customer login and payment authorisation via the EUDI Wallet are SCA-compliant.
In addition to the aforementioned challenges, another matter to consider is the bank’s identity and access management (IAM) system. Today, the system starts with the customer’s online session, after the bank’s own login check. With the identity wallet integrated, the IAM process must start the session from the wallet’s response.
This change is needed regardless of whether a bank builds its own wallet integration or buys one, and it can be difficult with the legacy IAM systems that many PSPs still use today.
For the IAM changes, Banfico experts can guide banks through the configuration of systems such as Keycloak, Ping Identity (including ForgeRock), IBM Verify, Oracle IAM and Okta/Auth0.
With the wallet integrated, a user journey for SCA through the wallet could look like the following flow:
