Building Europe’s Wallet-First, Cyber-Resilient Future with Identity, Tokenisation and Payment Passkeys

A robust and secure identity layer seems an obvious solution – one that is as effortless to use as making a payment, fast, interoperable with multiple platforms, privacy-preserving, and accepted everywhere consumers are. Within Europe, such a system is now being built. The EU Digital Identity Framework aims to enhance the way citizens and businesses securely identify and authenticate themselves online. 

Under the eIDAS 2.0 (Electronic Identification, Authentication and Trust Services) regulation, the aim is for mandatory issuance of EU Digital Identity Wallets (EUDIW) by every EU member state by the end of 2026. Some member states already have their own national schemes, so the regulation also aims to harmonise this development across the zone and make them interoperable. 

Core to the utility and success of these systems is regulated digital identity. They ensure people can trust online service providers, and vice versa. Confidence in the digital interactions that take place is crucial to driving adoption and forming consumer habits. Crucially, users stay in control – they can choose which data to share, for what purpose, and for how long. While people use the wallet, they only ever need to supply minimal information. If they need to verify that they’re over 18, for example, the credential can give a simple yes/no answer with no other information shared. 

What’s more, technology advances have made the underlying authentication and security of that data sharing both more secure and convenient to use. Payment passkeys, based on globally recognised FIDO (Fast Identity Online) standards, take advantage of the biometric authentication processes on a user’s own device, and replace traditional password-based authentication that currently enable most online payments. 

Implemented alongside a tokenized card – either Card-on-File (COF) or Click to Pay – they provide much stronger protection against fraud for card-not-present (CNP) transactions with a smooth, one-click experience for online shoppers. 

The increasing vulnerability of one-time-passwords (OTPs) is a big driver behind the shift towards payment passkeys, with biometrics offering a far more secure and convenient experience when it comes to the crucial first step of the payment passkey journey: device binding. 

While the digital wallets will remain voluntary and free of charge for end users, the goal is to ensure every EU citizen and resident has access to a way of sharing identity data, sign documents, and conduct transactions electronically on a cross-border basis. With a wide variety of use cases across payments, education, travel, health and Government services, these systems point to a future where identification, authentication, and payments are all closely connected. Citizens will soon be able to seamlessly open bank accounts, while identities issued through this system will be considered fully verified, meaning banks will be required to accept them. 

Historically the process banks have used to bring new customers on board has been fragmented and weighed down by compliance requirements. The EUDIW aims to change that by providing a government-backed identity and credential storage tool, all built using privacy-by-design principles and decentralised verification.

Banks can use this platform to instantly verify government-issued identity data, obtain electronic signatures with full legal effect, integrate with verified payment methods, and in sum, reduce the onboarding time from days to minutes. To take full advantage, it requires payment service providers, merchants and banks to assess and adapt their existing onboarding flows to accept EUDIW by design. Embracing this change is a real opportunity for them to meet consumers where they are, reducing fraud and driving higher conversion and faster onboarding in the process. 

Of course, the entire digital wallet model only works if the highest level of assurance is provided. Advanced cryptographic methods, combined with a chain of trust that ensures the wallet only hosts documents that belong to the holder, helps tackle the risk from theft and fraud. EU member states and software providers will be required to certify every wallet made available, in combination with digital document issuers audited every two years to ensure they’re taking the necessary security measures.

The main way card details are protected in mobile wallets is through card tokenisation, a use case it originally started with, but has since grown into a technology that’s shaping the next decade of commerce across a whole range of platforms. Commercial digital wallet platforms like Apple Pay, Google Wallet and Samsung Wallet house ‘virtual’ cards with no holograms or signature strips. Cardholders enrol a card once, authenticate it with biometrics, and can then make secure, tap-and-go payments powered entirely by device-bound tokens. It lets consumers tap, scan or click exactly as before, but with card numbers never touching the merchant environment for better security.