What is digital ID? The three models of digital identity, how verifiable credentials work, the eIDAS 2.0 wallet deadlines, and which digital IDs satisfy KYC.
Table of contents
- A digital ID is a credential that proves facts about a person online. Digital identity is the wider set of identifiers, attributes and evidence behind it.
- There are three working models: platform logins, government wallets and user-held verifiable credentials. They differ on one question: who holds the data.
- Under eIDAS 2.0, every EU member state must offer at least one European Digital Identity Wallet within 24 months of the core implementing acts entering into force, which lands in December 2026.
- Banks, payment firms and other private relying parties that must use strong user authentication have to accept the wallet, on the user's request, within 36 months of those acts: December 2027.
- From 10 July 2027 the EU Anti-Money Laundering Regulation lets obliged entities verify a customer with eIDAS electronic identification at assurance level substantial or high.
- A digital ID proves identity. It does not screen sanctions, assess risk or keep an audit trail, so it feeds KYC rather than replacing it.
Digital identity is the set of identifiers, verified attributes and evidence that represent a person or a company online, and a digital ID is the credential that proves part of it to someone else. It comes in three models: platform logins, government wallets such as the EU Digital Identity Wallet, and verifiable credentials the user holds and presents.
TL;DR
A digital ID is a machine-checkable proof of who someone is, or of one fact about them, such as being over 18. For most of the internet's history that proof was checked once and then copied into the database of whoever checked it. Two things are changing that. The W3C finished the standards for user-held, signed credentials, and the EU passed eIDAS 2.0, which puts a state-issued identity wallet on every citizen's phone by the end of 2026 and obliges banks and payment firms to accept it by the end of 2027. For a regulated firm, the practical question is which digital IDs count as evidence for customer due diligence, and how to accept them without building another store of passports and selfies.
This article is general information on EU law and W3C standards as of 22 October 2026, not legal advice.
What is a digital ID?
A digital ID is an electronic credential that lets a person prove who they are, or prove one attribute about themselves, to an online service. Behind every digital ID sits a digital identity made of four layers:
- Identifiers. The handle a system knows you by: an email address, a national identification number, or a cryptographic identifier.
- Attributes. The claims attached to that identifier: name, date of birth, nationality, address, over-18 status.
- Evidence. What backs the claims: a passport checked against a live face, a record in a government register, a bank's own onboarding file.
- Credentials. Signed, portable packages of verified attributes that can be shown to a third party.
The distinction that matters most is between an identity that is checked once and an identity that is held and reused. Most online identity today is the first kind: a provider checks a document, keeps a copy, and the next service starts again from zero. Every copy is another place the data can leak, which is why identity vendors keep appearing in our KYC and IDV breach tracker. The newer models are built so the person carries the verified result and shares only what each service needs.
What is the difference between digital identity and digital ID verification?
Digital identity is the data and the credentials. Digital ID verification is the process that checks them: matching a government document to a live face, confirming the document is genuine, and recording the result. In regulatory language that process is identity proofing, and its strength is graded in identity assurance levels.
The two meet at reuse. Verification produces evidence; a digital identity credential lets that evidence travel, so a person verified once does not have to upload the same passport to every app. For the state of the verification market itself, see our 2026 state of digital ID verification.
What are the three models of digital identity?
Every digital identity system answers the same question differently: who holds the identity data?
| Platform login | Government wallet (eIDAS 2.0) | User-held credentials (SSI) | |
|---|---|---|---|
| Who holds the data | The platform (Google, Apple, a bank) | The user's wallet, issued and certified under national schemes | The user, in a wallet app, with keys they control |
| What it proves | Control of an account | State-verified legal identity | Whatever the issuer of each credential verified |
| Assurance | Low for legal identity | Substantial or high | Depends on the issuer |
| Reuse | Inside the federation | Across the EU by design | Anywhere the credential format is accepted |
| Privacy model | The provider sees every login | Selective disclosure required; use is voluntary | Selective disclosure; the verifier need not contact the issuer |
| Coverage | Global, but not identity-grade | EU citizens and residents only | As wide as the issuers behind it |
Platform login
Federated identity lets one account sign you into many services. It solved password fatigue, but it proves you control an account, not that you are a particular legal person, and it concentrates behavioural data with a few providers. On its own it never meets the evidence bar for KYC.
Government wallet
Here the state verifies your legal identity and issues it to an app on your phone. eIDAS 2.0 turns this into an EU-wide, legally recognised system: Article 5a(15) of Regulation (EU) 2024/1183 makes use of the wallet voluntary, and services may not disadvantage people who choose not to use one. The trade-off is reach. The wallet covers people with an EU-issued identity and nobody else.
User-held credentials
Self-sovereign identity puts the person in control. Credentials live with the holder and are tied to cryptographic identifiers rather than a central account. This is the model behind most reusable KYC credentials.
The three are converging. The EU wallet borrows the user-held pattern (credentials on the device, selective disclosure), and user-held systems increasingly accept government credentials as their root of trust.
How do verifiable credentials and decentralized identifiers work?
A verifiable credential is a digitally signed statement, such as "this person is over 18" or "this passport was verified on this date", that the holder can store and present to anyone. The recipient checks the signature, which shows who issued the claim and that it has not been altered, and then checks expiry and revocation status, usually against a status list the issuer publishes rather than by asking the issuer about each presentation.
The model has three roles:
- Issuer. Verifies a fact and signs the credential: a government, a bank, an identity verification provider.
- Holder. Keeps the credential and decides when to share it.
- Verifier. Checks the signature and accepts or rejects the claim.
The standards are settled. Decentralized identifiers (DIDs), identifiers a person or organisation controls with its own keys instead of through a registry, became a W3C Recommendation in July 2022. The Verifiable Credentials Data Model 2.0 became a W3C Recommendation in May 2025.
Two properties matter for compliance teams:
- Selective disclosure. The holder reveals one attribute without exposing the whole document. Zero-knowledge proofs go further and prove a statement is true without revealing the data behind it.
- No phone-home check. The verifier does not query the issuer each time, so no central log records where a person used their identity.
A blockchain is optional in this architecture. Where one is used, it anchors identifiers or revocation status, and personal data never belongs on a public ledger. We cover the ledger-based designs in blockchain identity verification.
What does eIDAS 2.0 require, and by when?
eIDAS 2.0 is Regulation (EU) 2024/1183, which amended the original eIDAS Regulation to create the European Digital Identity Framework. Its deadlines run from the core implementing acts, the first of which, including Implementing Regulation (EU) 2024/2977 on person identification data, were adopted on 28 November 2024 and entered into force on 24 December 2024.
| Milestone | Legal basis | Date |
|---|---|---|
| eIDAS 2.0 enters into force | Regulation (EU) 2024/1183 | 20 May 2024 |
| Core wallet implementing acts enter into force | Implementing Regulations of 28 November 2024 | 24 December 2024 |
| Each member state provides at least one wallet | Article 5a(1): within 24 months of the implementing acts | December 2026 |
| Regulated private relying parties accept the wallet on the user's request | Article 5f(2): no later than 36 months from the implementing acts | December 2027 |
| AMLR lets obliged entities verify identity with eIDAS eID | Regulation (EU) 2024/1624, Article 22(6)(b) | 10 July 2027 |
Article 5f(2) is the clause regulated firms should read closely. It applies to private relying parties, except micro and small enterprises, that are required by law or contract to use strong user authentication for online identification, and it names banking and financial services among the sectors. Those firms must accept the wallet when a user asks to use it. Very large online platforms that require user authentication must also accept it on the user's request, under Article 5f(3).
Rollout will be uneven. Member states can provide the wallet directly, under a mandate, or by recognising a private wallet (Article 5a(2)), and some national wallets are already live while others are still in certification. Germany's approach is covered in our news on the German Digital Identities Act, and the change to the wallet's photo attribute in EUDI Wallet portrait turns optional. For the KYC operations view of the same law, read our eIDAS 2.0 and EUDI Wallet KYC guide.
Can a digital ID satisfy KYC?
Partly, and from July 2027 explicitly in EU law. Article 22(6) of the Anti-Money Laundering Regulation gives obliged entities two routes to verify a customer's identity: (a) an identity document plus, where relevant, reliable and independent sources, or (b) electronic identification means that meet eIDAS at assurance level substantial or high, and relevant qualified trust services. Recital 66 explains the second limb: eID should be accepted where the customer has it, and qualified trust services are the route where they do not, for example a resident of a third country. A wallet presentation at the right assurance level is therefore a recognised verification route, not a workaround. AMLA's draft standards on customer due diligence go in the same direction and treat remote document checks as the route that needs justifying, as our news on AMLA's final CDD RTS explains.
What a digital ID does not do is the rest of customer due diligence. It does not screen sanctions or politically exposed person lists, assess risk, identify beneficial owners, monitor transactions, or keep the records a supervisor will ask for. It also covers only people with an identity the scheme recognises. A firm onboarding customers from outside the EU still needs document and biometric identity verification for everyone the wallet does not reach.
Which digital IDs can a regulated firm rely on?
This is the decision table we use when a compliance team asks whether a given digital ID can carry a customer's identity verification. It summarises the routes above; your national supervisor and your own risk assessment decide the final answer.
| Digital ID presented | Can it verify identity for CDD? | What you still need |
|---|---|---|
| Social or platform login | No | A full identity check |
| EU wallet or notified national eID at substantial or high | Yes, under AMLR Article 22(6)(b) from 10 July 2027, and under national rules today where they allow it | Screening, risk assessment, ongoing monitoring, records |
| Reusable credential issued after a document and liveness check | Yes, if your policy accepts the issuer's verification and you can retrieve the underlying evidence when asked | The same, plus a reliance or outsourcing assessment of the issuer |
| Age token ("over 18" only) | No, it proves one attribute, not identity | A full identity check if KYC applies |
| Self-asserted profile data | No | A full identity check |
Three questions settle most cases:
- What assurance level does the credential carry? Substantial or high under eIDAS, or an equivalent document and liveness check.
- Can you produce the evidence on request? A supervisor will ask how the identity was verified, not only whether.
- Who does the credential cover? Plan a second route for every customer the scheme does not reach.
Where does a reusable KYC credential fit?
On the spectrum above, Zyphe sits in the user-held model, applied to regulated onboarding. Zyphe verifies a government identity document from 190+ countries against a live face and issues the person a reusable credential, the KYC Passport. The next business that needs to verify the same person accepts the credential instead of collecting the documents again. Zyphe's integrations with the eIDAS 2.0 wallet and with Italy's SPID and CIE schemes are in production, so a wallet or national eID can be one of the inputs.
The difference from a conventional vendor is where the data sits. There is no central store of customer PII: the end user holds the key to their own record, and at onboarding they consent to the business holding a derivative access key, so the firm can open the record and produce it to its supervisor without asking the user again. That answers the evidence question in the table above without a vendor database of passports to breach. The mechanics are in what is a KYC Passport and in why your KYC vendor is your biggest data breach risk.
eIDAS wallets and reusable credentials complement each other. The wallet becomes a strong input for EU customers; a reusable credential carries the full verification result across borders and to customers no wallet covers.
The bottom line
Digital identity is moving from checked-and-copied to held-and-reused. The standards for user-held credentials are finished, every EU state owes its citizens a wallet by December 2026, regulated firms must accept it by December 2027, and the AMLR makes eIDAS identification a recognised KYC route from July 2027. The firms that do well will accept wallets for the customers who have them, keep a document route for everyone else, and stop building their own store of identity documents along the way.
Book a demo to see a reusable KYC Passport accept a wallet or a document, or see how it works.
Related resources
- KYC Passport: reusable identity verification
- eIDAS 2.0 and the EU Digital Identity Wallet: KYC guide
- Age verification and digital identity guide
- 2026 state of digital ID verification
- Blockchain identity verification
- What is self-sovereign identity?
- Zero-knowledge proofs in KYC
- Deepfake detection in KYC
Cited sources
- Regulation (EU) 2024/1183 (eIDAS 2.0), Articles 5a and 5f: https://eur-lex.europa.eu/eli/reg/2024/1183/oj
- Regulation (EU) 2024/1624 (AMLR), Article 22(6): https://eur-lex.europa.eu/eli/reg/2024/1624/oj
- Commission Implementing Regulation (EU) 2024/2977 on person identification data: https://eur-lex.europa.eu/eli/reg_impl/2024/2977/oj/eng
- W3C, Verifiable Credentials Data Model v2.0: https://www.w3.org/TR/vc-data-model-2.0/
- W3C, Decentralized Identifiers (DIDs) v1.0: https://www.w3.org/TR/did-core/
Michelangelo Frigo (Co-Founder at Zyphe) Michelangelo Frigo is a privacy and identity infrastructure expert and co-founder of Zyphe.