The EU's eIDAS Committee made the EUDI Wallet biometric portrait optional on 18 June 2026. Here is what the compromise changes for KYC and identity teams.
Table of contents
On 18 June 2026 the EU's eIDAS Committee agreed that the EUDI Wallet biometric portrait can stay optional, so member states may let users decline a facial image in their wallet. The deal ends a standoff between the Commission, which wanted the portrait mandatory, and states that objected on privacy grounds.
- The eIDAS Committee settled the dispute on 18 June 2026 by letting member states allow users to opt out of including a facial image in their wallet.
- Under Commission Implementing Regulation (EU) 2024/2977, the portrait is already listed as an optional person identification data attribute, while name, date of birth, place of birth and nationality stay mandatory.
- The Commission had pushed to make the portrait mandatory for face-to-face checks and cross-border interoperability with the ISO 18013-5 mobile driving licence standard.
- Member States must offer at least one wallet by late December 2026, and the EU AML Regulation will require firms to accept wallet-based identity from 10 July 2027.
- Digital rights groups warn that an opt-out on paper may not survive real-world pressure to share biometric data.
What did the eIDAS Committee actually agree?
The eIDAS Committee, the body of member state representatives that votes on the technical rules for the European Digital Identity Wallet, met on 18 June 2026 and agreed an amended rule on the facial image. Member states may let users decline the portrait, but they are not forced to offer that choice. The amended implementing act now proceeds to formal adoption by the Commission.
The fight was about whether a facial image should be a compulsory part of every wallet. The Commission argued a portrait supports in-person identity checks and aligns the EUDI Wallet biometric data model with the ISO 18013-5 mobile driving licence standard. A bloc of member states resisted, warning that a mandatory face image stored for everyday use would be disproportionate.
The compromise leaves the legal baseline unchanged. The portrait remains an optional attribute, not a mandatory one, in the person identification data that anchors each wallet.
| Date | Milestone |
|---|---|
| 20 May 2024 | Regulation (EU) 2024/1183 enters into force, amending eIDAS |
| 28 November 2024 | Implementing Regulation (EU) 2024/2977 on person identification data adopted |
| 18 June 2026 | eIDAS Committee agrees the EUDI Wallet biometric portrait stays optional |
| Late December 2026 | Member States must provide at least one wallet |
| 10 July 2027 | AML Regulation (EU) 2024/1624 applies across the EU |
How does the EUDI Wallet biometric portrait fit into person identification data?
Person identification data, or PID, is the core identity record each wallet issues. Implementing Regulation (EU) 2024/2977, adopted on 28 November 2024, sets which attributes a wallet must carry and which are optional. Five attributes are mandatory; the portrait is not one of them.
The regulation lists the facial image as an optional attribute, compliant with the ISO 19794-5 or ISO 39794 biometric standards. The same text builds in data protection by design. Article 5(8) requires wallet providers to enable "privacy preserving techniques which ensure unlinkability" where an attestation does not need to identify the user. That phrase is the heart of selective disclosure: a wallet should prove a single fact, such as age over 18, without revealing the rest of the record.
The table below shows the split the June 2026 EUDI Wallet biometric decision leaves in place.
| PID attribute | Status under Regulation (EU) 2024/2977 | Notes |
|---|---|---|
| Family name | Mandatory | Core legal identity |
| Given name | Mandatory | Core legal identity |
| Date of birth | Mandatory | Used for age and identity checks |
| Place of birth | Mandatory | Disambiguates identity |
| Nationality | Mandatory | Establishes citizenship |
| Portrait (facial image) | Optional | ISO 19794-5 or ISO 39794; subject of the June 2026 compromise |
What does this change for your KYC and AML obligations?
The decision matters because the wallet is about to become a regulated onboarding channel. Regulation (EU) 2024/1624, the EU's single AML Regulation, applies from 10 July 2027 and points firms to eIDAS electronic identification for remote customer due diligence. Once member states issue wallets, regulated entities will need to accept wallet-based identity when a customer presents it.
For customer due diligence, the practical change is that you cannot assume a facial image will be in every wallet. Your CDD evidence model should treat the portrait as a bonus, not a guaranteed field.
If your remote onboarding flow relies on matching a selfie to a portrait pulled from the wallet, that match may be unavailable for users who opted out. You then need a documented fallback for collecting and verifying a face image directly.
For sanctions and PEP screening, nothing about the compromise reduces your duty. You still screen the verified name, date of birth and nationality the wallet returns, and you still apply enhanced due diligence where risk demands it. The wallet sharpens the input data; it does not replace the screening obligation.
For data protection, the opt-out makes your legal basis cleaner. A facial image processed to identify a person is special category biometric data under Article 9 of the GDPR, and Article 5(1)(c) requires data minimisation. Designing flows that work without a stored portrait, and that request a face image only when a named legal basis applies, is now both feasible and expected. Record-keeping duties are unchanged: log what attributes you requested, what the wallet returned and the assurance level relied on.
What is still uncertain about the EUDI Wallet biometric rule?
The biggest open question is whether an opt-out on paper holds up in practice. Because member states may, but need not, offer the choice, a user in one country could opt out while a user in another has no such right. That fragmentation cuts against the single market the wallet is meant to create, and it leaves relying parties guessing what a given wallet will contain.
Consent pressure is the second risk. Digital rights group epicenter.works warned that people could be pushed to share a face image even where an opt-out exists, with its director cautioning that forcing the feature would "create a pushback from society." If a bank or platform treats the portrait as the smooth path and the opt-out as friction, the choice becomes nominal.
Timing is the third risk. Member States face a late December 2026 deadline to ship at least one wallet, and the Commission has itself signalled doubt that every state will make it. A rule only just headed for formal adoption leaves implementers little runway, raising the chance of divergent national interpretations of how the EUDI Wallet biometric opt-out should work in live services.
How does this compare with other digital identity schemes?
The portrait question is not unique to Europe. The ISO 18013-5 mobile driving licence, deployed in several US states and in Australia, embeds a facial image by design, which is exactly the interoperability the Commission cited. The EU choice to keep the image optional is therefore a deliberate divergence in favour of data minimisation over global symmetry.
It also fits a wider European pattern. Italy's data protection authority fined Poste Italiane 12.5 million euros for making device scans a condition of app access, a reminder that regulators here treat compelled data collection as a live enforcement risk. Keeping the wallet portrait optional reduces the chance that a national rollout repeats that mistake at scale.
How should compliance teams respond?
Start with a wallet readiness review. Map every onboarding and step-up flow that assumes a facial image, and add a fallback path for wallets that carry no portrait. Confirm your CDD logic verifies the five mandatory attributes and treats the portrait as optional.
Then set screening to run on the verified name, date of birth and nationality regardless of whether a face image is present, and record the assurance level you relied on. Brief data protection colleagues that requesting a portrait is special category processing that needs its own legal basis.
Then design for choice rather than friction. Architectures that minimise data and prove single facts without exposing the full record are the ones that age well as the wallet rolls out. Zyphe verifies identity through an NFC chip read to ICAO 9303 and eIDAS standards with two step liveness and no image upload, shards personal data across a decentralised network so no single node holds a complete record, and issues a reusable credential through one API. To see how that maps to wallet based onboarding, book a demo.
The bottom line
Keeping the EUDI Wallet biometric portrait optional is a win for data minimisation, but it hands compliance teams a design problem. The wallet is becoming a regulated onboarding channel under the EU AML Regulation, and the attributes it carries will vary by member state and by user choice. Teams that build flows around the mandatory identity attributes, treat a face image as optional rather than assumed, and minimise what they collect will adapt fastest as wallets reach citizens through 2026 and 2027.
Cited sources
- Regulation (EU) 2024/1183 establishing the European Digital Identity Framework (EUR-Lex)
- Commission Implementing Regulation (EU) 2024/2977 on person identification data and EAAs (EUR-Lex)
- European Digital Identity Regulation overview (European Commission)
- Regulation (EU) 2024/1624 on the prevention of money laundering (EUR-Lex)
- EUDI Wallet biometric compromise draws privacy concerns (Biometric Update)
- Italy's Garante fines Poste Italiane for device surveillance (Zyphe news)
- Germany's Digital Identities Act and the EUDI wallet (Zyphe news)
- KYC vs AML: key differences explained (Zyphe blog)
- How Zyphe verification works
Michelangelo Frigo (Co-Founder at Zyphe) Michelangelo Frigo is a privacy and identity infrastructure expert and co-founder of Zyphe.