The EU Identity Wallet: KYC Without the Full Reveal

The EU Digital Identity Wallet (EUDI Wallet), mandated under the amended eIDAS Regulation (Regulation (EU) 2024/1183), obliges every member state to offer citizens a wallet by 2026. For KYC teams, the shift is structural: instead of collecting a scanned passport and storing its full contents, you may soon receive a signed attestation that answers one question and nothing more. This is general information, not legal advice, but the direction of travel is worth planning for now.

What a Verifiable Credential Actually Contains

A verifiable credential (VC) is a cryptographically signed set of claims issued by a trusted party — a government register, a bank, or a licensed identity provider. The credential binds three things: the issuer (who vouches), the subject (the holder), and the claims (date of birth, nationality, residence). The holder stores it in a wallet and presents it to a relying party, who verifies the issuer's signature against a trust list.

The change from document-based KYC is that the relying party never touches the underlying breeder document. Where you once parsed an MRZ and retained a full image, you now validate a signature and read only the attributes you were authorized to request. The audit question shifts from "do we have the passport scan" to "can we reproduce the presentation and its verification result."

Selective Disclosure and Zero-Knowledge Proofs

The privacy mechanism that makes wallets interesting is selective disclosure. Two formats dominate the current EUDI Architecture and Reference Framework: SD-JWT (selective disclosure JSON Web Tokens) and ISO/IEC 18013-5 mobile documents (mDoc/mDL). Both let a holder reveal a subset of claims while keeping the issuer's signature valid over the whole.

Some schemes go further with predicate proofs. Rather than disclosing a date of birth, the wallet can prove "over 18" as a boolean, or prove residence in a jurisdiction without revealing a street address. For a compliance team, this reframes data collection:

• Ask for the claim you need to make a decision, not the document that happens to contain it.
• Log the verification outcome and issuer, not the raw attributes, where your obligations allow.
• Treat every disclosed field as something you must later justify holding.

This maps directly onto data minimization principles under GDPR Article 5(1)(c). If a risk decision needs three attributes, requesting twelve creates retention liability you gain nothing from.

Where Wallets Fit — and Where They Don't

Wallets do not eliminate KYC obligations; they change the evidence format. You still need to satisfy customer due diligence requirements, assess risk, and screen against sanctions and PEP lists. A wallet gives you a higher-assurance attribute source, but it says nothing about transaction behavior, source of funds, or adverse media. Those checks continue regardless of how identity was proven.

Coverage is also uneven. Adoption timelines vary across member states, non-EU customers will not hold an EUDI Wallet, and many flows will run on chat and messaging channels where a wallet handoff adds steps. Practical onboarding will stay multi-modal for years: wallet presentation where available, document-and-liveness capture where not, and a fallback path for edge cases. Designing for both from the start avoids a rebuild later.

Preparing Your Stack

Three engineering tasks make wallet acceptance realistic. First, build a credential verifier that validates issuer signatures against the official trust lists and handles both SD-JWT and mDoc. Second, define an attribute request policy per product, so each flow asks for the minimum set and records the justification. Third, align retention: if a wallet lets you avoid storing a full identity document, configure your pipeline to keep the verification result and discard what you did not need.

Chat-based verification fits this model closely. A conversational flow can request a specific attribute, receive a signed presentation, confirm the outcome, and retain only the decision — a natural expression of collecting less and holding it for a configurable, defensible window. The wallet supplies the assurance; your policy decides what survives the session. Read more at privatekycbot.com.