EUDI Wallet readiness: what banks should test before going live

A customer loses the phone holding their EUDI Wallet and needs access to their bank account. The European Digital Identity Wallet, or EUDI Wallet, holds credentials: digital records of identity information and other facts confirmed by authorised organisations. Users can see what a service requests and choose what to share.

However, when a customer uses the wallet to regain access to a bank account, the bank must establish that the person sharing those details is its originally verified customer. At Regula, we approach identity verification for banking with account recovery and other changes in access in mind. Banks also need to know what to do when the evidence is insufficient, and these five tests can help them prepare.

Test what the bank receives from the wallet

The first step is making sure the information itself can be trusted. That means checking who issued it and whether it is still valid. A digital signature confirms its origin and that it has not been altered.

Next comes the question of whether the credential actually belongs to the wallet presenting it. For PID, the core personal identification data, cryptographic device binding is mandatory; requirements for other credentials depend on their type and format. Where binding applies, verify that the presenting wallet holds the corresponding key. EUDI defines these checks and requires identification using PID to meet assurance level High; other credentials may have different security requirements.

All of this is far easier to get right if it's settled before launch rather than worked out case by case. Banks should decide in advance which identity details they need, which issuers they're prepared to trust, and how wallet information will be compared against their existing customer records.

During the pilot:

• Test that valid, complete information allows the application to continue through the bank's remaining checks.
• Test altered or substituted credentials and replayed presentations. Reject evidence when signature, required wallet binding or checks linking the response to the current request fail.
• Test expiry and issuer revocation checks, including a credential withdrawn while it remains visible in the wallet. Request valid evidence if it is expired or revoked.

Test wallet migration to a new device

Banks should test the migration process of each wallet they accept. Moving to a new phone may require issuers to issue credentials again; a backup does not necessarily make device-bound credentials usable on another device.

During the pilot:

• Test whether newly issued credentials can be connected to the existing customer.
• Test someone using their own valid wallet to seek access to another person's account.
• Compare verified identity information with customer records. A phone number or address alone should not determine the match.
• Continue without another passport upload when the customer is reliably identified; review mismatches and refuse incorrect account matches.

Assign reviewers and define what evidence they can request.

Test how customers regain access

Recovering a wallet and recovering bank account access involve different responsibilities. The wallet provider manages the wallet, issuers manage its credentials, and the bank decides whether to restore account access. Test what each accepted wallet provides after recovery and whether that evidence is enough to identify the customer.

During the pilot:

• Test whether changes to the bank's recovery contact details could let someone use recovery messages to claim the account.
• Test recovery using a stolen or compromised wallet. Restore access only if the bank can reliably connect the requester to its originally verified customer.
• If that connection remains uncertain, request a check suited to the missing evidence: document verification, a fresh face comparison with a previously verified photograph, or a branch identity check.
• Where facial verification is used, include liveness detection to help distinguish a live person from a photograph or recording.

Explain additional checks to customers. Assign a team to investigate disputed recoveries, with access to the relevant records.

Test selective disclosure and missing information

Selective disclosure lets customers share selected attributes rather than an entire credential. Test whether the bank can complete its checks using the information needed for the service, while recognising when mandatory details are absent.

During the pilot:

• Check that requests collect only necessary attributes (must meet minimisation compliance) and cover applicable KYC requirements.
• Let applications proceed when the disclosed information is sufficient.
• Request only missing information, explaining why it is needed. A loan applicant who has proved their identity may still need income evidence.
• If required information or a validity check is unavailable, explain whether the request must wait or another verification method can be used.

Test an alternative customers can actually use

In a 2024 Forrester Consulting study, The New Imperative: Digital IDs, commissioned by Regula, 35% of respondents cited dependence on technology and potential system failures among the downsides of digital ID adoption. An unsupported credential, service failure or unusable phone should lead to an alternative staff can explain.

During the pilot:

• Offer document verification with a face comparison or assistance at a branch.
• Define when uncertain results require staff review and what evidence can resolve them.
• Test whether substituted camera images are detected and prevented from supporting approval.
• Check that support can continue without requesting information already supplied.
• Measure completion, abandonment, and review time to find where customers get stuck.

Make each decision explainable

Before launch, ask a reviewer to reconstruct a pilot decision: what information the bank received, which checks and rules led to its response, and what staff considered and decided. Define who can access these records and how long they are kept.

Regula IDV Platform integrates wallet-based identity evidence into banks’ existing identity and KYC workflows. Banks can combine EUDI Wallet data with document and biometric verification, applying additional checks where the risk or use case requires them. Configurable workflows, manual review and verification history help banks trace how each decision was reached. Deployment on an organisation’s own infrastructure or in the cloud lets banks choose how identity data and verification processes are managed.

Across all five tests, the bank should be able to explain its response to every situation. Customers should know what is missing and how to resolve it, where possible. EUDI's benefits should extend beyond the first wallet interaction to the less predictable moments when customers need their bank's help.

Additional links: 

• Knowledge Hub on the Digital ID - https://regulaforensics.com/resources/the-road-to-digital-id/
• Webinar: Building Trusted Journeys in the Digital Identity Era - https://www.youtube.com/watch?v=fmNCXXOU7s4
• Webinar: Is Digital ID a Weapon to Break Up the Traditional Identity Verification Market? - https://www.youtube.com/watch?v=hhj_wWvuFc4
• Webinar: Understanding Electronic IDs and Digital IDs - https://www.youtube.com/watch?v=E_ks3icLMBY

About Henry Patishman

As Executive VP of Identity Verification solutions, Henry Patishman is responsible for driving Regula’s strategic initiatives across different industries in the cutting-edge field of identity verification and biometrics. Henry has a broad view and extensive experience across the entire breadth of the IT industry, particularly in digital transformation, security, and data storage. He has held senior global positions with multiple global tech companies, such as ABBYY and ACA Pacific. Henry graduated from Deakin University in Victoria, Australia, with 2 degrees: Bachelor of Commerce and Bachelor of Science.

 

About Regula

Regula is a global developer of identity verification solutions and forensic devices, trusted by over 2.000 organisations across regulated industries worldwide. Built on 34 years of document forensics expertise, Regula delivers end-to-end document verification, biometric authentication, and identity lifecycle management, backed by the world’s largest template library of 16.000+ IDs from 254 countries. Recognised in the 2025 Gartner® Magic Quadrant™ for Identity Verification. Learn more at www.regulaforensics.com.