The European Union Digital Identity Wallet (EUDIW) was meant to be all things to all people, but now payments functionality is delayed. The EU’s tactical response is SCARLET, but the fundamental design weakness exposed could prevent EUDIW from ever being a Digital Identity solution.
Five years into Europe’s digital identity wallet programme, and on the eve of the December 2026 delivery date for mandatory wallet availability, the European Commission has invited the European Payments Council to develop a framework, SCARLET, that defines common business arrangements, operational rules and technical specifications for payment authentication.
Remember, payments were a key part of the original European Union promise. This unfinished work raises questions about the rollout timetable, and the distinct possibility that the wallet’s practical scope is shrinking.
My assessment is that authentication—the harder half of the identity process—is a fundamental weakness. Digital Identity must establish who the human actor is, not merely verify the credentials they present. If the EUDIW cannot reliably authenticate the human actor against the identity represented by those credentials, it fails at a defining function of digital identity. SCARLET raises that concern in payments. If the same weakness extends across the wallet, Europe risks delivering only digital documents instead of authenticated digital identity.
Has Europe built an identity service, or merely a document wallet?
Payments were part of the promise
From 2021 to 2026 the European Union (EU), and its executive arm the European Commission (EC), made it crystal clear that payments were part of the European Union Digital Identity Wallet (EUDIW). The history shows this:
June 2021: eIDAS (electronic IDentification, Authentication and trust Services) 2.0 legislative proposal proposed the EUDIW and specifically included payments as recital 31 states:
“Secure electronic identification and the provision of attestation of attributes should offer additional flexibility … to support … initiation of transactions in the field of payment services.”November 2023: This was confirmed in an EC press release:
“the Wallet will allow users to open bank accounts, make payments…”January 2026: the EC’s Payment Authentication Use Case Manual, version 2, stated:
With regard to authentication for electronic payments… In particular, the Wallet must enable the user to give his/her consent for a payment by authenticating transactional information (e.g., payment and payee information).2026: The FAQ section makes the requirement clear:
“The Regulation also requires Member States to offer European Digital Identity Wallets to all EU citizens by end 2026 and obliges private service providers to accept the wallet for SCA (strong customer authentication) by end 2027.”
These statements confirm that payment capability was part of the EUDIW promise from the outset. Some may argue that SCARLET concerns only Strong Customer Authentication (SCA), rather than payments generally. But “only SCA” understates its importance: for online payments, SCA is the default legal requirement, subject to specified exemptions.
A wallet intended to authenticate online purchases and bank transfers therefore needs SCA as a core capability. It is reasonable to expect SCA to underpin much of the wallet’s intended payment use.
SCARLET consequently concerns a central part of the EU’s payments promise: making wallet-based authentication dependable and interoperable across payment providers.
The EUDIW red flag is raised
But in an extraordinary development, the EUDIW now needs a design for payments.
The European Payments Council (EPC) has been invited by the EU to develop a rulebook for EUDIW payments. That’s right – after 5 years of EUDIW development, the payments industry is now being asked to complete the operational scheme. The project has the pithy title ‘Strong Customer Authentication [SCA] Acceptance Rulebook and Liability Framework for EUDIW Transactions’, which fortunately collapses neatly into the acronym SCARLET.
The first SCARLET rulebook is planned for December 2027 under existing payment regulations. A subsequent version will address the new regulations from 2028/29. Specifically, the EPC will deliver:
“A business and contractual framework defining scheme actors, eligibility requirements, rights and obligations of the legal entities participating to the scheme.
Common functional and operational rules.
Technical specifications, relying on the work already done by the European Commission with the Architectural Reference Framework (ARF), the related technical specifications (TS12) and considering the contribution of Large-Scale Pilots (LSPs).”
So the EPC will deliver a scheme, define functionality, and develop technical specifications. That is astonishing for a wallet that was meant to be available in two month’s time.
The first rulebook is due in December 2027, followed by an implementation period covering development, testing, onboarding and certification. Yet payment providers are expected to accept the wallets by December 2027. A rulebook in December, implementation afterward, and acceptance required that same month. The EPC should explain how this calendar works.
This is bigger than payments – it raises questions about the EUDIW itself
Note the reasoning given for SCARLET:
SCARLET is intended to reduce the risk of multiple, potentially non-interoperable approaches emerging across Europe by providing a common standard for the 3,000+ Payments Service Providers and the 27+ EU Digital Identity Wallet providers expected to operate in the EU/EEA.
If a flagship use still requires a separate interoperability scheme, what exactly does the wallet’s general identity framework deliver—and what must every sector build for itself?
The EUDIW was intended to provide such a general interoperable approach to all things identity and payments but, after 5 years of development, its common payment authentication scheme remains unfinished. If payment authentication still needs a common operational scheme, where is the evidence that the broader identity service is complete?
Without authentication, the EUDIW cannot support digital identity, it can only support Verifiable Credentials. A verifiable credential provides signed digital evidence. It does not, by itself, authenticate the human actor presenting it. Let’s rename the EUDIW as the EUDW.
The fundamental difference: digital identity vs digital documents
Both are digital. That does not make them equivalent.
A complete digital identity service establishes who is acting and enables that actor to use their relevant credentials. A digital document provides evidence about its subject. But a digital document does not, by itself, establish that the human actor presenting it is in fact the subject of the document.
For the purposes of this discussion, a complete digital identity service combines identification, authentication and credential use. It preserves those relationships when the identity is reused across services.
A digitally signed credential allows a service to check its source and detect alteration. Those are valuable capabilities but are limited. Verifying a credential does not, by itself, establish that the human actor presenting it is the individual it describes.
That is the distinction at the heart of this newsletter: we want digital identity but digital documents alone do not achieve that function. We need a secure and easy-to-use process; a verifiable digital document is not such a process.
Summary
The EUDIW promised digital identity. A wallet full of digitally signed documents does not, by itself, deliver that promise.
The crucial test is whether a service can reliably establish that the human actor presenting a credential is the individual it describes. Checking the document’s signature or unlocking a wallet does not, by itself, establish that relationship.
SCARLET exposes substantial unfinished work in making wallet authentication usable across the payments industry. That raises a question the EU cannot bury beneath another mountain of specifications: where is the complete, interoperable identity service?
If the programme simply delivers credential storage and presentation, while leaving dependable identification and authentication to be assembled separately by each sector, its ambition has shrunk.
EUDIW has delivered the ‘DW’. It has yet to substantiate the ‘DI’.
The result is EUDW: a European Digital Wallet.
A retreat from providing digital identity to simply carrying digital documents.
Ruh roh, as they say.