How EU Digital Identity Wallets will reshape identity verification in digital payments

By Dmitrij Olifer, Chief Information Security & Product Compliance Officer at Ondato

Europe is approaching a new era of digital payments and identity. At least one national European Digital Identity (EUDI) compliant wallet must be rolled out by each Member State by the end of 2026. From July 2027, regulated financial institutions that utilise remote onboarding will have to accept these wallets when customers choose to use them to identify and authenticate themselves. From the end of 2027, EUDI-compliant wallets will become mandatory as one of the possible options for strong customer authentication for clients of financial institutions, payment and service providers in the transport and energy sectors. Wallet-based verification will make identity verification and authentication processes faster, simpler and more reliable.

At the same time, advances in AI are making it easy for fraudsters to impersonate legitimate customers and create synthetic identities. These developments are reshaping the balance between convenience and security, requiring financial institutions and service providers to strengthen identity assurance and keep pace with evolving financial crime risks.

The question is: how to integrate new identity validation technologies, including identification, authentication and age estimation, without losing sight of the purpose of verification? A customer’s identity is only one part of their risk profile, and onboarding information can become outdated. Financial institutions must therefore combine trusted digital credentials with adaptive fraud controls and risk-based ongoing monitoring.

Digital ID wallets as the new foundation for trust

From the customer’s perspective, EUDI Wallets offer a secure and convenient way to verify identity, allowing individuals to prove their identity and voluntarily share verified information with organisations, reducing repeated document submissions and simplifying customer onboarding. They will also enable individuals to obtain and share verified information from other trusted sources within the EUDI framework, making identity verification more efficient. By 24 December 2027, financial institutions and payment service providers covered by the mandatory acceptance requirements will have to accept EUDI Wallets upon the end-user’s request, making wallet integration a priority.

This will remain voluntary for customers, and implementation may vary across Member States. Regulated businesses must therefore continue to offer alternative identity verification and customer authentication routes during remote onboarding process and give customers the opportunity to choose their preferred method.

The EU’s new Anti-Money Laundering Regulation (AMLR) will establish harmonised customer due diligence requirements, including those applicable to remote identity verification as part of financial institutions’ Know Your Customer (KYC) processes. Under the AMLR, EUDI Wallets will be recognised as a qualifying electronic identification method for verifying customers’ identities.

However, a properly verified identity does not automatically indicate a low-risk customer. Wallets strengthen the evidence used to establish who someone is and enable the sharing of relevant, reliable information from trusted sources in line with data minimisation principles. Other checks such as measures to prevent impersonation, beneficial ownership verification, politically exposed person (PEP) and sanction screening, remain necessary to address compliance and fraud risks. Regulated businesses should treat digital identity wallets as a valuable piece of a broader trust framework, supporting and strengthening identity verification and customer due diligence.

While digital identity becomes easier to prove, fraudsters are finding new ways around existing controls. Deepfakes, AI-generated faces and convincing impersonation techniques can undermine confidence in conventional identity checks. Synthetic identities can be created by combining genuine and fabricated personal information, making fraudulent applications difficult to detect.

Synthetic identities  expose the pitfalls of relying on a single document, trusted source or static verification rule. Certain inconsistencies only emerge when identity information is assessed alongside other signals, and analyzing more relevant signals increases the likelihood of identifying suspicious behavior.

To ensure protection against fraud, regulated businesses must evaluate evidence in context and assess information from multiple sources. Automation remains essential for handling large application volumes efficiently, but effective fraud prevention also requires the ability to recognize conflicting evidence, identify unusual patterns and apply additional scrutiny when necessary, keeping verification efficient and resilient.

In payments, the cost of getting identity wrong is immediate. With instant payments, money moves in seconds, leaving little time to stop fraud mid-transaction. Many payment scams involve mule accounts, some of which are opened using stolen or synthetic identities. This makes identity verification during customer onboarding and ongoing monitoring of existing customers essential safeguards against fraud, not just compliance steps.

Post-onboarding KYC

In this new era of AI-based fraud, Know Your Customer (KYC) remains a continuous responsibility that extends beyond onboarding. Traditional KYC processes have relied on periodic reviews, but these can leave gaps when a customer’s circumstances or risk exposure change between assessments. New sanctions listings, emerging PEP matches, adverse media or indications of account takeover can materially affect a customer’s risk profile or reveal new fraud risks after the initial checks.

Ongoing monitoring helps close these gaps. A crowdfunding platform uses ongoing anti-money laundering screening to flag new sanctions or PEP matches and adverse media concerning existing customers. Continuous monitoring helps maintain an up-to-date understanding of customer risk. EUDI Wallets can support onboarding, identity verification and authentication, but they do not replace ongoing screening and other customer monitoring activities.

A risk-based approach has to protect the customer experience. To strike the balance between security and convenience, a European digital bank turned to video identification after implementing additional controls that help identify potentially suspicious applications.

The best approach is to keep routine onboarding efficient for lower-risk customers while prioritising manual reviews and enhanced checks for applications with conflicting evidence, suspected fraud or complex ownership structures.

What regulated businesses should do next

If you’re a regulated business, start by assessing how wallet-based credentials could fit into existing onboarding systems and compliance processes. Don’t abandon alternative verification routes. Strengthen controls against synthetic identities by verifying that the information collected at onboarding is sufficient to support subsequent risk assessments. Don’t lose sight of documentation, since compliance decisions need to be explainable and supported by evidence.

EUDI Wallets will make it easier for people to prove their identity online, but they do not eliminate the risk of increasingly sophisticated AI-based fraud. Payment providers must bring together trusted identity information, adaptive fraud controls and ongoing monitoring, and treat identity verification as the start of the customer relationship, not a one-off check.