EUDI Wallet for AML and KYC: what banks and obliged entities need to know

Banks, payment institutions, insurers and other obliged entities must identify their customers (“know your customer”, KYC). The EUDI Wallet is well suited to this: it is an electronic identification means at the highest assurance level and provides officially signed identity data. This guide covers the rules under the EU Anti-Money Laundering Regulation, which data to request and what to keep.

The legal basis

• Identification by electronic means: From 10 July 2027, the AMLR (Regulation (EU) 2024/1624) applies directly in all member states. Art. 22(6)(b) allows obliged entities to verify identity through electronic identification means meeting the eIDAS requirements for assurance level “substantial” or “high”, and relevant qualified trust services.
• The wallet meets that level: EUDI Wallets are provided under an electronic identification scheme at assurance level high (Art. 5a(11) eIDAS).
• Until then, national law applies. Germany, for example, already allows the online ID card and notified eIDAS schemes (§ 12 Anti-Money Laundering Act), and its draft Digital Identities Act puts the EUDI Wallet on an equal footing with the online ID card (§ 15(2) of the draft; parliamentary vote scheduled for 15 October 2026).
• Mandatory acceptance: Private relying parties required by law or contract to use strong user authentication for online identification must accept the wallet on the user’s request – banking and financial services are named explicitly in Art. 5f(2) eIDAS. By our calculation the deadline is 24 December 2027; micro and small enterprises are exempt. More: mandatory acceptance.

What you need – and what the wallet provides

PID column per the annex of Implementing Regulation 2024/2977 as amended by 2026/1731. The key point is the address: whether it is in the PID depends on the issuing member state. Germany’s draft law, for instance, takes over the online ID card data including address and nationality. For wallets from other countries the address may be missing, so your process needs a second path.

Request only what you need and register exactly these attributes for the intended use “AML customer identification” – you may not request more than registered: what data relying parties may request. Which attributes electronic identification means must provide for due diligence will be specified by the EU Anti-Money Laundering Authority in technical standards (Art. 28(1)(e) AMLR); we have not confirmed their adoption as of 12 October 2026 unverified.

Record keeping

Art. 77 AMLR requires obliged entities to keep copies of the documents and information obtained in customer due diligence, “including information obtained through electronic identification means”, for five years after the end of the business relationship. Instead of copies, references may be kept if the information can be provided immediately and cannot be altered (Art. 77(2)).

The portrait is a special case: relying parties may not retain the wallet portrait unless that is necessary for identification under EU data protection law or provided for by EU or national law (Art. 3a(3) Implementing Regulation 2024/2977). The AMLR’s mandatory identification data do not include a photo. In our reading you should therefore not request it unless your process needs it; whether the AMLR retention duty creates an exception to the ban has not been clarified unverified. See the portrait in the EUDI Wallet.

What to prepare now

1. Plan the registration with an intended use for AML identification and exactly the attributes above; the access certificate is only issued after registration.
2. Handle missing addresses for wallets from other member states.
3. Define what you keep: data, proof of signature, time – and leave out the portrait unless needed.
4. Check your provider: many identity verification providers are integrating the wallet; clarify who is the relying party and in whose name it registers.
5. Note the dates: AMLR from 10 July 2027, mandatory acceptance from 24 December 2027 – overview: EUDI Wallet deadlines.