What is a wallet-relying party?

A wallet-relying party (often just relying party) is any organisation that relies on the EUDI Wallet: it asks a user’s wallet for data or attestations in order to identify the user or check something, such as their age. That can be a bank, an energy supplier, a telecoms operator, an online shop or a public authority in any member state. Every relying party must register in advance and may only request the data it has registered (Art. 5b(1) and (3) eIDAS).

This page explains the role from an EU-wide perspective. It is general information, not legal advice.

The roles in the EUDI ecosystem

Which wallets exist in which country: EUDI wallets in the EU and the EUDI index.

Obligations of a relying party

Register in the member state of establishment

A relying party that intends to rely on EUDI Wallets registers in the member state where it is established (Art. 5b(1) eIDAS). Registration must be cost-effective and proportionate to risk. At minimum it covers the member state, name, registration number where applicable, contact details and the intended use, including the data requested (Art. 5b(2)).

The detailed rules are in Implementing Regulation (EU) 2025/848, which applies from 24 December 2026 (Art. 11) and was amended by Implementing Regulation (EU) 2026/1730. Each member state keeps at least one national register and designates at least one registrar (Art. 3). How registration works in practice: Relying party registration.

Request only registered data

A relying party must not ask users for data beyond what it has registered (Art. 5b(3) eIDAS). An online shop that only needs to check age registers that purpose and does not receive the customer’s full name and address. If a relying party requests more attributes than it has registered, the registrar can suspend or cancel its registration (Art. 9(2)(c) of Regulation 2025/848); its certificates are then revoked (Art. 9(6)).

Identify itself to the wallet

Relying parties must identify themselves to the user (Art. 5b(8) eIDAS). With every request, the relying party authenticates itself to the wallet using an access certificate. Access certificates are issued only to registered relying parties, and the certificate policies are harmonised across the EU (Art. 7 and Annex IV of Regulation 2025/848).

Relying parties also receive a registration certificate. It shows, per intended use, which data are registered, and the wallet informs the user when a request goes beyond that (Art. 8(2)(d)). Since the amendment by Regulation (EU) 2026/1730, every member state must authorise at least one provider of registration certificates, which issues them automatically and without undue delay after registration (Art. 8(1)). In the original 2025 text this was optional.

Report changes

If registered information changes, for example the company name or a purpose, the relying party must update its registration without delay (Art. 5b(6) eIDAS, Art. 5(3) of Regulation 2025/848).

The registers are public

Registration information is made publicly available online (Art. 5b(5) eIDAS). From 24 December 2026, every member state must publish its register in human- and machine-readable form, through a common API and a national website (Art. 3 of Regulation 2025/848). Annex II specifies a REST API returning JSON signed as JWS (RFC 7515), described in OpenAPI 3 and searchable without prior authentication. The responses contain the Annex I information and current and historic certificates. One item is excluded: the regulation refers to “the contact information in Annex I point 4”, and point 4 is the physical address of establishment.

The technical details are set out in the Commission’s technical specifications TS5 (formats and API) and TS6 (the common set of information to register). Each registered intended use lists the credentials and individual attributes (claims) requested. That makes it possible to see, across the EU, which organisation asks for which data and why.

The Commission must publish a signed, machine-readable list of all registrars and registers based on member states’ notifications (Art. 5a(18)(a) eIDAS, Art. 5(1) of Implementing Regulation (EU) 2024/2980). As of 12 October 2026 this list has not been published.

Eudigo collects and analyses these registers for all member states once they are online and publishes aggregate figures in the EUDI index. Individual entries relating to natural persons, such as sole traders, are not republished one by one.

Intermediaries

Many organisations will not connect the wallet themselves but use a service provider. Such intermediaries are deemed to be relying parties themselves and must not store data about the content of the transaction (Art. 5b(10) eIDAS). In the register, a relying party states whether it uses an intermediary and which one (Annex I points 14 and 15 of Regulation 2025/848). Regulation 2026/1730 added point 16, which links an intermediary holding the access certificate to the relying parties it acts for. The TS5 data model also flags services that act as intermediaries.

An example

A mobile operator wants to identify new customers online. It registers an intended use such as “identity verification at contract signature” and states that it requests name, date of birth and address for it. Its access certificate identifies it to the wallet. The customer sees in the wallet who is asking and which data will be shared, and approves the release. For a second purpose, such as an age check in the operator’s shop, it needs another registered intended use, because data and purpose are registered per intended use (Annex I points 9 and 10 of Regulation 2025/848). The example is simplified and says nothing about which data a particular business may or must collect.

Who has to become a relying party?

Anyone who wants to use the wallet, voluntarily or because they must. Public bodies that require electronic identification for online services must accept EUDI Wallets (Art. 5f(1) eIDAS). Many private companies in regulated sectors, such as banking, energy, transport and telecoms, must accept the wallet at the user’s request from 24 December 2027 at the latest (calculated) if they require strong user authentication; micro and small enterprises are exempt (Art. 5f(2)). Very large online platforms are also covered; the regulation sets no separate date for them (Art. 5f(3)).

Details: Mandatory acceptance, Small business exemption and the deadlines overview.

A national example: Germany

In Germany, the draft Digital Identities Act (DIdG) names the Federal Office of Administration (Bundesverwaltungsamt, BVA) as registrar for a single central register; the BVA would also issue access and registration certificates (§ 2(2) no. 2(b) and § 10(1) of the draft). As of 12 October 2026 the act is a government (cabinet) bill; the Bundestag’s second and third reading is scheduled for 15 October 2026. The EU rules leave this choice to each member state: a provider of access certificates can be any natural or legal person mandated by a member state (Art. 2(11) of Regulation 2025/848). Which bodies other countries choose: see Relying party registration.