The EUDI Wallet for Banks and Fintechs: SCA, PSD2/PSD3 and Onboarding

Banks and payment institutions are unusual among relying parties: they are already subject to strict customer authentication and identity verification obligations under PSD2, are explicitly named among the sectors obliged to accept the EUDI Wallet under eIDAS 2.0, and are the segment where the wallet's business case is most immediate because they run the highest volume of repeat, high-friction identity checks — account opening, strong customer authentication, and periodic re-verification under AML rules.

Where the wallet intersects PSD2 and the coming PSD3

PSD2's strong customer authentication (SCA) requires two independent factors from three categories: something you know, something you have, and something you are. A wallet-based presentation can satisfy possession (the device-bound private key) and, depending on the wallet's local unlock mechanism, inherence or knowledge as well — effectively delivering SCA in a single interaction instead of a password plus an SMS code or app push. The draft PSD3 and the accompanying Payment Services Regulation explicitly anticipate this convergence, referencing eIDAS-compliant electronic identification as an accepted SCA element rather than treating it as a separate compliance track.

For payment initiation and account information services under open banking, wallet-based identification also simplifies the identity assurance step required before granting access to a third-party provider — replacing redirect-based bank login flows that are themselves a frequent source of conversion loss.

Retail account opening

1. The applicant presents a PID attestation instead of a passport scan and liveness video.
2. The bank verifies the signature chain against the EU Trust List and checks revocation status.
3. AML customer due diligence is satisfied by the government-issued, cryptographically signed identity data, subject to the bank's usual risk-based screening (PEP, sanctions, adverse media).
4. The bank issues its own non-qualified attestation back into the customer's wallet — an account-holder credential, a card-tier attribute, or a relationship-manager assignment — that the customer can reuse across the bank's own channels.

This closes the loop that document-based onboarding never could: the bank becomes both a relying party (verifying the PID) and an issuer (attesting the resulting relationship), and the second half of that loop is where most of the long-term product value sits — reusable proof of account status for lending, brokerage or insurance partners without re-running full KYC.

Corporate onboarding and mandates

Corporate account opening is where document-based processes fail hardest today: verifying beneficial ownership, signing authority, and board resolutions typically means chasing PDFs, notarised extracts and manual cross-checks against national business registers. The wallet ecosystem extends the same attestation model to legal persons and their representatives:

• A legal-entity wallet or a natural person's wallet can hold a signed attestation of representation authority — proof that a named individual can bind the company for a defined scope of transactions.
• Mandate attestations can be scoped and time-limited, so a bank can verify a treasury officer's authority to open a specific account type without a fresh notarised document each time the mandate needs re-confirmation.
• Beneficial ownership data, once attested by a national business registry as a credential, becomes machine-verifiable rather than something a compliance analyst re-keys from a PDF extract.

Corporate KYC has been the slowest, most manual part of business banking for a decade. Attested mandates are the first realistic path to making it verify itself.

Periodic re-verification and ongoing monitoring

AML obligations require periodic re-verification of customer information, not just a one-time check at onboarding. Wallet-based attestations make this far cheaper to run: instead of prompting customers to resubmit documents, the bank requests a fresh presentation of the same attributes, verifies the signature and revocation status, and updates its records — a process that can be largely automated and triggered at defined intervals or risk events rather than through manual outreach campaigns.

The business case for moving early

• Lower cost per verified customer across both retail account opening and periodic AML re-verification.
• Higher conversion at account opening, where document capture and liveness checks are consistently the highest-abandonment step.
• Reduced fraud losses from forged or stolen documents, particularly relevant for synthetic identity fraud in unsecured lending.
• Competitive differentiation during the adoption window before wallet-based onboarding becomes table stakes across the sector.
• A foundation for issuing reusable, bank-attested credentials that create stickiness across a customer's other financial relationships.

Rollout sequencing that works in practice

1. Start with SCA at login and payment confirmation, where the integration surface is narrow and the user benefit (fewer OTP prompts) is immediate.
2. Extend to retail account opening as a parallel path alongside existing document-based onboarding.
3. Pilot corporate mandate attestations with a small set of business customers and a single account type before generalising.
4. Automate periodic AML re-verification last, once volume through the wallet channel is high enough to justify the workflow change.

Why most banks will not build the integration layer themselves

Each of these use cases requires Relying Party registration, certificate management and conformance tracking across every Member State and every wallet a bank's customer base might use — a standing regulatory function most banking IT organisations would rather not own directly, especially given how quickly the underlying framework is still evolving. Arkadiz operates as the intermediary Relying Party for exactly this reason: banks and fintechs integrate once against a single API to cover SCA, account opening, corporate mandates and periodic re-verification across multiple Member States and wallets, while Arkadiz carries the registration, certificate lifecycle and conformance work in the background.