In short
A relying party that intends to rely on the wallet registers in the Member State where it is established and states the intended use, including the data it will request Art. 5b(1) Art. 5b(2). It requests nothing more Art. 5b(3). Implementing Regulation 2025/848, which organises this registration, applies from 24 December 2026 Art. 11. Certain private companies and very large online platforms will also have to accept the wallet, upon the voluntary request of the user Art. 5f(2) Art. 5f(3).
This guide is part of step 7. The role of the relying party is presented in step 2, its obligations and its registration are explained in step 3. Here, they are set out again as a working list.
Your obligations
The table sets out each obligation with its legal basis. A deadline is indicated only if the text gives one.
| Obligation | Legal basis | Deadline |
|---|---|---|
| Register in the Member State where you are established, where you intend to rely on the wallet for the provision of public or private services by means of digital interaction | Art. 5b(1) | Implementing Regulation 2025/848 applicable from 24 December 2026 Art. 11 |
| Provide at least the information in Annex I to Implementing Regulation 2025/848 (identification, contact details, intended use and data requested), accurate at the time of registration | Art. 5b(2) Art. 5(1) Art. 5(2) | idem |
| Provide the URL of your privacy policy for the intended use (Member States ensure this) | Art. 8(2)(g) | idem |
| Not request any data other than that indicated in the registration | Art. 5b(3) | — |
| Report any change to the registered information without delay, and update it without undue delay | Art. 5b(6) Art. 5(3) | — |
| Identify yourself to the user | Art. 5b(8) | — |
| Authenticate and validate the person identification data (PID) and the attestations requested from the wallet | Art. 5b(9) | — |
| Not refuse pseudonyms where Union or national law does not require the identification of the user | Art. 5b(9) | — |
| If you are an intermediary acting on behalf of a relying party: you are deemed to be a relying party and do not store data about the content of the transaction | Art. 5b(10) | — |
| Inform the registrar and request the cancellation of the registration when you no longer intend to rely on wallet units | Art. 6(7) | — |
| Private relying party required, by law or by contract, to use strong user authentication, excluding micro and small enterprises: also accept the wallet, only upon the voluntary request of the user | Art. 5f(2) | no later than thirty-six months after the entry into force of the implementing acts on the wallet and its certification Art. 5f(2) |
| Provider of a very large online platform that requires authentication: accept and facilitate the wallet, only upon the voluntary request of the user and for the minimum data necessary | Art. 5f(3) | no deadline in the text Art. 5f(3) |
A dash indicates that the cited provision sets no deadline of its own.
Two practical consequences follow from these rules. Only a registered relying party receives an access certificate, which authenticates it to wallets Art. 7(2) Art. 2(12). And the registrar may suspend or cancel a registration, in particular if it contains inaccurate, outdated or misleading information, or if the relying party requests more attributes than it has registered Art. 9(2)(a) Art. 9(2)(c).
If you also rely on qualified signatures, seals or certificates, the qualified trust service provider that issued the underlying qualified certificate provides you, free of charge, with information on the validity or revocation status of that certificate Art. 24(4), and the trusted list of its State indicates its qualified services Art. 22(1). These mechanisms are presented in step 5.
The texts to read, in order
- Consolidated Regulation 910/2014, the article on wallet-relying parties Art. 5b, then the one on acceptance of the wallet Art. 5f. Library page for the Regulation.
- Implementing Regulation 2025/848 on registration: information to be provided, procedure, certificates, suspension Art. 1. Library page for Implementing Regulation 2025/848.
- Implementing Regulation 2024/2982 on protocols and interfaces, in particular the presentation of attributes to relying parties and erasure requests Art. 1. It is addressed to wallet providers, but describes what your systems will receive. Library page for Implementing Regulation 2024/2982.
- Implementing Regulation 2024/2977 on PID and attestations, to find out what the PID contains Annex. Library page for Implementing Regulation 2024/2977.
- The ARF, version 3.0.0 in this corpus, to understand the architecture; it is informative ARF 3.0.0 § 1.3 Purpose, scope and audience. Library page for the ARF.
Checklist
- We have identified each service where we want to rely on the wallet Art. 5b(1).
- For each intended use, the list of data to be requested has been settled Art. 5b(2)(c) Annex I.
- Our registration information is accurate and our privacy policy has a URL Art. 5(2) Art. 8(2)(g).
- A procedure ensures that the registration is updated with each change Art. 5b(6) Art. 5(3).
- Our systems do not request any data other than those declared Art. 5b(3).
- We authenticate and validate the PID and attestations received Art. 5b(9).
- We accept pseudonyms where the law does not require the identification of the user Art. 5b(9).
- If we use an intermediary, it does not store data about the content of transactions Art. 5b(10).
- We have checked whether we are required to accept the wallet (strong authentication imposed, size of the company, very large platform) Art. 5f(2) Art. 5f(3).
- We know how to request the cancellation of a registration that is no longer needed Art. 6(7).
Advice
Asphalia advice
Where to start. Start from your customer journeys, not from the technology. For each journey where you identify someone or verify a capacity (age, diploma, mandate), note the strictly necessary data and the legal basis that authorises you to request it. This list becomes the core of your registration: the Regulation prohibits you from requesting anything else Art. 5b(3). Have it validated jointly by the business, the data protection officer and the technical team.
Asphalia advice
The pitfalls.
- Declaring broadly “just in case”. An overly broad declaration attracts questions. From the wallet dashboard, the user can ask you to erase their data, or report to the data protection authority a request that seems unlawful or suspicious to them Art. 5a(4)(d). An overly narrow declaration blocks your journeys, because requesting more than declared can lead to suspension Art. 9(2)(c). Aim accurately, and keep it updated.
- Forgetting erasure requests. Wallets allow the user to ask you to erase the data transmitted Art. 6. Plan who receives them and how they are handled.
- Entrusting integration to an intermediary without saying so. The intermediary is itself a relying party and keeps nothing of the content of transactions Art. 5b(10); registration provides for mentioning the use of an intermediary Annex I. Check your contracts.
- Calculating the acceptance deadline on your own. The thirty-six-month period runs from the entry into force of specific implementing acts Art. 5f(2). Follow the dates published by the authorities rather than an internal calculation.
Consolidation without official value
This page cites the consolidated versions, published on EUR-Lex, of Regulation 910/2014 and Implementing Regulations 2024/2977, 2024/2982 and 2025/848 Regulation (EU) No 910/2014 — consolidated version of 18/10/2024 Implementing Regulation (EU) 2024/2977 — consolidated version of 11/08/2026 Implementing Regulation (EU) 2024/2982 — consolidated version of 11/08/2026 Implementing Regulation (EU) 2025/848 — consolidated version of 11/08/2026. These consolidations are documentation tools: only the Official Journal of the European Union is authentic.
Key points
- Register in your Member State before relying on the wallet Art. 5b(1).
- Request only the data declared for each intended use Art. 5b(3).
- Keep the registration up to date Art. 5b(6).
- Authenticate and validate what you receive, and accept pseudonyms where the law does not require identification Art. 5b(9).
- Check whether acceptance of the wallet is imposed on you Art. 5f(2) Art. 5f(3).
Written by Asphalia.