Digital Identity

What digital identity actually means

Digital identity is a verified representation of a real person’s identity that exists in electronic form, issued by a trusted source, and capable of being presented to prove who someone is without relying on a physical document. It’s not the same as an online account or a password; it’s meant to function as the electronic equivalent of a passport or driving licence, something that carries genuine, verified proof of identity rather than just access to a specific service.

Digital identity vs a login: a distinction worth being precise about

A login proves you have access to an account; it doesn’t prove who you are. Usernames and passwords, and even most two-factor authentication, verify that whoever is signing in knows a secret or controls a device, not that they’re a specific, real, verified person.

A genuine digital identity is built on identity proofing that happened at some point, a document check, a biometric match, verification against a government record, and then represents the result of that proofing in a form that can be reused and presented elsewhere, ideally without repeating the entire proofing process from scratch every time.

The EU Digital Identity Wallet: what’s actually mandated, and when

The clearest binding example of digital identity moving from concept to law is the European Union’s eIDAS 2.0 regulation, formally Regulation (EU) 2024/1183, which entered into force on 20 May 2024. It requires every EU member state to make at least one certified European Digital Identity Wallet, the EUDI Wallet, available to citizens and businesses by the end of 2026.

That deadline applies to member states providing the wallet, not to businesses accepting it. Large private-sector organisations in regulated sectors, banking, healthcare, telecoms, and large online platforms, have a separate deadline roughly a year later, late 2027, by which they’re required to accept the EUDI Wallet as an authentication method where relevant.

What the EUDI Wallet will actually let people do

The EUDI Wallet is designed to hold verified credentials, not just a single identity document: proof of age, a driving licence, educational qualifications, and financial account access, all in one wallet a person controls on their own device, rather than in each individual service’s own database. A person could, in principle, prove they’re over 18 to a retailer, prove their professional qualification to an employer, or complete identity verification for a new bank account, all using the same underlying verified credential.

The stated policy goal is interoperability: a credential verified once, to a defined standard, that’s genuinely reusable across borders and sectors, rather than every organisation running its own separate identity proofing process from scratch.

The UK’s parallel but separate approach

The UK, no longer bound by EU regulation, has built a parallel but structurally separate framework. The Digital Identity and Attributes Trust Framework, DIATF, moved from voluntary guidance to statutory footing under the Data (Use and Access) Act 2025, in force since 1 December 2025, with a formal certification mark, version 1.0, published 6 March 2026.

Rather than a single government-issued wallet like the EU model, the UK’s approach certifies private-sector Digital Verification Service providers against defined confidence levels, GPG45’s Low, Medium, High, and Very High tiers, creating a market of certified providers rather than one centralised wallet.

Mobile driver’s licenses: the quieter US rollout

In the US, the most concrete near-term digital identity development isn’t a comprehensive wallet but the mobile driver’s license, mDL, an electronic version of a state-issued driving licence stored on a phone, built to the ISO/IEC 18013-5 international standard specifically so it can be read consistently by verifiers across different states and industries. Adoption has been gradual and state-by-state rather than federally mandated, which is a meaningfully different rollout model from the EU’s binding, deadline-driven approach.

The technical backbone: verifiable credentials

Most modern digital identity systems, including the EUDI Wallet, are built on verifiable credentials, a W3C technical standard for issuing, holding, and presenting cryptographically signed digital claims. A verifiable credential lets a holder present proof of an attribute, such as being over a certain age or holding a valid licence, in a way a relying party can cryptographically confirm was genuinely issued by the claimed authority and hasn’t been tampered with, without necessarily contacting the issuer directly at the moment of presentation.

Reusable identity and what it means for KYC specifically

For KYC and AML compliance specifically, reusable digital identity offers a genuine efficiency case: a customer who has already been verified to a defined assurance level by one institution, or by a government-issued wallet, shouldn’t necessarily need to repeat the entire identity proofing process from scratch at every new provider they deal with.

That promise remains mostly theoretical for regulated financial services today. Firms still generally need to run their own CDD process and satisfy their own regulator that verification meets the applicable standard, even where a customer arrives holding a credential verified elsewhere. Genuine reliance on third-party digital identity for full regulatory purposes is still the exception, not the default, in most jurisdictions as of this writing.

Why digital identity adoption has been slower than the hype suggested

Digital identity has been discussed as an imminent transformation for over a decade, and the gap between that discussion and binding deployment has been wide until quite recently. Technical complexity, cross-border interoperability requirements, and genuine, well-founded privacy concerns about centralising identity data have all slowed rollout considerably.

The EU’s binding, dated legal deadline is different in kind from earlier voluntary pilots and discussion papers precisely because it removes the option to keep treating digital identity as a future consideration. A hard, dated legal deadline changes planning timelines in a way that years of conceptual discussion didn’t.

Privacy design: selective disclosure

Privacy protection is built into the newer generation of digital identity frameworks through selective disclosure: the ability to prove a specific fact, that you’re over 18, that you hold a valid professional licence, without revealing the underlying data that fact is based on, such as an exact date of birth or full document details.

This is presented as a genuine improvement over physical documents, which typically reveal everything on the document, full date of birth, address, document number, even when only one specific fact actually needed confirming.

What this means for a compliance programme today

For a compliance programme today, the practical position is preparation rather than dependency. The EU deadline for member states, the UK’s now-statutory DIATF framework, and the gradual US mDL rollout are all real, dated developments worth tracking directly rather than assuming stay theoretical, but none of them yet let a regulated firm skip its own identity verification obligations. Firms operating in or with the EU specifically should treat the 2026 wallet deadline, and the follow-on 2027 private-sector acceptance deadline, as concrete integration planning milestones, not distant possibilities.

Frequently asked questions

Read more: our ultimate guides, whitepapers and templates

Related guides and resources to help you act on what you just read.