The European Payments Council has launched SCARLET, a new initiative to establish common rules for using EU Digital Identity Wallets in payment authentication. With more than 3,000 payment service providers and at least 27 wallet providers expected across Europe, the challenge is increasingly moving beyond the technology itself. The question is how banks, wallet operators and payment networks can establish the interoperability, responsibilities and commercial arrangements necessary for adoption.
Europe’s digital identity programme is approaching an important transition. While Member States prepare to introduce their EU Digital Identity Wallets, the financial services industry is beginning to address what happens when those wallets need to work with existing payment infrastructure.
The European Payments Council (EPC) has announced the development of SCARLET, the Strong Customer Authentication Acceptance Rulebook and Liability Framework for EUDIW Transactions. The initiative is intended to establish common business, operational and technical rules for payment service providers accepting EU Digital Identity Wallets for customer authentication.
Approved by the EPC Board on 24 September 2026 and publicly announced in October, SCARLET responds to an approaching regulatory obligation under the revised European Digital Identity Framework, commonly known as eIDAS 2.0.
The development reflects a broader change in Europe’s digital identity programme. As the initial wallet rollout approaches, attention is shifting from building digital identity infrastructure towards making that infrastructure usable across different sectors, organisations and national markets.
Payments represent one of the most commercially significant tests of that ambition.
More than 3,000 payment providers, at least 27 wallets
The scale of the interoperability challenge is considerable. According to the EPC, more than 3,000 payment service providers and at least 27 EU Digital Identity Wallet providers are expected to operate across the EU and European Economic Area. Without a common framework, these organisations could develop different approaches to wallet-based customer authentication, creating additional integration requirements and potentially incompatible implementations.
The wallet programme itself is based on common European technical specifications, but standardised wallet capabilities do not automatically establish the contractual and operational relationships required by the payments industry.
Banks and other payment service providers need to determine how customers are authenticated, which credentials they can accept, how those credentials are verified and how responsibility is allocated between the organisations involved. SCARLET is intended to address these questions through a common industry framework.
The EPC plans to establish eligibility requirements and participation obligations, common functional and operational rules, and technical specifications building on the European Commission’s Architecture and Reference Framework, its TS12 payment-authentication specification and experience from the EUDI Wallet large-scale pilots.
The intention is to provide a consistent approach across European payment services without requiring every bank and wallet provider to negotiate its own technical and contractual arrangements.
That is an important distinction. The European Union can establish the regulatory requirements for digital identity, but large-scale commercial adoption also depends on the organisations expected to use that infrastructure agreeing on how it will work in practice.
What changes when a wallet is used for payments?
The EUDI Wallet is designed to allow users to identify themselves, store verified credentials and selectively share information with trusted parties. In a payments context, it can also provide a means of meeting Strong Customer Authentication (SCA) requirements.
Under the existing Payment Services Directive, PSD2, payment service providers must apply SCA in specified circumstances, including when customers access payment accounts online or initiate electronic payments. Traditionally, this may involve a banking application, a security device or another authentication method controlled by the customer’s payment provider.
With an EUDI Wallet, the authentication process could instead involve a wallet containing an attestation issued by the customer’s bank or another authorised provider. For example, a customer making an online purchase could receive an authentication request through their wallet. The wallet would display relevant transaction information, such as the amount and payee, and the customer could confirm the operation using the device and an additional authentication factor, such as a PIN or biometric verification.
The resulting cryptographic proof would allow the payment provider to verify that the required authentication had taken place and was linked to the specific transaction. Importantly, the wallet is not necessarily the payment instrument. It provides an authentication capability that can work alongside existing card and account-to-account payment systems.
The European Commission’s payment-authentication use case explicitly envisages integration with existing infrastructure, including SEPA credit transfers and card payments. That distinction matters commercially. The EUDI programme is not proposing that European identity wallets replace established payment networks. Instead, it introduces another way of authenticating users within those networks.
The responsibility question
One of the most significant elements of SCARLET is its explicit inclusion of a liability framework. In a conventional banking environment, payment providers already operate within established legal and contractual arrangements governing customer authentication, transaction authorisation, fraud and liability. Introducing an independently operated digital identity wallet adds new participants and potentially new dependencies to that process.
A wallet provider may be responsible for the secure operation of its application, while a bank remains responsible for authenticating its customer and authorising payments under applicable financial regulation. Credential issuers, payment processors and other service providers may have their own obligations.
These responsibilities need to remain clear when multiple organisations participate in a single authentication flow. SCARLET aims to define the relationships and obligations of participating entities, including the allocation of responsibility within the scheme.
The challenge, however, extends beyond technical interoperability. Bringing EUDI Wallets into payment authentication changes the relationship between consumer choice, operational control and financial responsibility.
Kristian Thure Sørensen of IN Groupe argues that SCARLET must address something more fundamental than an isolated liability question:
“Rather than settling one isolated liability issue, SCARLET has to address a fundamental paradigm shift: historically, banks accepted strict liability for unauthorised payments because they chose and controlled the Strong Customer Authentication (SCA) tool. With the EUDI Wallet, authentication becomes the citizen’s choice via an external wallet the bank doesn’t control, yet payment regulations still leave the bank holding the financial liability towards the customer.”
This creates a commercial challenge that technical standards alone cannot resolve. Banks must be able to establish responsibilities and manage disputes even when the authentication process involves an independently operated wallet.
He adds;
“Before banks can confidently accept them at scale, SCARLET must establish the commercial rulebook that gives banks standardised dispute resolution and enforceable scheme rules to manage a risk they no longer directly control.”
— Kristian Thure Sørensen, IN Groupe, speaking in a personal capacity.
The EPC is developing the initiative in response to an invitation from the European Commission’s DG CNECT and DG FISMA, working in close collaboration with the Commission and the European Banking Authority. Wallet ecosystem representatives and other stakeholders will participate through a multi-stakeholder group.
That structure recognises that European digital identity and financial regulation are becoming increasingly interconnected. It also illustrates why technical interoperability is only one part of the implementation challenge. Two systems may successfully exchange credentials, but commercial interoperability requires agreement on the legal and operational consequences of using them.
Two deadlines, and a difficult implementation timetable
The timing introduces another important consideration. Under the European Digital Identity Framework, Member States are required to make at least one EUDI Wallet available by the end of 2026. The obligations for certain private-sector providers to accept wallets for Strong Customer Authentication follow a separate timetable, generally extending to the end of 2027.
These are different milestones, with different practical requirements. Making a wallet available does not mean that every bank, merchant or payment service provider will immediately be ready to accept it. SCARLET version 1.0 is being developed around the existing PSD2 framework and the European Banking Authority’s current technical requirements for SCA.
The EPC intends to conduct an open consultation during summer 2027 and publish the first rulebook in December 2027. The scheme would then enter into effect following an implementation period covering development, testing, onboarding and certification.
A subsequent SCARLET version 1.1 is planned to accommodate the forthcoming Payment Services Regulation, with the intention of supporting compliance as the revised payments framework takes effect in 2028 and 2029. This creates a demanding sequence of regulatory, technical and commercial milestones.
The initial scheme is still under development, and its final provisions have not yet been agreed. Nevertheless, payment providers already know that wallet acceptance will require preparation beyond the installation of new software. The industry will have to coordinate authentication methods, credentials, trusted-party relationships and compliance obligations while European wallet implementations are themselves entering service.
From pilot projects to commercial infrastructure
Payment authentication has already featured in the EUDI Wallet large-scale pilot programme. The NOBID consortium, involving Nordic and Baltic countries together with Italy and Germany, has explored the use of wallets to authorise payments for products and services. The European Digital Wallet Consortium has also demonstrated payment-related use cases, including online and in-person transactions.
These projects have helped test the technical and user-experience requirements of wallet-based authentication. But moving from a pilot to a commercial service introduces additional considerations. A payment provider needs to know whether a wallet meets the applicable requirements, whether credentials originate from a trusted issuer, how authentication evidence is retained and how disputed transactions will be handled. It must also support customers using different national wallets, potentially issued by organisations operating under different domestic arrangements.
SCARLET is intended to establish common ground across these implementations rather than leaving individual payment providers to solve the same problems independently. For consumers, the potential benefit is straightforward: an authentication method that can work across services and national boundaries without requiring separate arrangements for every provider.
For businesses, the potential lies in more consistent customer authentication, simpler integration and reduced fragmentation. Whether those benefits translate into lower costs or improved conversion rates will depend on the quality of implementation and subsequent adoption. The more demanding task is therefore to turn a technically possible authentication process into a dependable commercial service.
A test of Europe’s digital trust infrastructure
The development of SCARLET provides an indication of where Europe’s digital identity programme is heading. The emphasis is expanding from the provision of digital credentials to the systems and relationships required for those credentials to be accepted in everyday transactions. Payments offer a particularly revealing example because they operate within an established regulatory environment in which authentication, authorisation, fraud management and liability must function together. The technology must be secure, but it must also be usable by customers, interoperable across providers and supported by clear rules when something goes wrong.
For Europe, this represents a practical test of its wider ambition to create interoperable digital infrastructure across the single market. Success will depend on more than the number of wallets issued or the number of Member States meeting their launch deadlines. It will depend on whether the organisations expected to use those wallets can incorporate them into real services without introducing another layer of fragmentation. SCARLET is an attempt to establish part of that missing commercial framework.
Its significance lies in the recognition that a European digital identity system will only achieve its intended scale when technological interoperability is matched by operational responsibility and market participation. As Europe’s wallets move towards deployment, the payments industry is beginning the work that will determine whether they become an everyday part of the digital economy.
Leave a Reply