Deutscher Bundestag [DEU] ¦ Digital Identities Act Adopted: The EUDI Wallet Enters German AML Law

Germany adopts the legal basis for the EUDI Wallet and opens it for AML identification

On 15 October 2026 the Bundestag adopted the Digital Identities Act (Digitale Identitätengesetz, DIdG), which implements the national parts of the amended eIDAS Regulation (EU) No 910/2014 for the European Digital Identity Wallet. The coalition of CDU/CSU and SPD voted in favour, and AfD, Bündnis 90/Die Grünen and Die Linke voted against. The Bundestag adopted the bill as amended by the Committee on Digital Affairs and State Modernisation, together with a resolution on the wallet’s pseudonym function, and rejected an AfD motion to restrict the wallet to public administration. The act requires the consent of the Bundesrat and enters into force on the day after its promulgation. Germany’s state wallet, called “d-you”, is scheduled to start on 2 January 2027. Our article on the ministry’s draft covered the first version of the text. For financial crime compliance, the most relevant change is in the Anti-Money Laundering Act (Geldwäschegesetz, GwG), which will accept the wallet for customer identification.

What the act does and does not regulate

The EUDI Wallet framework applies directly as EU law. The DIdG adds what that framework leaves to member states: which authorities are responsible, legal bases for individual measures, and amendments to sector laws. Its core is a new Act on the European Digital Identity Wallet (EBDIG), followed by changes to the Online Access Act, the Trust Services Act, the GwG, the passport and identity card laws and the register of basic company data.

The act does not commit Germany to one way of providing the wallet. The eIDAS Regulation allows three models: provision by the state itself, provision on its behalf under a public contract, or private provision recognised by the state. The Federal Ministry for Digital Affairs and State Modernisation (BMDS) chooses one or more of these models and publishes its decision in the Federal Gazette. At the committee’s request, any public contract must take appropriate account of the digital sovereignty of the EU and Germany.

Bastian Schwind-Wagner _Follow

"For obliged entities in Germany, the most practical part of the Digital Identities Act is a short amendment to the Anti-Money Laundering Act. The EUDI Wallet becomes an accepted means of verifying identity, the authentication and validation data replace the copy of the ID document, and the reference transfer for qualified electronic signatures disappears before the EU AML Regulation applies.

The wallet is due to launch on 2 January 2027, so onboarding teams have little time. They need to decide which wallet data they actually require, register as relying parties on that basis, and make sure the validation records end up in their KYC files in a form an auditor can follow."

The wallet becomes a GwG identification method

Article 6 of the act amends two provisions of the GwG. A new number 4a in section 12(1) adds the EUDI Wallet to the list of documents and means that obliged entities may use to verify a natural person’s identity, next to identity documents, the electronic identity function of the German ID card, notified eID systems and qualified electronic signatures.

Record keeping changes as well. Where identity is verified with the wallet, obliged entities do not keep a copy of an ID document. Instead, section 8(2) GwG will require them to record the electronic data generated when the person identification data are authenticated and validated under Article 5b(9) of the eIDAS Regulation. The explanatory memorandum links this to the record-keeping duty in Article 40(1)(a) of Directive (EU) 2015/849. In practice, the evidence of a wallet-based identification is the validation record, and firms have to be able to produce it on request.

The reference transfer for qualified electronic signatures disappears

The act also deletes the third sentence of section 12(1) GwG. That sentence required a reference transfer from an account in the customer’s name when identity was verified with a qualified electronic signature. The government points out that the EU AML Regulation (EU) 2024/1624, which applies from 10 July 2027, accepts a qualified electronic signature at assurance level “substantial” for customer identification without a reference transfer, and that the current AML Directive does not require one either. Dropping the requirement before then is meant to prepare obliged entities and their customers for the single EU rulebook and to avoid competitive disadvantages for German firms.

Who does what in the German wallet ecosystem

The BMDS is responsible for providing the wallet and for designating the bodies that issue person identification data (PID). The PID provider may not be the wallet provider at the same time. For companies and other legal persons, the commercial, cooperative, partnership, foundation and association registers are the authentic sources for PID, and the register of basic company data covers public bodies and entities under foreign law. The competence of the Federal Ministry of Finance for the transparency register stays unchanged.

The Federal Office of Administration (BVA) provides the validation mechanisms, registers relying parties centrally for Germany, keeps the list of registered relying parties and issues access and registration certificates. The Federal Office for Information Security (BSI) runs certification and handles security breaches, including suspending or withdrawing wallets. The Federal Network Agency (BNetzA) supervises the wallet framework and acts as single point of contact. After an amendment in committee, it should also explain on its website the aspects of supervision that matter to users.

Acceptance duties for banks and other private relying parties

Section 15(1) EBDIG applies Article 5f(1) to (3) of the eIDAS Regulation to situations without any cross-border element. Article 5f(2) obliges private relying parties that must use strong user authentication for online identification to accept the EUDI Wallet. The committee report names banking and financial services among the affected sectors, alongside transport, energy, health, postal services, education and telecommunications. Very large online platforms are subject to their own acceptance duty. Through section 15(1), the duty also covers purely domestic cases.

Where federal law requires proof of identity with the eID function of the German ID card, the eID card for EU citizens or the electronic residence permit, the wallet can be used instead unless a specific federal or state law provides otherwise or excludes it. The committee added that wallet use includes offline mode at a physical location using proximity technologies, which matters for identification in a branch or at a counter.

Data minimisation starts at registration

Relying parties must state at registration which data they intend to request from users, as Annex I point 9 of Implementing Regulation (EU) 2025/848 provides. The committee report states that the data minimisation principle of Article 5(1)(c) GDPR applies at that stage, so a relying party may not register for data it does not need for the intended use. The BMDS is to publish guidance on which data services can typically request under the applicable law and on the risks of profiling, particularly with private services.

For obliged entities this means an exercise before go-live: the data elements needed for customer due diligence under the GwG have to be defined, justified and registered. Requesting more than the identification duty requires may conflict with the registration, and requesting less leaves gaps in the KYC file.

Attestations, payments and the experimentation clause

Federal authorities will have to issue decisions and other documents granted on application as electronic attestations of attributes on request. The committee shortened the transition period from 24 to 12 months after promulgation. From then on, such attestations will also satisfy written-form requirements towards federal authorities, unless electronic procedures are excluded or a qualified electronic signature is required.

The wallet may integrate existing payment instruments of the user, provided they come from a licensed payment service provider and do not impair the wallet’s functions or security or create other undue risks. The provider must notify the BSI at least three months before the integration becomes usable. Ordinances and trials that concern payment services, financial services, the transparency register or identification means used for AML/CFT require the agreement of the Federal Ministry of Finance.

An experimentation clause allows the BMDS to test deviations from the act for up to two years, for example further identification methods, automated decisions including the use of artificial intelligence, PID for persons from the age of 13, or sector-specific acceptance requirements. The committee limited this to one renewal and requires the ministry to give the Bundestag committee at least two sitting weeks to comment before a trial is announced.

Pseudonyms, biometric photos and the opposition’s criticism

EU law requires the wallet to let users generate and store pseudonyms. According to the resolution, this function will not be available when d-you starts on 2 January 2027, and the Bundestag asks the government to provide it as soon as possible after launch and to give it priority. Users can refuse the inclusion of their facial image in the PID, as Annex I of Implementing Regulation (EU) 2026/1731 permits member states to allow.

The Greens supported a European digital identity in principle but found the protection against abusive data requests too weak, criticised the removal of the ban on automated transfers of biometric photos between passport authorities and objected to a launch without the pseudonym function. Die Linke called the act a minimal implementation, wanted the experimentation clause removed and rejected lowering the age for the electronic identity to 13. The AfD wanted a national wallet limited to administrative procedures. In the public hearing on 6 October 2026, experts from SPRIND, the Federal Data Protection Commissioner, the BNetzA, Bitkom, the Federation of German Consumer Organisations, epicenter.works and the municipal associations broadly welcomed the wallet but raised questions about security, limits on data requests, privacy and municipal implementation.

What obliged entities should prepare

The government estimates a one-off compliance cost of about €13.5 million for businesses and an annual increase of €1.1 million, against annual savings of about €121.7 million for the administration. For banks, payment institutions, crypto-asset service providers and other obliged entities, the work is concrete. Onboarding procedures need a wallet route with the validation data recorded as the GwG requires, the reference transfer for qualified electronic signatures can be removed from the process once the act is in force, and the registration as relying party has to match the data actually required for identification. The Bundesrat still has to give its consent, and the launch of d-you on 2 January 2027 sets the practical deadline.

Dive deeper

• Deutscher Bundestag ¦ Bundestag macht Weg für die EUDI-Wallet frei (Textarchiv, 15.10.2026) ¦ Link
• Deutscher Bundestag ¦ Drucksache 21/7408 – Gesetzentwurf der Bundesregierung, Digitale Identitätengesetz (DIdG) ¦ Link
• Deutscher Bundestag ¦ Drucksache 21/8617 – Beschlussempfehlung und Bericht des Ausschusses für Digitales und Staatsmodernisierung ¦ Link
• Deutscher Bundestag ¦ Plenarprotokoll 21/102 ¦ Link