SecurityBrief UK - Technology news for CISOs & cybersecurity decision-makers
616
Wed, 22nd Apr 2026 (Yesterday)

Consider how bank onboarding still works in many places today. Paper or scanned documents. Selfie checks. Video calls with third-party providers. And long manual review queues whenever something doesn't match perfectly. The process exists because banks need to know who their customers are, but the friction it creates drives abandonment rates that would be unacceptable at any other stage of the customer journey.

Now imagine that same customer presenting a digital credential from their phone - government-anchored, cryptographically verified, shared only with their explicit consent. No document uploads. No video calls. The bank knows the credential carries authoritative verification without the friction of proving it from scratch. This is not a theoretical future. In Europe, it is already written into law and now moving from regulation into implementation.

By the end of 2026, all EU member states must offer citizens access to digital identity wallets. By the end of 2027, any business requiring strong customer authentication will be legally required to accept these wallets as proof of identity. More than 350 organisations are already participating in large-scale pilots. The technical specifications are being finalised. The initial real-world use cases are emerging.

From proving you can pay to proving who you are

The deeper shift is in how trust flows through payment systems. Traditional fraud prevention relies on pattern detection - algorithmic models that flag anomalies and assign risk scores. This approach treats identity as probabilistic. The new model is fundamentally different: cryptographic verification of government-anchored credentials. The question moves from "does this transaction look legitimate?" to "is this person verified?"

For payments, this represents a structural change. The focus shifts from proving the customer can pay to proving who they are. Once identity is established with sufficient assurance, the payment follows. Identity becomes, in effect, a payment rail. Not moving money, but moving the trust that authorises money to move.

Consent architecture as challenge

Digital identity wallets are designed to give users control over what they share, when, and with whom. Banks have historically been gatekeepers of customer data. That relationship is inverting. In a wallet-based model, the customer decides which credentials to present and which attributes to disclose. The institutions that design the most transparent, user-friendly consent experiences will earn trust. Those that treat wallet acceptance as a compliance checkbox will find customers choosing providers who make the process feel respectful rather than extractive.

Integration reality

Most bank systems are not built to interact with decentralised identity wallets. Solving that integration challenge is where competitive advantage will emerge. Translation layers and gateways that connect existing infrastructure to wallet ecosystems - without requiring full system overhauls - are becoming critical components. The organisations that build this capability early will set standards others follow.

There is also the interoperability question. Wallets issued in one jurisdiction are supposed to work across borders, but implementation timelines and technical choices vary. Banks operating across multiple markets will need to manage what could be a fragmented landscape with agility. The upside: those prepared for complexity will be positioned to capture opportunity when competitors struggle.

While many organisations are still focused on compliance checklists and rollout timelines, the real opportunity is strategic. Digital identity is converging with payments. The customer relationship is being restructured around consent and control. Market leadership in this space remains open. The question for every bank and payment provider is whether they are treating this as an IT project or as a fundamental repositioning of how they earn and maintain customer trust.