Summary

EU’s  payment and identity landscape is currently the theater of a high-stakes conflict between regulatory ambition and commercial reality. For the past decade, European legislators have pursued a strategy of “regulatory innovation,” attempting to break the dominance of US-based technology platforms (Apple, Google) and payment networks (Visa, Mastercard) through legislative mandates. From the failed efforts of 2015 IFR (regulating excess profits), PSD2, PSD3 and eIDAS 2.0, the pattern is consistent: enforce technical openness in the hope that competitive markets will spontaneously emerge.

This strategy is fundamentally flawed because it conflates technical connectivity with commercial viability. While the EU has successfully legislated open APIs and is now forcing open the phone SE architecture, it has consistently failed to address the “commercial constructs” (governance, liability, and economic incentives) that make these systems work. Without a radical shift acknowledging the necessity of commercial constructs over regulation, the EU’s initiatives will result in compliant but commercially irrelevant infrastructure, that no one will monetize (or invest in), further relegating the EU to a second tier market and leaving US platforms to dominate.

eIDAS 2.0 follows in the footsteps of PSD2 Failure 

The history of PSD2 serves as a grim foreshadowing for the European Digital Identity Wallet. Just as PSD2 mandated open data without a business model, eIDAS 2.0 is mandating digital identity issuance without a clear path to monetization. The assumption that “if you build it (and mandate it), they will come” is testing the patience of the banking sector, which is once again being asked to foot the bill for public infrastructure.

To me, it is an obvious statement that tech is merely the plumbing of the financial system. The product is a commercial construct with governance. This distinction is consistently missed by regulators who view payments as a utility rather than a risk-management business.

Visa and Mastercard are not technology companies in the purest sense; they are governance companies. Their core IP is not the ISO 8583 message format, but the commercial framework combined with an actively managed rulebook that guarantees that if a cardholder in Tokyo taps a terminal in New York, the merchant will get paid, and if the merchant defrauds the customer, the customer will get a refund.

European initiatives like Open Banking and eIDAS lack this layer. They are “statutory” constructs, not commercial ones. This governance deficit explains why “Big Tech” and the “Card Networks” remain dominant despite open access mandates. 

eIDAS 2.0 regulation (Regulation (EU) 2024/1183) is the EU’s attempt to regain sovereignty over digital identity. It mandates the rollout of European Digital Identity Wallets (EUDI) by 2026. This is not just a technical upgrade; it is a fundamental restructuring of the digital trust market and creates a dangerous asymmetry for banks:

• Issuance (Article 6a): Member States must provide at least one wallet. They can build it themselves or designate private intermediaries (like banks or telcos). While banks are not statutorily forced to issue the wallet in all countries, they are under immense political pressure to do so to prevent the government from launching a competing “State App”.
• Acceptance (Article 6a/6b): Relying Parties (RPs) in sectors requiring Strong Customer Authentication (SCA)—which includes all banks—must accept the EUDI wallet. This means a bank must allow a user to log in to their online banking using a wallet issued by a competitor (e.g., a government agency or a rival bank). HOWEVER, local country bank regulators have yet to issue guidance here, and thus acceptance remains in existing KYC factors (ex customer sighting and wet signature in Italy). 

This “Acceptance Mandate” is the strategic threat to banking and banks abiltiy to control consumer authentication (and risk). How can banks be accountable for fraud or KYC/AML controls if they can’t manage the authentication? 

Who Pays for Identity?

The most glaring omission in eIDAS 2.0 is the economic model. The regulation states the wallet must be “free” for natural persons.

• Infrastructure Costs: The costs of issuing Qualified Electronic Attestations of Attributes (QEAAs), maintaining high-availability servers, and securing the keys are significant.
• The “Verifier Pays” Myth: The assumption is that Relying Parties (Verifiers) will pay for the privilege of checking an ID. However, if the government mandates acceptance, they may also cap the fees. Furthermore, for low-value transactions, the willingness to pay for high-assurance identity is low.
• The Trust Service Provider (TSP) Crisis: Companies like Signicat, Entrust, and others are building the “boxes” (issuance, revocation, preservation services) but are warning that without a sustainable revenue flow, the ecosystem will collapse. If the private sector cannot make a margin, the state will be forced to subsidize the entire stack, leading to the typical inefficiencies of public procurement IT.

Despite the goal of a “Single Digital Market,” eIDAS implementation is likely to be fragmented. With 27 Member States potentially launching 27 different wallet schemes (or certifying hundreds of private ones), the interoperability challenge is immense. Relying Parties will need middleware “bridges” to handle the diversity of technical endpoints and credential formats. This complexity favors global platforms (Apple/Google) that abstract this fragmentation away from the user and the developer.

Google/Apple’s Strategic Moat 

The European Commission’s antitrust case against Apple, resulting in the opening of the NFC chip for Host Card Emulation (HCE), was hailed as a victory for competition. However, a closer look at the implementation details reveals a masterclass in defensive platform strategy.

• The EC Commitments: Apple agreed to allow third-party developers access to NFC via HCE (Host Card Emulation), exactly how Google’s Android Operates. HCE runs in the main operating system software. While functionally capable of making a payment, it is theoretically less secure and consumes more battery than secure enclave managed credentials. Google has also invested in building the enclave equivalent (See Titan M2), with both apple and google moving to device bound identity credentials as the heart of their authentication strategies.
• Secure Element Access: Apple has created a path for “NFC & SE Platform” entitlements, allowing access to the SE. However, this comes with strict “commercial agreements” and “security reviews,” giving Apple continued gatekeeper power over who gets the “premium” hardware access.
• HCE becomes the common software app model, platform investment in enclave/Titan architecture remains proprietary.

Ex Apple’s Fees

Apple’s compliance with the Digital Markets Act (DMA) introduced a new fee structure that makes competing with Apple Pay economically punitive.

• Core Technology Fee (CTF): Developers opting into the new business terms (required for alternative distribution and some NFC entitlements) must pay €0.50 for every first annual install over one million.
• The Bank’s Calculation: For a major European bank with 5 million app users, moving their wallet to the new “open” framework could cost €2 million per year in CTF alone, just for the privilege of having the app installed.
• Entitlement Fees: Accessing the NFC and SE APIs requires specific entitlements that also carry associated fees and commercial agreements.
• Result: The cost of “independence” from Apple Pay often exceeds the cost of staying within Apple Pay and paying the issuer fees. Apple has priced the “open” door so high that few will walk through it.

The User Experience (UX) Moat

The most powerful weapon in Google and Apple’s arsenal is consumer behavior

• Apple is the #1 consumer brand for many reasons: Trust, intuitiveness, consistency, predictability, quality, ….etc.
• Example: The Double-Click: Double-clicking the side button on an iPhone instantly invokes the default wallet (usually Apple Wallet). This works from the lock screen, inside apps, or when the phone is asleep.
• The Competitor Experience: While Apple now allows users to set a third-party app as the “default contactless app,” the invocation gestures are often less fluid. In some HCE implementations, the app must be running or “field detect” must wake it up, which can be slower than the native SE response.
• Selecting an alternate wallet will be a nightmare with no benefit. Users accustomed to the double-click may find that their new bank wallet doesn’t respond the same way. Troubleshooting forums are already filled with users confused by the “AssistiveTouch” workarounds or settings changes required to make non-Apple Pay flows work smoothly.

Device Bound Identity

While the EU regulates the “Wallet” paradigm (a digital container for credentials), the tech industry is moving toward a post-wallet paradigm: Passkeys and Device Bound Credentials.

• The Passkey Revolution: Championed by the FIDO Alliance (Apple, Google, Microsoft), passkeys replace passwords with cryptographic key pairs stored on the device, unlocked by biometrics.26
• The Threat to eIDAS: If I can log in to my bank, my government tax portal, and my Amazon account using a Passkey stored in my iCloud Keychain (synced across all my Apple devices), why do I need an EUDI Wallet app?
• Identity at the Edge: Passkeys effectively decentralize identity to the device/platform level. The “Wallet” becomes invisible. The OS handles the authentication. eIDAS 2.0 envisions a world of “presenting credentials,” but the market is moving toward “implicit authentication”.40

 Consumer surveys indicate that consumers are experiencing “app overload.”

• Preference for Consolidation: Surveys indicate that 91% of users would consolidate to a single financial app if they could.42 They do not want a separate app for their ID, another for their credit card, and another for their loyalty points.
• The Super-Wallet: Apple and Google are building this Super-Wallet. It holds keys, IDs, money, and tickets.
• The Fragmented Alternative: The EU approach risks creating a fragmented ecosystem where a user needs a “Government Wallet” for taxes, a “Bank Wallet” for payments, and a “Retail Wallet” for loyalty. In a direct competition, the integrated platform wallet wins on convenience every time.

Wrap Up

The European attempt to “force open” US platforms is a case study in the limitations of legislative power. The EU can force Apple to open the NFC port, but it cannot force Apple to make it free, easy, or popular. It can mandate the creation of digital wallets, but it cannot mandate that consumers love them.

The failure of PSD2 and the struggling birth of eIDAS 2.0 demonstrate that Commercial Constructs are the true engines of the payment (and identity) ecosystem. The US platforms have mastered these constructs. Europe is still trying to build them with legislation. Until Europe bridges the gap between “technical compliance” and “commercial viability,” the digital sovereignty it seeks will remain an illusion, and the “Fortress” of the US platforms will remain unbreached.