eIDAS – Top 3 Problems

Europe is twelve months away from a legal deadline for a wallet no one has asked for. Governments are required to issue digital IDs, banks are not required and will likely hold off given the success of Norway’s Bank ID model (commercial terms there). Under Regulation (EU) 2024/1183, commonly called eIDAS 2.0, every Member State must offer at least one certified European Digital Identity (EUDI) Wallet to all citizens and residents by December 2026. The Commission’s stated ambition is that 80% of European citizens use a digital identity solution by 2030.

The wallet is a container. It holds Person Identification Data (PID), the citizen’s legally recognized core identity issued under national authority. It holds Qualified Electronic Attestations of Attributes (QEAAs), which are verified claims such as a driving license, a professional qualification or a bank account identifier. It also supports Qualified Electronic Signatures (QES), which carry the legal weight of a handwritten signature in all 27 Member States. For payments, the relevant consequence is that a certified wallet credential satisfies Strong Customer Authentication, so a bank cannot arbitrarily reject a wallet based authentication event in a payment flow.

Continue reading →

Stripe Agentic Commerce Protocol (ACP)

The best, and perhaps only, operable protocol that can solve agent payment issues today.

Stripe’s Agentic Commerce Protocol (ACP), co-developed with OpenAI, is a functional leap forward in enabling agentic commerce. While its open-source nature invites broad adoption, Stripe is uniquely able to “make it work” by leveraging its existing fraud-fighting assets. Another less reported benefit of ACP is payment rail agnostic operation. ACP will work for paybybank, PIX, EFTPOS, Swish, Bizum or anything else. Anywhere that Stipe’s device graph and Radar (Risk/Fraud) are effective. Stripe’s secure payment token plus risk signals allow merchants to operate the way they do today (no operational change).

ACP may only have a limited 2-3 yr runway as more advanced authentication methods become mainstream, and network rule sets/services advance to serve all agent providers (leveling the playing field).

Continue reading →

Wallets and Privacy

I’m on a brief vacation celebrating my 28th anniversary and deep in thought (pic below). What am I thinking of here on the beach? Wallets, Networks, Trust and Privacy.

The Case for Separating Wallets from Identity Providers

As digital identities continue to evolve, one of the most important debates centers around who controls and operates the wallet that holds these identities. Specifically, should wallets be separated from authorities that legally issue “identity”—commonly known as Identity Providers (IdPs)? This issue is particularly relevant in countries like India and Europe, where digital identity initiatives have made significant strides, yet their approaches raise important questions about privacy and control.

Continue reading →