1 Wallet Unit Attestation and Lifecycle Management (For European Business Wallet)

Status: Proposed
Date: 11 February 2026
Authors: WP4 Architecture

  • Lal Chandran, iGrant.io, Sweden
  • Sander Dijkhuis, Cleverbase, the Netherlands
  • George J Padayatti, iGrant.io, Sweden

1.1 Context

The European Business Wallet represents an economic operator or public sector body and operates within a cloud or on-premise environment under regulatory oversight derived from revised eIDAS and related Implementing Regulations.

Trust in a Business Wallet must be established at two distinct levels:

  1. Cybersecurity assurance in the wallet’s secure execution and key management environment.
  2. Organisational entity authentication assurance (cf. ISO/IEC 29115) represented by the European Business Wallet Owner ID (EBWOID).

At present, the WE BUILD architecture does not formally define:

  • A Wallet Unit Attestation (WUA) model for European Business Wallet.
  • A Wallet Instance Attestation (WIA) model and its relationship to the WUA.
  • A clear lifecycle model governing Wallet Unit states.
  • The downgrade and revocation semantics between structural and identity trust.

Without an explicit lifecycle and attestation model, revocation handling, issuance eligibility and cross-border interoperability remain ambiguous.

1.2 Decision

The European Business Wallet SHALL introduce:

  1. A mandatory Wallet Unit Attestation (WUA).
  2. A defined lifecycle model governing Wallet Unit state transitions.
  3. For this ADR, WIA is not considered for the first iteration of WE BUILD at least.

1.2.1 Wallet Unit Attestation (WUA)

A Wallet Unit Attestation is a signed object issued by the Wallet Provider that:

  • Binds the Wallet Unit to a secure cryptographic environment.
  • Contains public keys used for credential binding.
  • Includes validity and revocation information.
  • Is presented to Issuers and Attestation Providers.
  • Is presented to Relying Parties when required to determine Wallet Unit validity, for example via selective disclosure mechanisms.

A valid WUA is required for a Wallet Unit to operate within the EBW ecosystem.

1.2.2 Wallet Unit Lifecycle Model

The Wallet Unit SHALL follow the lifecycle states defined below:

UNINSTALLED

No wallet instantiated. No cryptographic material. No WUA. No EBWOID.

INSTALLED

Wallet software deployed and environment prepared, but no WUA issued.

OPERATIONAL

Valid WUA present. Structural trust established. EBWOID not yet acquired or pending.

VALID

Valid WUA and valid EBWOID present. Fully functional for regulated and cross-border use.

1.2.3 State Transitions

  • UNINSTALLED → INSTALLED
    Organisation instantiates the software.

  • INSTALLED → OPERATIONAL
    Wallet Unit acquires the WUA.

  • OPERATIONAL → VALID
    A natural person requests and obtains the EBWOID on behalf of the Economic Operator, which is then bound to the Wallet Unit.

  • VALID → OPERATIONAL
    EBWOID revoked or expired.

  • OPERATIONAL or VALID → INSTALLED
    WUA revoked or expired.

  • INSTALLED → UNINSTALLED Uninstallation or decommissioning of a WU, for e.g. during porting from one service provider to other.

Structural trust (WUA) is foundational. Identity trust (EBWOID) depends upon it. A Wallet Unit cannot be VALID without a valid WUA.

1.3 Consequences

  • Cybersecurity assurance and Organisational entity authentication assurance are explicitly separated.
  • Revocation of WUA immediately suspends infrastructural legitimacy.
  • Revocation of EBWOID suspends identity validity while preserving structural trust. Where EBWOID is short-lived, the dependency between WUA revocation and EBWOID validity must be further specified in the implementing acts to ensure Relying Parties are not exposed to invalid Wallet Units.
  • Issuers gain a clear rule for issuance eligibility.
  • Lifecycle handling becomes testable within ITB and conformance specifications.
  • Cross-border interoperability is strengthened through explicit state semantics.
  • Wallet Providers are expected to implement this which will be elaborated on further, for.g. via a conformance specification.

This ADR establishes WUA and lifecycle management as mandatory architectural functions of the European Business Wallet. It does not yet establish lifecycle management for entry in the WE BUILD Digital Directory, to simulate the European Digital Directory. This is another layer, which governs the availability of the wallet owner for notifications and submission of documents.

1.4 Advice

Once merged, this is our consortium’s decision. This does not mean all participants agree it is the best possible decision. In the decision making process, we have heard the following advice.

1.5 Advice

Once merged, this is our consortium’s decision. This does not mean all participants agree it is the best possible decision. In the decision making process, we have heard the following advice.

2026-02-11, Sander Dijkhuis, Cleverbase, Netherlands 2026-02-11, George Padayatti, iGrant.io, Sweden 2026-02-12, George Fourtounis, GRNET, Greece 2026-02-12, Malin Norlander, Bolagsverket, Sweden