Which certifications should an identity verification provider hold in the EU? | Trust Infrastructure Explained

Key takeaways

• ETSI TS 119 461 V2.1.1 becomes the reference standard for identity proofing when qualified certificates and qualified electronic attestations of attributes are issued, under Implementing Regulation (EU) 2025/1566, applicable from 19 August 2027.
• The OpenID Foundation opened OpenID4VP and OpenID4VCI conformance tests for self-certification in August 2026, so wallet verifiers can now publish test results against a shared profile.
• DORA and NIS2 set obligations for entities within their respective scopes. Neither provides a statutory compliance certificate.
• An orchestration platform routes users to identity methods operated by other providers. For each method, the relevant certificate covers a defined service and provider.
• In the UK, the digital verification services (DVS) trust framework 1.0 replaces the earlier gamma (0.4) version, with a public register of certified services under the Data (Use and Access) Act 2025.

Which certifications matter when you choose an identity verification provider?

Evidence for identity verification providers falls into 3 levels. The first covers the organisation: how it secures data, keeps services running and manages quality. The second covers each identity method: whether document checks, biometrics, eIDs and wallet presentations meet a recognised standard. The third covers legal status: whether a public register lists the provider as a trust service provider.

The 3 generations of identity need different evidence. Document and biometric checks are assessed against identity proofing and presentation attack standards. Notified eIDs are assessed by the Member State that notifies them under eIDAS. EUDI Wallet presentations are assessed through protocol conformance testing and, for the wallets themselves, certification under EU implementing rules. The Digital Identity Glossary defines the eIDAS terms used in this guide.

What is ETSI TS 119 461 and who needs it?

ETSI TS 119 461 is a European technical specification that sets policy and security requirements for identity proofing of the people and organisations that receive trust services.

Implementing Regulation (EU) 2025/1566 names ETSI TS 119 461 V2.1.1 (2025-02), with the regulation’s adaptations, as the reference standard for verifying identity when a qualified trust service provider issues a qualified certificate or a qualified electronic attestation of attributes. The regulation applies from 19 August 2027, which gives qualified providers 24 months from entry into force to align their identity proofing.

ETSI TS 119 461 applies to the party that performs identity proofing. A qualified trust service provider can proof identity itself or rely on an identity proofing service provider, and in both cases the proofing process is what gets assessed. Implementing Regulation (EU) 2025/1566 requires certification by an accredited conformity assessment body for specified identification methods.

Version 2.1.1 of ETSI TS 119 461 includes requirements against modern fraud, including the detection of injection attacks that feed synthetic or pre-recorded video into the capture process.

ETSI TS 119 461 is a requirement for these qualified services. A provider that issues non-qualified attestations, or a business that verifies its own customers for AML purposes, can use the standard as a benchmark, but Implementing Regulation (EU) 2025/1566 does not oblige them to.

Does ETSI TS 119 461 apply to identity orchestration platforms?

An identity orchestration platform routes each user to a verification method that another provider operates. The document check, the face match and the liveness test may run on that provider’s infrastructure, but ETSI TS 119 461 certification scope depends on each party’s role in identity proofing. The right question for an orchestration platform is which providers behind each method hold the certification, and for which use case.

Authologic does not itself perform identity proofing within the meaning of ETSI TS 119 461 and Implementing Regulation (EU) 2025/1566. For each document and biometric method on the Authologic platform, the ETSI TS 119 461 question therefore concerns the provider behind that method.

Do eIDs and bank IDs need certification?

Notified eIDs follow a different route from document checks. A Member State notifies its eID scheme to the European Commission under Article 9 of eIDAS, stating its assurance level (low, substantial or high) under Article 8. Other Member States review the scheme before notification, and the Commission publishes the list of notified schemes.

Notification gives an eID scheme cross-border legal weight. Under Article 6 of eIDAS, public online services in other Member States requiring substantial or high assurance must recognise notified eIDs at or above the required level. ETSI TS 119 461 does not replace eID notification, but it can cover the use of notified eIDs as evidence in identity proofing.

Bank IDs vary by country. Some are notified under eIDAS, while others operate under national rules or banking-sector frameworks without notification. When a provider offers a bank ID, ask whether that bank ID is notified and at which assurance level, because the answer affects how you can use it for customer due diligence.

The assurance level of each eID matters more than any provider certificate, because it shows how rigorously the method checked that the user is who they claim to be. The glossary entry on assurance levels explains what low, substantial and high mean in practice. Authologic’s integrations page shows an assurance level for each method by country. For notified and non-notified eIDs, the level shown is the eIDAS assurance level of the scheme. For methods outside eIDAS, the level is Authologic’s own indicative mapping to the same scale, not an eIDAS assurance level.

How do you check that an EUDI Wallet verifier works?

EUDI Wallets and the services that verify them are assessed in different ways. The wallets themselves must be certified under Implementing Regulation (EU) 2024/2981 before Member States provide them. Relying parties that verify wallet presentations register with a national registrar under Implementing Regulation (EU) 2025/848, which applies from 24 December 2026. Registration is an administrative step, and it does not certify the relying party’s software.

Protocol conformance testing fills the gap for verifier software. In August 2026 the OpenID Foundation opened conformance tests for OpenID for Verifiable Presentations (OpenID4VP) and OpenID for Verifiable Credential Issuance (OpenID4VCI) for self-certification. Wallets and verifiers can test against the High Assurance Interoperability Profile (HAIP) 1.0, and implementers who pass can publish their results.

Conformance tests for wallet verifiers check 2 things: whether the verifier communicates correctly over OpenID4VP, and whether it reads credential formats such as SD-JWT VC and ISO/IEC 18013-5 mobile documents.

The EU’s own conformance work is still developing. Version 3.0 of the Architecture and Reference Framework, released in July 2026, introduced a Functional Conformance Assessment Framework with shared test cases for wallets. Its test suites are still being built, and the framework treats conformance testing as a step before certification.

Authologic tests its wallet verification service at EU-level interoperability events and in conformance testing.

The EUDI Wallet Readiness Checklist covers the other steps a relying party needs before 24 December 2027, when the obligation to accept wallets begins for private relying parties covered by Article 5f(2) of eIDAS.

What does trust service provider status prove?

Trust service providers offer services such as electronic signatures, seals, time stamps and electronic attestations of attributes under the eIDAS Regulation, and they are either qualified or non-qualified. A qualified provider has passed a conformity assessment, received qualified status from its national supervisory body and appears on the national trusted list. A non-qualified provider offers the same type of service without qualified status, and its outputs carry legal effect without the presumptions and equivalences the eIDAS Regulation attaches to qualified services.

Related: qualified and non-qualified trust services | electronic attestations of attributes

A trust service register entry confirms the provider’s registration for a specific service. The entry does not cover the provider’s other activities. A provider registered to issue electronic attestations of attributes (EAA) is not by that fact a qualified provider of signatures or certified for identity proofing. Check the service type in the register entry before you rely on it.

Authologic is registered with Narodowy Bank Polski as a non-qualified trust service provider issuing electronic attestations of attributes, as announced on 2 September 2026.

Is there a certification for relying party intermediaries?

A relying party intermediary connects businesses to EUDI Wallets on their behalf and must register under Implementing Regulation (EU) 2025/848. As of October 2026, ETSI has not published policy requirements specific to intermediaries. The explainer on relying party intermediaries describes the role and its obligations.

Which security certifications should a provider hold?

ISO/IEC 27001 is the baseline security certification for an identity verification provider in Europe. ISO/IEC 27001 certifies an information security management system for a defined scope, and the scope matters as much as the certificate. A certificate that covers only an office, or only one product, says little about the platform that processes your customers’ data.

ISO/IEC 27017 and ISO/IEC 27018 add controls for cloud services and for personal data in public clouds. Providers often align their ISO/IEC 27001 scope with both. ISO/IEC 27701:2025 sets requirements for a standalone privacy information management system.

ISO 22301 certifies a business continuity management system, which supports the resilience questions that DORA asks financial entities to put to their ICT suppliers. ISO 9001 certifies a quality management system and shows that the provider runs documented, audited processes.

SOC 2 Type II is an attestation report under AICPA criteria, common in the United States. A SOC 2 Type II report shows how controls operated over an audit period. SOC 2 and ISO/IEC 27001 overlap substantially.

When you review any certificate, ask for 4 documents: the certificate itself, the scope statement, the Statement of Applicability for ISO/IEC 27001 and the date of the last surveillance or recertification audit.

Are DORA and NIS2 certifications?

Neither DORA nor NIS2 establishes a statutory compliance certificate. A provider that describes itself as “DORA certified” or “NIS2 certified” is describing a private assessment.

The Digital Operational Resilience Act (Regulation (EU) 2022/2554) applies to financial entities from 17 January 2025. Under Article 28, the financial entity stays fully responsible for risks from its ICT third-party providers and keeps a register of information on all ICT service contracts. Article 30 lists the clauses those contracts must contain, with additional requirements where the service supports critical or important functions. An identity verification provider supports DORA compliance by accepting those clauses and supplying evidence, and the financial entity decides whether the service supports a critical or important function.

The NIS2 Directive (Directive (EU) 2022/2555) covers trust service providers regardless of their size, under Article 2(2)(a)(ii). Qualified trust service providers are essential entities under Article 3(1)(b). Non-qualified trust service providers are essential entities if they exceed the medium-sized enterprise thresholds, and generally important entities otherwise. NIS2 applies through national law, so obligations and deadlines differ by Member State.

Article 21 of NIS2 requires covered entities to manage cybersecurity risks, including supply chain security. Ask whether the provider falls under NIS2 itself, in which Member State and as which type of entity, because that tells you which national authority supervises it.

The CASP briefing on authentication and KYC rules explains how DORA works alongside MiCA and, where applicable, PSD2 for crypto-asset service providers.

How is biometric spoof resistance tested?

ISO/IEC 30107-3 is the international standard for testing presentation attack detection: whether a liveness check stops printed photos, screen replays and masks. Accredited laboratories, such as iBeta in the United States, test biometric engines against ISO/IEC 30107-3 at defined levels of attack sophistication and issue a report for the tested engine and version.

ISO/IEC 30107-3 does not cover injection attacks, where an attacker bypasses the camera and feeds synthetic or pre-recorded video directly into the capture process. CEN/TS 18099, published in 2024, sets out how to detect and evaluate injection attacks. Ask for evidence against both, because deepfakes can arrive through injection.

A test report covers the engine and version that the lab tested. Ask which engine runs in production and whether the report matches it. The analysis of what stops AI-generated identity fraud explains why cryptographic proof from eIDs and wallets can reduce reliance on liveness detection.

What applies when you onboard UK customers?

The UK digital verification services (DVS) trust framework 1.0 sets the rules for certified identity and attribute services in the UK. The framework rests on the Data (Use and Access) Act 2025, was pre-released on 3 March 2026 and took effect on 2 September 2026.

The DVS trust framework defines 5 roles: identity service provider, attribute service provider, holder service provider, orchestration service provider and component service provider. A component service provider cannot hold any other role for the same service at the same time and must be certified separately.

Certified services can join a public register kept under section 32 of the Data (Use and Access) Act 2025 and, with version 1.0 certification, registration and a licence, use the UK CertifID trust mark. Services certified under the earlier gamma (0.4) version have at least 15 months to move to version 1.0, depending on their certification cycle.

How does Authologic evidence its own status?

Authologic is a trust infrastructure platform that orchestrates legacy identity verification, national eIDs and bank IDs, and EUDI Wallet credentials through one integration. For each verification, the platform records which method performed the check.

Authologic holds ISO/IEC 27001, ISO 9001 and ISO 22301 certifications, and its ISO/IEC 27001 scope is aligned with ISO/IEC 27017 and ISO/IEC 27018. The biometric engines available on the platform have iBeta test reports against ISO/IEC 30107-3 at Level 2, and one engine has reached Level 3. Certificates, scope statements, Statements of Applicability and test reports are available on request after a non-disclosure agreement (NDA) is signed.

Authologic sends customers the documents they need by email, usually on request. When new regulations or supervisory recommendations require specific standards, Authologic also shares the relevant information proactively, so that customers are ready for audits.

What do buyers ask an identity verification provider during due diligence?

The topic attracting the most interest in recent due diligence is how the use of personal data to train AI algorithms is regulated. Standards do not yet fully cover this area, and identity verification providers will need to keep addressing it as the rules develop.

Customers assessing an identity verification provider tend to work on the principle that more evidence is better. They ask both about the provider’s own certifications and about the certifications held by the providers behind each method. Authologic regularly sends customers its ISO 9001, ISO/IEC 27001 and ISO 22301 certificates, signs annexes addressing DORA requirements with financial-sector customers, and provides its providers’ statements on the standards they meet. Provider statements matter most for verification methods that include biometrics.

Betting operators need a documented methodology for AML verification more than they need certificates, together with evidence of continuous quality improvement. Maintaining certifications and passing audits is that evidence.

Fintechs often need assurance that the verification provider understands their business and holds the right certifications. They are looking for a partner they can trust.

Customers often mix up data capture methodology, ISO standards, legal requirements and supervisory recommendations, for example those of the Polish Financial Supervision Authority (KNF). The confusion is understandable: a customer wants assurance that the solution is secure, will not expose them to a data breach and will let them pass an audit. Authologic does not provide legal advice, but it helps customers keep their own obligations as data controllers in view alongside the evidence they collect about their provider: securing the data and informing users what is processed and how.

When customers assess a provider, the standards it meets today matter, but so does its overall approach to audits and its readiness to go through them.

What should you ask a provider before you sign?

These 7 recommended questions turn a list of logos into evidence you can rely on:

1. Which legal entity holds each certificate, and does its scope cover the service you will use?
2. For each identity method, who performs the check: the provider itself or a provider behind it?
3. Which certifications does each method hold, including local certifications expected in specific countries, such as Germany or Switzerland?
4. Which methods carry ETSI TS 119 461 certification, and for which use case?
5. Which methods are government eIDs, what assurance level does each reach, and is the scheme notified under eIDAS?
6. Once you accept EUDI Wallets: which conformance tests has the wallet verifier passed, and where are the results published?
7. Which DORA contractual clauses will the provider accept, and is it covered by NIS2?

FAQ

Which identity platforms are certified under the eIDAS trust framework?

No single eIDAS certificate covers a whole identity platform. Qualified trust service providers appear on national trusted lists, identity proofing services can be certified against ETSI TS 119 461, and eID schemes are notified by Member States. Check each method and service on a platform against the relevant register or certificate.

Is ETSI TS 119 461 mandatory?

ETSI TS 119 461 V2.1.1, with the regulation’s adaptations, is mandatory for identity proofing when qualified certificates and qualified electronic attestations of attributes are issued, under Implementing Regulation (EU) 2025/1566 from 19 August 2027. For other uses, including AML customer due diligence, ETSI TS 119 461 serves as a benchmark without an obligation under that regulation.

Is SOC 2 required in the EU?

There is no general EU requirement for SOC 2. SOC 2 is a US attestation framework. Some international buyers request both SOC 2 and ISO/IEC 27001, particularly where a US parent company runs vendor risk assessments. A SOC 2 Type II report and an ISO/IEC 27001 certificate cover overlapping controls with different audit methods.

Does a non-qualified trust service provider need ETSI TS 119 461?

A non-qualified trust service provider has no obligation under Implementing Regulation (EU) 2025/1566 to follow ETSI TS 119 461 for its non-qualified services, because the regulation covers qualified certificates and qualified electronic attestations of attributes. A non-qualified provider can still choose to certify against ETSI TS 119 461.

What is the difference between OpenID certification and self-certification?

In OpenID self-certification, the implementer runs the OpenID Foundation’s free conformance tests, publishes the results and submits a signed declaration. After approval, the OpenID Foundation lists the results and allows use of the OpenID Certified mark for a fee. The tests depend on the profile and role, and the published results let anyone check which profile and role an implementation passed.

Can a provider be “DORA certified”?

No statutory compliance certificate exists under DORA. The Digital Operational Resilience Act places obligations on financial entities, which assess their ICT third-party providers and include the contract clauses listed in Article 30. A provider can support that assessment with evidence such as ISO/IEC 27001 and ISO 22301 certificates and by accepting the required clauses.

How do I check a provider’s trust service status?

Look the provider up in the trusted list or, where available, the trust service register of the Member State where it is supervised. The European Commission publishes links to all national trusted lists. The entry states the service type, for example electronic attestations of attributes, and whether the service is qualified.

Sources

• Commission Implementing Regulation (EU) 2025/1566 - reference standards for identity verification for qualified certificates and qualified electronic attestations of attributes
• ETSI TS 119 461 V2.1.1 (2025-02)
• Commission Implementing Regulation (EU) 2024/2981 - certification of European Digital Identity Wallets
• OpenID Foundation: OpenID4VP and OpenID4VCI conformance tests open for self-certification
• UK digital verification services trust framework 1.0
• GOV.UK: Commencing transition from 0.4 to 1.0 (3 September 2026)
• Regulation (EU) 2022/2554 (DORA) and Directive (EU) 2022/2555 (NIS2)
• CEN/TS 18099:2024 Biometric data injection attack detection