Source: EURLEX
Language: en
Format: md

COMMISSION IMPLEMENTING REGULATION (EU) …/...

of XXX

laying down rules for the application of Regulation (EU) No 910/2014 of the European Parliament and of the Council as regards the registration of wallet-relying parties and the common mechanism for the identification and authentication of wallet-relying parties

THE EUROPEAN COMMISSION

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 910/2014
[1](#footnote2)
 of the European Parliament and of the Council on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC
[2](#footnote3)
, in particular Article 5b(11) thereof,

Whereas:

(1)For the purposes of registering relying parties that intend to rely upon European Digital Identity Wallets (‘wallets’) for the provision of public or private services by means of digital interaction, as required under Article 5b of Regulation (EU) No 910/2014, Member States should establish and maintain registers of registered wallet-relying parties established in their territory.

(2)Regulation (EU) 2016/679 of the European Parliament and of the Council
[3](#footnote4)
 and, where relevant, Directive 2002/58/EC of the European Parliament and of the Council
[4](#footnote5)
 apply to the personal data processing activities under this Regulation.

(3)The Commission regularly assesses new technologies, practices, standards or technical specifications. To ensure the highest level of harmonisation among Member States for the development and certification of the wallets, the technical specifications set out in this Regulation rely on the work carried out on the basis of Commission Recommendation (EU) 2021/946 of 3 June 2021 on a common Union Toolbox for a coordinated approach towards a European Digital Identity Framework
[5](#footnote6)
 and in particular the architecture and reference framework which is part of it. In accordance with recital 75 of Regulation 2024/1183
[6](#footnote7)
, the Commission should review and update this Implementing Regulation, if necessary, to keep it in line with global developments, the architecture and reference framework and to follow the best practices on the internal market. 

(4)The registration of wallet-relying parties aims at enhancing transparency and trust in the use of the wallets. In order to facilitate the consultation of the information on registered wallet-relying parties across the Union, Member States should make this information available to the public in a manner that is both human and machine-readable.

(5)As the registers are to provide interfaces to the wallets, it is necessary that the information in the registers can be processed by all wallets provided in the Union. Therefore, Member States should set up interfaces that meet the technical specifications set out in this Regulation.

(6)As registration policies are a useful tool for providing clear guidance to the wallet-relying parties on the registration process, Member States should set out and publish the registration policies applicable to registers set up in their territory.

(7)As set out in Article 5b of Regulation (EU) No 910/2014, another objective of the relying party registration is to facilitate the verification by Member States of the lawfulness of the activities of the wallet-relying parties. Therefore, wallet-relying parties should provide, for inclusion in the registers the necessary information, including their entitlement(s).

(8)In order to ensure that the registration process is cost-effective and proportionate-to risk, and to strike an appropriate balance between meeting a high level of transparency and safety on the one hand and ensuring uptake by service providers on the other hand, registrars should set up online and, where applicable, automated registration processes for wallet-relying parties that are easy to use and they should verify applications for registration without undue delay.

(9)For the purposes of ensuring security and continuity of the registers, Member State should keep records of all the information provided by wallet-relying parties established in that Member State for at least ten years.

(10)Member States are to ensure that the wallets are able to authenticate wallet-relying parties, irrespective of where they are established in the Union. To achieve this, wallet-relying parties should use wallet-relying party access certificates when they identify themselves to wallet units. To guarantee interoperability of those certificates across all wallets provided within the Union, wallet-relying parties access certificates should adhere to common requirements set-out in the Annex to this Regulation. The Commission, in collaboration with Member States, should closely monitor the development of new or alternative standards on which relying-party access certificates could be implemented. In particular, trust models that have proven their efficacy and security in Member States should be assessed.

(11)As set out in Regulation (EU) No 910/2014, wallet-relying parties are not to request users to provide any data other than those indicated for the intended use of wallets during the registration process. Wallet users should be enabled to verify the registration data of wallet-relying parties. To enable wallet users to verify that the attributes being requested by the wallet-relying party are within the scope of their registered attributes, Member States may require the issuance of wallet-relying party registration certificates to registered wallet-relying parties. To ensure the interoperability of the wallet-relying party registration certificates, Member States should ensure that those certificates meet the requirements and standards set out in the Annex of this Implementing Regulation.

(12)In order to protect wallet users from any potentially unlawful requests, registrars should be able to suspend or cancel the registration of any wallet-relying party without prior notice where the registrars have reason to believe that the registration contains information which is not accurate, not up to date or misleading, the wallet-relying party is not compliant with the registration policy or the wallet-relying party is otherwise acting in breach of Union or national law in a way that relates to their role as a wallet-relying party. In order to safeguard the stability of the wallet ecosystem, the decision to suspend or cancel a registration should be proportionate to the service disruption caused by the suspension or cancelation and the associated cost and inconvenience for the service provider and the user. For the same reason, supervisory bodies are to be enabled to suspend and cancel the registration required pursuant to Article 46a(4), point (f) of Regulation (EU) No 910/2014.

(13)The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725
[7](#footnote8)
 and delivered its opinion on [XX.XXX 2024]. 

(14)The measures provided for in this Regulation are in accordance with the opinion of the committee referred to in Article 48 of Regulation (EU) No 910/2014,

HAS ADOPTED THIS REGULATION:

Article 1

Subject matter and scope

This Regulation lays down rules for the registration of wallet-relying parties, to be updated on a regular basis to keep in line with technology and standards developments and with the work carried out on the basis of Commission Recommendation (EU) 2021/946, and in particular the Architecture and Reference Framework.

Article 2

Definitions

For the purposes of this Regulation, the following definitions apply:

(1)‘wallet-relying party’ means a relying party that intends to rely upon wallet units for the provision of public or private services by means of digital interaction;

(2)‘wallet unit’ means a unique configuration of a wallet solution that includes wallet instances, wallet secure cryptographic applications and wallet secure cryptographic devices provided by a wallet provider to an individual wallet user; 

(3)‘wallet solution’ means a combination of software, hardware, services, settings, and configurations, including wallet instances, one or more wallet secure cryptographic applications and one or more wallet secure cryptographic devices;

(4)‘wallet instance’ means the application installed and configured on a wallet user’s device or environment, which is part of a wallet unit, and that the wallet user uses to interact with the wallet unit; 

(5)‘wallet secure cryptographic application’ means an application that manages critical assets by being linked to and using the cryptographic and non-cryptographic functions provided by the wallet secure cryptographic device;

(6)‘wallet secure cryptographic device’ means a tamper-resistant device that provides an environment that is linked to and used by the wallet secure cryptographic application to protect critical assets and provide cryptographic functions for the secure execution of critical operations;

(7)'critical assets' means assets within or in relation to a wallet unit of such extraordinary importance that where their availability, confidentiality or integrity are compromised, this would have a very serious, debilitating effect on the ability to rely on the wallet unit;

(8)‘wallet provider’ means a natural or legal person who provides wallet solutions;

(9)‘wallet user’ means a user who is in control of the wallet unit;

(10)‘register of wallet-relying parties’ means an electronic register used by a Member State to make information on wallet-relying parties registered in that Member State publicly available as set out in Article 5b(5) of Regulation (EU) No 910/2014;

(11)‘provider of wallet-relying party access certificates’ means a natural or legal person mandated by a Member State to issue wallet-relying party access certificates to wallet-relying parties registered in that Member State; 

(12)‘wallet-relying party access certificate’ means a certificate for electronic seals or signatures authenticating and validating the wallet-relying party issued by a provider of wallet-relying party access certificates;

(13)'provider of person identification data’ means a natural or legal person responsible for issuing and revoking the person identification data and ensuring that the person identification data of a user is cryptographically bound to a wallet unit;

(14)‘registrar of wallet-relying parties’ means a body responsible for establishing and maintaining a list of registered wallet-relying parties established in their territory who has been designated by a Member State;

(15)‘wallet-relying party registration certificate’ means a data object that indicates the attributes the relying party has registered to intend to request from users;

(16)‘provider of wallet-relying party registration certificates’ means a natural or legal person mandated by a Member State to issue wallet-relying party registration certificates to wallet-relying parties registered in that Member State.

Article 3

National registers

1.Member States shall establish and maintain at least one national register with information about registered wallet-relying parties. Where more than one national register is established, a wallet-relying party shall be included in one register only.

2.Member States shall make the information set out in Annex I on registered wallet-relying parties from all national registers publicly available online, both in human readable form and in a form suitable for automated processing.

3.The information shall be available through a single national application programming interface (‘API’) and through a national website. It shall be electronically signed or sealed by or on behalf of the registrar, in accordance with the requirements set out in Section 1 of Annex II.

4.Member States shall ensure that the API referred to in paragraph 2 complies with the technical specifications set out in Section 2 of Annex II. Member States shall ensure that the registers comply with the registration policy set out in Article 4.

Article 4

Registration policies

1.Member States shall lay down and publish one or more national registration policies applicable to national registers.

2.The registration policy shall cover at least the following points:

(a)the identification and authentication procedures applicable to wallet-relying parties during the registration process; 

(b)the supporting documentation to be provided by the wallet-relying party to establish their identity, business registration, any applicable entitlement(s), and other relevant information that is required under the registration policy;

(c)where applicable, the description of the authentic sources or other official electronic records in the Member State where the register is set up, that can be relied upon to provide accurate data, information or other evidence required as part of the registration process;

(d)where applicable, the automated means supported to enable wallet-relying parties to register or to update an existing registration;

(e)the means of redress available to wallet-relying parties under the law of the Member State where the register is set up;

(f)the rules and procedures for the verification of the identity of the registered wallet-relying party and of any other relevant information provided by that party.

3.The procedures referred to in paragraph 1, point 
[(a)](#_Ref178941191)
 and (b) shall enable a wallet-relying party to indicate whether it is acting under a specific entitlement(s) as set out in Annex I.

4.The requirements set out in the registration policy shall not impede an automated registration process.

Article 5

Information to be provided to the national registers

A wallet-relying party shall provide to the relevant register of the Member State where it is established at least the information set out in Annex I. The wallet-relying party shall ensure that all information provided is accurate at the time of registration and when the information is updated.

Article 6

The registration process

1.Registrars shall set up online, and where applicable, automated registration processes for wallet-relying parties that are easy to use.

2.Registrars shall verify applications for registration without undue delay. They shall provide a response to the applicant within five working days, using appropriate means and in accordance with the laws and procedures of the Member State where the register is set up.

3.Registrars shall verify, where applicable, in an automated manner:

(a)the accuracy and validity of the information required under Article 5;

(b)where applicable, the power of attorney of a representative of the wallet-relying party in accordance with the laws and procedures of the Member State where the register is set up;

(c)the type of entitlement(s) of the wallet-relying party as set out in Annex I.

4.The verification of the information referred to in paragraph 3 shall include an authenticity and validity assessment of the provided information against the supporting documentation provided by the wallet-relying parties and against any authentic sources or other official electronic records in the Member State where the register is set up and to which the registrars have access in accordance with national law. The verification of entitlements of wallet-relying parties shall be carried out in accordance with Annex III.

5.When a wallet-relying party no longer intends to rely upon wallet units for the provision of public or private services under a specific registration, it shall notify the relevant registrar without undue delay and request the cancellation of that registration.

Article 7

Wallet-relying party access certificates

1.Member States shall ensure that providers of wallet-relying party access certificates issue wallet-relying party access certificates to wallet-relying parties registered in accordance with the requirements set out in Article 4 to Article 6 of this Regulation.

2.Member States shall set up dedicated certificate policies and certificate practice statements in accordance with the requirements set out in Annex IV. Member States shall ensure that wallet-relying party access certificates meet the requirements set out in Annex IV.

Article 8

Wallet-relying party registration certificates

1.Member States may require providers of wallet-relying party registration certificates to issue wallet-relying party registration certificates to wallet-relying parties registered in accordance with the requirements set out in Article 4 to Article 6 of this Regulation.

2.Where Member States require the provision of wallet-relying party registration certificates, Member States shall ensure that these certificates meet the requirements set out in Annex V.

Article 9

Suspension and cancellation

1.Registrars may suspend or cancel a registration of a wallet-relying party where such a suspension or cancellation is requested by a supervisory body pursuant to Article 46a(4), point (f) of Regulation (EU) No 910/2014 or where the registrars have reasons to believe that:

(a)the registration contains information which is not accurate, not up to date or misleading;

(b)the wallet-relying party is not compliant with the registration policy;

(c)the wallet-relying party is requesting more attributes than what they have registered in accordance with Article 5 and Article 6 of this Regulation;

(d)the wallet-relying party is otherwise acting in breach of Union or law of that Member State in a way that relates to their role as a wallet-relying party;

2.When considering the suspension or cancellation, the registrar shall conduct a proportionality assessment, taking into account the severity of the disruption caused by the suspension or cancellation and the associated costs, both for the wallet-relying party and the user. Based on the result of this assessment, the registrar may suspend or cancel the registration with or without prior notice to the relying party concerned.

3. In case of suspension or cancellation of the registration of a wallet-relying party, the registrar shall inform the provider of the relevant wallet-relying party access certificate, the provider of the relevant wallet-relying party registration certificates where applicable, and the concerned wallet-relying party of this action without undue delay and not later than 24 hours after the suspension or cancellation. This notification shall also include information on reason for the suspension and on the available means of redress or appeal. The provider of wallet-relying party access certificates, and, where applicable, the provider of wallet-relying registration certificates, shall suspend or revoke the wallet-relying party access certificate, and wallet-relying party registration certificates respectively, of the wallet-relying party for which the registration has been suspended or cancelled.

Article 10

Record keeping

Registrars shall record the information provided for the registration of a wallet-relying party, and of any subsequent updates for as long as necessary in accordance with Union and national law.

Article 11

Entry into force

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

It shall apply from [date to be inserted by the OP – 12 months after publication].

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels,

For the Commission

   The President

   Ursula VON DER LEYEN

[Top](#document1)

ANNEX I

Information regarding wallet-relying parties

1.The name of the wallet-relying party as stated in an official record together with identification data of that official record.

2.Where applicable, one or more identifiers of the wallet-relying party, as stated in an official record together with identification data of that official record, expressed as:

(a)an Economic Operators Registration and Identification (EORI) number as referred to in Commission Implementing Regulation (EU) No 1352/2013
[1](#footnote2)
;

(b)the registration number as registered in a national business register;

(c)a Legal Entity Identifier (LEI) as referred to in Commission Implementing Regulation (EU) No 2022/1860
[2](#footnote3)
;

(d)a VAT registration number;

(e)an excise number as specified in Article 2(12) of Council Regulation (EC) No 389/2012
[3](#footnote4)
;

(f)a tax reference number;

(g)a European Unique Identifier (EUID) as referred to in Commission Implementing Regulation (EU) 2020/2244
[4](#footnote5)
.

3.The physical address where the wallet-relying party is registered.

4.For the indication of the Member State in which the registering wallet-relying party is established, the ISO 3166-1 Alpha 2 codes shall be used, with the following exception: the Country Code for Greece shall be ‘EL’.

5.Detailed contact information of the wallet-relying party, one or more, including:

(a)a website for providing helpdesk and support;

(b)a phone number where the wallet-relying party can be contacted for matters pertaining to its registration and intended use of the wallet units;

(c)a digital address where the wallet-relying party can be contacted for matters pertaining to its registration and intended use of the wallet units;

(d)an e-mail address where the wallet-relying party can be contacted for matters pertaining to its registration and intended use of the wallet units;

6.A description of the type of services provided.

7.A list of the attributes that the relying party intends to request, expressed as a friendly name and a technical name including the namespace that the attributes are grouped under in a machine-readable format for automated processing, with an indication if they are mandatory or optional.

8.A description of the intended use of the attributes to be requested by the wallet-relying party from wallet units, including an indication if the intended use of the attribute are for purposes to fulfil specific rules of the Union or National law requiring the relying party to identify users.

9.An indication whether the wallet-relying party is a public sector body.

10.Where applicable, every entitlement of the wallet-relying party, that shall be expressed as follows:

(a)‘Service Provider’ to express the entitlement of the wallet-relying party as a provider of services;

(b)‘QEAA\_Provider’ to express the entitlement of the wallet-relying party as a qualified trust service provider issuing qualified electronic attestations of attributes;

(c)‘Non\_Q\_EAA\_Provider’ to express the entitlement of the wallet-relying party as a Trust service provider issuing non-qualified electronic attestations of attributes;

(d)‘PUB\_EAA\_Provider’ to express the entitlement of the wallet-relying party as a provider of electronic attestations of attributes issued by or on behalf of a public sector body responsible for an authentic source;

(e)‘PID\_Provider’ to express the entitlement of the wallet-relying party as a provider of person identification data;

(f)‘QCert\_for\_ESeal\_Provider’ to express the entitlement of the wallet-relying party as a qualified trust service provider issuing qualified certificates for electronic seals;

(g)‘QCert\_for\_ESig\_Provider’ to express the entitlement of the wallet-relying party as a qualified trust service provider issuing qualified certificates for electronic signatures;

(h)‘rQSealCDs\_Provider’ to express the entitlement of the wallet-relying party as a qualified trust service provider providing a qualified trust service for the management of a remote qualified electronic signature creation device;

(i)‘rQSigCDs\_Provider’ to express the entitlement of the wallet-relying party as a qualified trust service provider providing a qualified trust service for the management of a remote qualified electronic seal creation device;

(j)‘ESig\_ESeal\_Creation\_Provider’ to express the entitlement of the wallet-relying party as a (non-qualified) trust service provider of remote creation of electronic signatures or electronic seals as a non-qualified trust service;

(k)‘WAC\_Provider’ to express the entitlement of the wallet-relying party as a qualified trust service provider issuing qualified certificate for web authentication.

ANNEX II

1.Requirements on electronic signatures or seals applied to the information made available on registered wallet-relying parties

Electronic signatures and electronic seals referred to in Article 3(2) shall be JSON advanced electronic signatures at conformance level B-B, B-T or B-LT, and comply with the following ETSI technical specifications:

–ETSI TS 119 182-1 V1.2.1 (JAdES baseline signatures).

2.Requirements on the single API

1.The API shall:

(1)be a REST API, supporting JSON as format with JAdES or ASIC signature format in accordance with the relevant requirements specified in Section 1 of this Annex;

(2)allow any requestor, without prior authentication, to make (search/read) requests to the register, for information about a wallet-relying party, based on defined parameters including the wallet-relying party official or business registration number, or the name of the wallet-relying party or any information referred to in Annex II Paragraph 1, 2 and 8;

(3)ensure that replies to requests referred to in paragraph 2 include one or more statements on information about registered wallet-relying parties;

(4)be published as an OpenAPI version 3, together with the appropriate documentation.

2.The statements referred to in point (3) shall be expressed under the form of electronically signed or sealed JSON files, with format and structure in accordance with the requirements on electronic signatures or seals set out Section 1.

ANNEX III

Source of evidentiary documentation for the verification of entitlements of wallet-relying parties

1.The verification that a wallet-relying party is a provider of qualified electronic attestations of attributes, a provider of qualified certificate for electronic signatures or seals, or a provider of a qualified trust service for the management of a remote qualified electronic signature or seal creation device, shall be based on the national trusted lists issued in accordance with Article 22 of Regulation (EU) No 910/2014.

2.The verification that a wallet-relying party is a provider of non-qualified electronic attestations of attributes or a provider of remote creation of electronic signatures or seals as a non-qualified trust service shall be based on the national trusted lists issued in accordance with Article 22 of Regulation (EU) No 910/2014 of the European Parliament and of the Council
[5](#footnote6)
.

3.The verification that a wallet-relying party is a provider of person identification data shall be based on the list of providers of person identification data published by the Commission in accordance with Article 5a(18) of Regulation (EU) No 910/2014.

4.The verification that a wallet-relying party is a provider of electronic attestations of attributes issued by or on behalf of a public sector body responsible for an authentic source shall be based on the list published by the Commission in accordance with Article 45f(3) of Regulation (EU) No 910/2014.

ANNEX IV

Requirements for wallet-relying party access certificates

1.The certificate policy applicable to the provision of wallet-relying party access certificates shall describe the security requirements that apply to, and the rules that indicate the applicability of, a wallet-relying party access certificate for their issuance to and use by wallet-relying parties in their interactions with wallet solutions.

2.The certificate practice statement applicable to the provision of wallet-relying party access certificates shall describe the practices that a provider of wallet-relying party access certificates employs in issuing, managing, revoking, and re-keying wallet-relying party access certificates. The re-issuance of wallet-relying party access certificates for the same signature or seal activation data shall not be permitted.

3.The certificate policy and certificate practice statement applicable to the provision of wallet-relying party access certificates shall comply with IETF RFC 3647, and shall in particular include:

(a)a clear description of the public key infrastructure hierarchy and certification paths from the end-entity wallet-relying party access certificates up to the top of the hierarchy used for issuing them, while indicating the expected trust anchor(s) in such hierarchy and paths;

(b)a comprehensive description of the procedures for the issuance of wallet-relying party access certificates, including for the verification of the identity and of any certified attribute of the wallet-relying party to which a wallet-relying party certificate is to be issued;

(c)the obligation for the provider of wallet-relying party access certificates, when issuing a wallet-relying party certificate, to verify that:

–the wallet-relying party is included, with a valid registration status, in a register of the Member State in which that wallet-relying party is established;

–any information in the wallet-relying party access certificate is accurate and consistent with the registration information available from that register.

(d)a comprehensive description of the procedures for revocation of wallet-relying party access certificates;

(e)the obligation for the provider of wallet-relying party access certificates to implement measures and processes to:

–continuously monitor any changes in the relying party registers in which wallet-relying parties to whom they have issued wallet-relying party access certificates are registered;

–when such changes so require, revoke any wallet-relying party certificate that they issued to the corresponding wallet-relying party, in particular when the content of the certificate is no longer accurate and consistent with the information registered, or when the registration of the relying party is suspended or cancelled.

(f)a comprehensive description of the procedures and mechanisms for the validation of wallet-relying party access certificates;

(g)the obligation for the provider of wallet-relying party access certificates to allow relevant stakeholders, including wallet-relying parties and competent supervisory bodies, to request the revocation of wallet-relying party access certificates;

(h)the obligation for the provider of wallet-relying party access certificates to register all such revocations in its certificate database and to publish the revocation status of the certificate in a timely manner, and in any event within 24 hours after the receipt of the request for revocation. The revocation shall become effective immediately upon its publication;

(i)the obligation for the providers of wallet-relying party access certificates to provide information on the validity or revocation status of wallet-relying party certificates issued by that provider. This information shall be made available at least on a per certificate basis at any time and at least beyond the validity period of the certificate in an automated manner that is reliable, free of charge and effectively in accordance with the certificate policy;

(j)the obligation for the providers of wallet-relying party access certificates to log all wallet-relying party access certificates they have issued to ensure certificate transparency, in compliance mutatis mutandis with IETF RFC 9162;

(k)the obligation for the wallet-relying party access certificates to include:

–the location where the certificate supporting the advanced electronic signature or advanced electronic seal on that certificate is available, for the entire certification path to be built up to the expected trust anchor in the public key infrastructure hierarchy used by the provider;

–a machine processable reference to the applicable certificate policy and certificate practice statement;

–the information referred to in Annex I, points (1) to (3), 5(b) and 5(d).

ANNEX V

Requirements for wallet-relying party registration certificates

1.The certificate policy applicable to the provision of wallet-relying party registration certificates shall describe the security requirements that apply to, and the rules that indicate the applicability of, a wallet-relying party registration certificate for their issuance to and use by wallet-relying parties in their interactions with wallet solutions.

2.The certificate practice statement applicable to the provision of wallet-relying party registration certificates shall describe the practices that a provider of wallet-relying party registration certificates employs in issuing, managing, revoking, and re-keying wallet-relying party registration certificates, and where applicable how they relate to wallet-relying party access certificates issued to wallet-relying parties.

3.The certificate policy and certificate practice statement applicable to the provision of wallet-relying party registration certificates shall comply with IETF RFC 3647 and IETF RFC 5755, and shall in particular include:

(a)a clear description of the public key infrastructure hierarchy and certification paths from the end-entity wallet-relying party registration certificates up to the top of the hierarchy used for issuing them, while indicating the expected trust anchor(s) in such hierarchy and paths;

(b)a comprehensive description of the procedures for the issuance of wallet-relying party registration certificates, including for the verification of the identity and of any certified attribute of the wallet-relying party to which a wallet-relying party certificate is to be issued;

(c) the obligation for the provider of wallet-relying party registration certificates, when issuing a wallet-relying party registration certificate, to verify that:

–the wallet-relying party is included, with a valid registration status, in a register of the Member State in which that wallet-relying party is established;

–any information in the wallet-relying party registration certificate is accurate and consistent with the registration information available from that register.

(d)a comprehensive description of the procedures for revocation of wallet-relying party registration certificates;

(e)the obligation for the provider of wallet-relying party registration certificates to implement measures and processes to:

–continuously monitor any changes in the relying party registers in which wallet-relying parties to whom they have issued wallet-relying party registration certificates are registered;

–when such changes so require, revoke any wallet-relying party registration certificate that they issued to the corresponding wallet-relying party, in particular when the content of the certificate is no longer accurate and consistent with the information registered, or when the registration of the relying party is suspended or cancelled.

(f)a comprehensive description of the procedures and mechanisms for the validation of wallet-relying party registration certificates;

(g)the obligation for the provider of wallet-relying party registration certificates to allow relevant stakeholders, including wallet-relying parties and competent supervisory bodies, to request the revocation of wallet-relying party registration certificates;

(h)the obligation for the provider of wallet-relying party registration certificates to register all such revocations in its certificate database and to publish the revocation status of the certificate in a timely manner, and in any event within 24 hours after the receipt of the request for revocation. The revocation shall become effective immediately upon its publication;

(i)the obligation for the providers of wallet-relying party registration certificates to provide information on the validity or revocation status of wallet-relying party registration certificates issued by that provider. This information shall be made available at least on a per certificate basis at any time and at least beyond the validity period of the certificate in an automated manner that is reliable, free of charge and effectively in accordance with the certificate policy;

(j)the obligation for the providers of wallet-relying party registration certificates to log all wallet-relying party registration certificates they have issued to ensure certificate transparency, in compliance mutatis mutandis with IETF RFC 9162;

(k)the obligation for the wallet-relying party registration certificates:

–to include the location where the certificate supporting the advanced electronic signature or advanced electronic seal on that certificate is available, for the entire certification path to be built up to the expected trust anchor in the public key infrastructure hierarchy used by the provider;

–to include a machine processable reference to the applicable certificate policy and certificate practice statement;

–to include the information referred to in Annex I, points 1, 2 and 8;

–to comply with IETF RFC 5755 to express attributes in relation to wallet-relying party registration certificates.

:   [(1)](#footnoteref2)
       Commission Implementing Regulation (EU) No 1352/2013 of 4 December 2013 establishing the forms provided for in Regulation (EU) No 608/2013 of the European Parliament and of the Council concerning customs enforcement of intellectual property rights, OJ L 341, 18.12.2013, p. 10, ELI: 
    <http://data.europa.eu/eli/reg_impl/2013/1352/oj>
    .
:   [(2)](#footnoteref3)
       Commission Implementing Regulation (EU) 2022/1860 of 10 June 2022 laying down implementing technical standards for the application of Regulation (EU) No 648/2012 of the European Parliament and of the Council with regard to the standards, formats, frequency and methods and arrangements for reporting, OJ L 262, 7.10.2022, p. 68, ELI:  
    <http://data.europa.eu/eli/reg_impl/2022/1860/oj>
    <.>
:   [(3)](#footnoteref4)
       Council Regulation (EU) No 389/2012 of 2 May 2012 on administrative cooperation in the field of excise duties and repealing Regulation (EC) No 2073/2004, OJ L 121, 8.5.2012, p. 1, ELI: 
    <http://data.europa.eu/eli/reg/2012/389/oj>
    <.>
:   [(4)](#footnoteref5)
       Commission Implementing Regulation (EU) 2020/2244 of 17 December 2020 laying down rules for the application of Directive (EU) 2017/1132 of the European Parliament and of the Council as regards technical specifications and procedures for the system of interconnection of registers and repealing Commission Implementing Regulation (EU) 2015/884, OJ L 439, 29.12.2020, p. 1, ELI: 
    <http://data.europa.eu/eli/reg_impl/2020/2244/oj>
    <.>
:   [(5)](#footnoteref6)
       Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive), OJ L 333, 27.12.2022, p. 80, ELI: 
    <http://data.europa.eu/eli/dir/2022/2555/oj>
    <.>

[Top](#document2)