A method comprising: receiving, by a mobile device, a request for available applets from an access device; providing, by the mobile device, a list of available applets including trusted applet identifiers and untrusted applet identifiers to the access device, the list of available applets including a wallet identifier for each of the available applets, the trusted applet identifiers identifying applets having credentials provisioned with issuer participation, and the untrusted applet identifiers identifying applets having credentials provisioned without issuer participation, wherein the wallet identifier identifies a mobile application that is associated with each of the available applets; receiving, by the mobile device, a selection of an applet identifier from the list; when the selected applet identifier is a trusted applet identifier: providing, by the mobile device, the credentials associated with the selected trusted applet identifier to the access device; and when the selected applet identifier is an untrusted applet identifier: requesting, by the mobile device, an entity identifier from the access device; receiving, by the mobile device, the entity identifier associated with the access device; validating, by the mobile device, that the access device is authorized to access credentials associated with the selected untrusted applet identifier using the entity identifier; and providing, by the mobile device, the credentials associated with the selected untrusted applet identifier to the access device. receiving, by a mobile device, a request for available applets from an access device; providing, by the mobile device, a list of available applets including trusted applet identifiers and untrusted applet identifiers to the access device, the list of available applets including a wallet identifier for each of the available applets, the trusted applet identifiers identifying applets having credentials provisioned with issuer participation, and the untrusted applet identifiers identifying applets having credentials provisioned without issuer participation, wherein the wallet identifier identifies a mobile application that is associated with each of the available applets; receiving, by the mobile device, a selection of an applet identifier from the list; when the selected applet identifier is a trusted applet identifier: providing, by the mobile device, the credentials associated with the selected trusted applet identifier to the access device; and when the selected applet identifier is an untrusted applet identifier: requesting, by the mobile device, an entity identifier from the access device; receiving, by the mobile device, the entity identifier associated with the access device; validating, by the mobile device, that the access device is authorized to access credentials associated with the selected untrusted applet identifier using the entity identifier; and providing, by the mobile device, the credentials associated with the selected untrusted applet identifier to the access device. requesting, by the mobile device, an entity identifier from the access device; receiving, by the mobile device, the entity identifier associated with the access device; validating, by the mobile device, that the access device is authorized to access credentials associated with the selected untrusted applet identifier using the entity identifier; and providing, by the mobile device, the credentials associated with the selected untrusted applet identifier to the access device.