EPC launches SCARLET to set SCA rules and liability for EU Digital Identity Wallet payments

The European Payments Council launched SCARLET - Strong Customer Authentication Acceptance Rulebook and Liability Framework for EUDIW Transactions - after its board approved development on 24 September 2026. The initiative answers the eIDAS 2.0 obligation that payment service providers accept EU Digital Identity Wallets for strong customer authentication when a customer chooses one.

It is to be built in three parts: a business and contractual framework, common functional and operational rules, and technical specifications resting on the European Commission's Architecture Reference Framework. Version 1.0 covers wallet acceptance under PSD2 and the current EBA SCA rules; an open consultation is planned for summer 2027 and the first rulebook for December 2027. The EPC puts the population in scope at at least 3,000 PSPs and at least 27 wallet providers across the EU and EEA.

eIDAS 2.0 makes wallet acceptance an obligation rather than an option, and until now nothing told a PSP what accepting one actually means at the authentication step or who carries the loss when it fails. SCARLET is the industry's attempt to answer both before the obligation bites, and the liability allocation is the load-bearing part: SCA liability today is settled between issuer, acquirer and merchant, and inserting a state-issued wallet provider into that chain has no precedent.

A rulebook landing in December 2027 also sets the integration clock for every acquirer and gateway that will have to carry wallet-based authentication alongside 3-D Secure.

Whether the summer 2027 consultation holds, how SCARLET allocates liability between wallet provider, issuer and acquirer, and whether version 1.1 lands in time to carry PSR obligations from 2028 or 2029 as the EPC envisages.

• europeanpaymentscouncil.eu
• ID Tech Wire, 20 Oct 2026