Digital identity after Sovrin: eIDAS 2.0 wallets and verifiable credentials

This article first appeared on our blog in 2022, at the height of interest in decentralized identity, and argued that self-sovereign identity would matter. It did — but not through the network we were writing about. The Sovrin MainNet shut down on 31 March 2025 and the Sovrin Foundation dissolved on 21 May 2025. We have rewritten the piece around what actually won: eIDAS 2.0 wallets and the verifiable-credential standards that escaped the ledger.

Self-sovereign identity got its architecture right and its infrastructure wrong. The user-held credential, selective disclosure, verification without phoning the issuer — all of it is now European law. The public-permissioned blockchain underneath it is gone. If you are building identity into a regulated product in 2026, the useful question is no longer “should we use SSI”; it is which four specifications you have to implement, and by when.

What Sovrin was, and the one idea worth keeping

Sovrin’s architecture (built on Hyperledger Indy) rested on three roles and one inversion:

• Issuers — a government, bank or university — cryptographically signed verifiable credentials (“this person is over 18”, “this degree is real”) and handed them to you.
• Holders — you — kept credentials in a wallet you controlled, on your device.
• Verifiers — anyone needing proof — received a presentation from your wallet and checked the issuer’s signature.

The inversion: personal data never touched the ledger. Sovrin’s ledger stored only public artifacts — issuers’ decentralized identifiers, credential schemas, revocation registries. Your data lived with you; the ledger existed so a verifier could check that an issuer’s key was genuine and a credential had not been revoked, without calling the issuer and telling them where you were presenting it. Add zero-knowledge techniques and you got selective disclosure: prove you are over 18 without revealing your birthdate.

As a list of design principles this remains exactly right: user control, data minimisation, no central honeypot, no issuer phone-home on every verification. As a deployment plan it failed, and it is worth being precise about why. The ledger solved a problem most ecosystems did not have. Verifiers overwhelmingly needed to trust a small, known set of issuers — governments, banks, universities — whose keys can be published and rotated through ordinary means. Paying consensus costs and governance overhead to decentralise a trust list that was never contested is the same error we describe in blockchain vs database. After years of governance and funding turbulence and thin adoption, the network wound down; the ledger survives only as a read-only archive so already-issued credentials can still be verified.

The stack that actually won

The standards escaped the blockchain, and they are specific enough to implement against. Four pieces:

• W3C Verifiable Credentials 2.0 — the data model. Stable, a W3C Recommendation, and deliberately agnostic about where trust anchors live.
• SD-JWT VC — the credential format doing most of the real work in Europe. A signed JWT with salted, individually disclosable claims: selective disclosure without zero-knowledge machinery, implementable by any team that already handles JWTs.
• OpenID for Verifiable Presentations and its issuance counterpart, OpenID4VCI — the protocols. This is the pragmatic masterstroke: credential exchange rides on OAuth-shaped flows that every identity team on earth already operates.
• ISO/IEC 18013-5 mdoc — the mobile-driving-licence format, and the reason your wallet will hold credentials issued by authorities that have never heard of the W3C.

If you are building acceptance, those are your dependencies. Note what is absent: no ledger, no token, no consensus. Trust comes from certified issuers and published trust lists — the EUDI Architecture and Reference Framework specifies exactly how. The “blockchain” in SSI turned out to be the removable part.

Europe legislated the wallet, and then attached a deadline to it

eIDAS 2.0 — Regulation (EU) 2024/1183 — obliges every member state to offer citizens an EU Digital Identity Wallet, with regulated sectors including banking obliged to accept wallet presentations in the period following (Commission overview). The architecture is recognisably Sovrin’s: credentials held on the citizen’s device, selective disclosure, verification without issuer callbacks. Sovereign-backed rather than blockchain-anchored — the compromise the movement needed and resisted.

The deadline that turns this from roadmap to project is not in eIDAS at all. It is in the Anti-Money Laundering Regulation, (EU) 2024/1624, which applies from 10 July 2027. Article 22 makes eIDAS-based means — national eID, qualified electronic signatures, EUDI wallet credentials — the primary route for remote customer identification, and demotes video identification to a defined fallback, permitted where an eIDAS-compliant method is unavailable or disproportionate (practitioner summary). In Germany that lands on top of BaFin Circular 3/2017 (GW), still the live instrument for video identification and expected to be superseded by a dedicated ordinance.

For anyone running onboarding today, that is a concrete three-part programme: accept wallet presentations, keep a certified video-identification path as the documented fallback, and be able to show why the fallback was used in any given case.

India took the other road, and it worked

Aadhaar, DigiLocker and the UPI-adjacent rails delivered a billion-person digital identity as state infrastructure — philosophically the opposite of SSI, operationally the largest digital-ID deployment in the world. The lesson idealists resisted is that adoption follows utility and issuer buy-in, not architectural purity. Two things are worth noticing anyway: DigiLocker’s signed documents already occupy verifiable-credential territory in substance, and India’s DPDP Act 2023 with the DPDP Rules 2025 (notified 14 November 2025, substantive obligations from 14 May 2027) push the centralised model toward the same data-minimisation properties SSI designed in from the start. The architectures are converging from opposite ends.

What this means for anyone building onboarding

We build video-KYC and video-banking platforms, which makes this settlement our problem as much as our readers’. The realistic architecture for banks and government services through 2027 and beyond is hybrid, with the ranking now written into law: accept wallet credentials as the primary path, fall back to compliant video identification where the wallet cannot serve, and run one audit and risk framework across both so the choice between them is itself a recorded, justifiable decision.

Wallets still need enrolment — frequently video-based — recovery after device loss, and coverage for customers outside the ecosystem for years. Video identification is not disappearing; it is being reclassified, and a reclassification you have not designed for is an audit finding. That is an integration and platform-engineering problem, which is the kind we take on in our banking & insurance and product & software engineering work.

FAQ

Which specifications do I actually implement to accept EU Digital Identity Wallet credentials? Four: W3C Verifiable Credentials 2.0 as the data model, SD-JWT VC as the credential format, OpenID4VP and OpenID4VCI as the presentation and issuance protocols, and ISO/IEC 18013-5 mdoc for authority-issued documents. Trust anchors come from certified issuers and published trust lists per the EUDI Architecture and Reference Framework — not from a ledger.

Will digital identity wallets replace video KYC? They will outrank it. From 10 July 2027 the AMLR makes eIDAS-based identification the primary route and video identification a defined fallback, permitted where an eIDAS method is unavailable or disproportionate. Video stays in the stack for enrolment, recovery and non-wallet customers — but you will need to justify each use, which is a design requirement, not a paragraph in a policy document.

Is the Sovrin network still running? No. The MainNet shut down on 31 March 2025 and the Sovrin Foundation dissolved on 21 May 2025; the ledger remains only as a read-only archive so existing credentials can still be verified. The standards it championed continue independently and are now the basis of the EU Digital Identity Wallet.

Rajan Jain is the CEO of Vaagmodo. We build identity-adjacent platforms — video KYC, onboarding, credential integration — for regulated clients in Europe and India. Talk to us: contact or info@vaagmodo.com.