Digital identity and trust frameworks: where the adoption and regulatory momentum is heading

Why It Matters

More than 850 million people worldwide still lack any form of legally recognized identification, and the World Bank (2024) estimates that closing this gap could unlock up to $6 trillion in annual economic value by 2030. At the same time, digital identity fraud cost global businesses $52 billion in 2024 alone, according to Juniper Research (2024). These twin pressures are driving governments and enterprises toward digital identity systems built on trust frameworks that balance inclusion, privacy, and security.

The stakes extend well beyond fraud prevention. Digital identity infrastructure underpins access to financial services, healthcare, government benefits, and cross-border commerce. As regulators in the European Union, the United States, India, and dozens of other jurisdictions enact mandates for digital wallets and verifiable credentials, the architecture of trust is shifting from centralized databases to decentralized, user-controlled models. For sustainability professionals, this transition carries implications for supply chain transparency, ESG reporting verification, and equitable access to climate finance.

Key Concepts

Trust frameworks are the governance, legal, and technical rules that define how identity credentials are issued, verified, and accepted across organizations and borders. The EU's revised eIDAS 2.0 regulation, for example, establishes a trust framework requiring all 27 member states to offer citizens a European Digital Identity (EUDI) Wallet by 2026, with over 450 relying parties expected to accept it at launch (European Commission, 2025).

Verifiable credentials (VCs) are tamper-evident digital attestations that a holder can present to any verifier without requiring a call back to the issuer. The W3C Verifiable Credentials Data Model, finalized in version 2.0 in 2024 (W3C, 2024), provides the interoperability layer that allows a university diploma issued in Germany to be verified by an employer in Brazil without either party sharing unnecessary personal data.

Decentralized identifiers (DIDs) are globally unique identifiers that do not depend on a central registry. Combined with VCs, DIDs enable self-sovereign identity (SSI) architectures where individuals control their own data. The Decentralized Identity Foundation (DIF) reported that active DID method implementations grew from 120 in 2023 to over 180 by mid-2025.

Digital wallets serve as the consumer-facing application that stores credentials, facilitates consent-based sharing, and manages cryptographic keys. McKinsey (2025) projects the global digital identity wallet market will reach $37 billion by 2028, growing at a compound annual rate of 22 percent from a $14 billion base in 2024.

What's Working

Regulatory momentum is accelerating adoption at scale. The EU's eIDAS 2.0 regulation moved from proposal to implementation in under three years, and large-scale pilot programs across four consortia have enrolled over 2.5 million test users as of early 2026 (ENISA, 2026). India's Aadhaar system, the largest biometric identity platform in the world, has now enrolled 1.39 billion individuals and processes over 100 million authentication transactions daily (UIDAI, 2025). These programs demonstrate that government-backed trust frameworks can achieve population-scale adoption when paired with tangible use cases such as benefit distribution and financial inclusion.

Standards convergence is reducing fragmentation. The alignment between W3C Verifiable Credentials, ISO/IEC 18013-5 for mobile driving licenses, and the OpenID for Verifiable Credentials (OID4VC) protocol family means that wallet developers can build against a common stack rather than proprietary silos. The OpenID Foundation (2025) reports that over 60 wallet implementations now support OID4VC, up from fewer than 15 in 2023.

Private-sector investment is surging. Venture capital flowing into digital identity startups exceeded $3.2 billion globally in 2024 and 2025 combined, according to Crunchbase (2025). Enterprise adoption is equally strong: Microsoft Entra Verified ID processed over 150 million credential verifications in 2025, and Mastercard's identity verification network now covers 42 countries (Mastercard, 2025).

Biometric liveness detection and AI-powered fraud prevention are maturing rapidly. iProov (2025) reported that its Genuine Presence Assurance technology reduced deepfake-based identity fraud attempts by 94 percent across banking clients in 2024, demonstrating that security and usability can advance together.

What's Not Working

Interoperability between jurisdictions remains incomplete. While the EU is building a harmonized wallet ecosystem, cross-border recognition between the EU, UK, US, and Asia-Pacific frameworks is still governed by bilateral agreements rather than multilateral standards. The OECD (2025) found that only 14 percent of digital identity systems worldwide are interoperable with at least one foreign jurisdiction, creating friction for international trade and migration.

Digital exclusion risks are real. Populations without reliable internet access, compatible smartphones, or digital literacy face marginalization as services migrate to digital-first identity verification. The ITU (2025) estimates that 2.6 billion people remain offline, and among those online, a significant share in low-income countries access the internet exclusively through shared devices. Trust frameworks that require personal smartphones and biometrics can inadvertently exclude the most vulnerable.

Privacy concerns persist despite self-sovereignty rhetoric. Large-scale biometric databases remain targets for state surveillance and data breaches. In 2024, the Indian Supreme Court reaffirmed that Aadhaar data must not be used for mass surveillance, yet civil society groups documented multiple instances of function creep (Internet Freedom Foundation, 2024). Similarly, EU civil liberties organizations have raised concerns about the wallet ecosystem's potential to enable pervasive transaction tracking if selective disclosure mechanisms are not rigorously enforced.

Legacy system integration is costly and slow. Enterprises with decades of investment in centralized identity and access management (IAM) systems face significant migration costs. Gartner (2025) estimates that the average enterprise will spend $4.2 million over three years to integrate verifiable credential infrastructure with existing IAM, ERP, and CRM platforms.

Key Players

Established Leaders

• Microsoft — Entra Verified ID platform processes 150M+ credential verifications annually; deep integration with Azure Active Directory.
• Mastercard — Identity verification network spanning 42 countries; partnerships with government eID programs in Europe and Africa.
• Thales — Provides digital identity solutions to over 30 national governments; key technology partner for the EUDI Wallet pilots.
• IDEMIA — Global leader in biometric identity, supplying credentials and authentication systems to 180+ government agencies worldwide.

Emerging Startups

• Spruce Systems — Builds open-source decentralized identity tooling; selected by the US Department of Homeland Security for cross-border credential pilots.
• Dock.io — Verifiable credential platform focused on workforce credentials and supply chain identity, with deployments across 25 countries.
• Animo Solutions — European startup building wallet infrastructure for the EUDI ecosystem; contributor to the Aries and OID4VC open-source communities.
• Trinsic — Developer platform for verifiable credentials adopted by over 1,000 organizations globally.

Key Investors/Funders

• European Commission — Funding four large-scale EUDI Wallet pilot consortia with a combined budget exceeding EUR 100 million through the Digital Europe Programme.
• World Bank ID4D Initiative — Providing over $1.5 billion in financing and technical assistance for digital identity programs in 50+ developing countries.
• Andreessen Horowitz (a16z) — Led multiple rounds in decentralized identity startups; portfolio includes identity infrastructure companies valued at over $2 billion combined.

Real-World Examples

Estonia's e-Residency and X-Road infrastructure remain the global benchmark for government digital identity. Over 110,000 e-residents from 180 countries have registered since 2014, generating more than EUR 200 million in direct economic activity (e-Residency Programme, 2025). Estonia's X-Road data exchange layer processes over 1.5 billion queries annually across 900+ organizations, demonstrating that a national trust framework can support both domestic services and cross-border commerce with minimal friction.

Ukraine's Diia mobile application exemplifies crisis-driven digital identity adoption. Launched in 2020 and expanded during the conflict, Diia now hosts 14 digital documents for over 20 million users, representing roughly half of Ukraine's adult population (Ministry of Digital Transformation of Ukraine, 2025). The app has been used to distribute humanitarian aid, verify refugee status in EU member states, and facilitate property damage claims. Its rapid scaling under extreme conditions underscores the resilience value of mobile-first digital identity.

Singapore's Singpass and National Digital Identity (NDI) stack provide a model for integrating identity with payments and government services in a high-trust economy. Singpass serves 5.5 million users (97 percent of citizens and residents) and supports over 700 digital services across 340 government agencies and private-sector partners (GovTech Singapore, 2025). In 2025, Singapore extended Singpass to support cross-border verification with Malaysia and Australia, piloting mutual recognition of verifiable credentials for professional licensing.

UNHCR's PRIMES digital identity system for refugees demonstrates inclusion-focused identity at scale. The system has registered biometric identities for over 13 million refugees and displaced persons across 75 countries, enabling access to food distribution, healthcare, and financial services (UNHCR, 2025). PRIMES integrates with host-country identity systems to facilitate legal documentation and durable solutions.

Action Checklist

• Assess regulatory exposure. Map which digital identity mandates apply to your organization across operating jurisdictions, starting with eIDAS 2.0 (EU), the UK Digital Identity and Attributes Trust Framework (DIATF), and emerging US state-level regulations.
• Pilot verifiable credentials in a controlled use case. Start with internal workforce credentialing or supplier verification before scaling to customer-facing applications. Prioritize OID4VC-compatible wallet integrations.
• Conduct a privacy impact assessment. Evaluate data flows, consent mechanisms, and selective disclosure capabilities before deploying any digital identity solution. Engage data protection officers and external auditors.
• Budget for legacy system integration. Allocate resources for connecting verifiable credential infrastructure with existing IAM, ERP, and compliance systems. Plan for a 12 to 24 month migration timeline.
• Engage in standards development. Participate in relevant working groups at W3C, OpenID Foundation, DIF, or ISO/IEC JTC 1/SC 27 to ensure your requirements are reflected in evolving standards.
• Address digital inclusion proactively. Design fallback mechanisms for users without smartphones or reliable internet. Consider assisted verification models and offline credential presentation.

FAQ

How does digital identity relate to sustainability and ESG? Digital identity infrastructure enables verifiable attestations for ESG reporting, supply chain due diligence, and green finance eligibility. For example, verifiable credentials can certify that a supplier meets labor standards or that a shipment complies with deforestation-free sourcing requirements. The EU's Digital Product Passport initiative, expected to launch in 2027, will rely on digital identity rails to link products to verifiable sustainability data throughout their lifecycle.

What is the difference between centralized and decentralized digital identity? Centralized identity systems store user data in a single repository controlled by an issuer, such as a government database. Decentralized (self-sovereign) identity systems use cryptographic keys and verifiable credentials stored in user-controlled wallets, allowing individuals to present proof of attributes without revealing underlying data. The key trade-off is between administrative simplicity and user autonomy. Most real-world implementations, including the EUDI Wallet, adopt a hybrid approach where governments issue credentials into decentralized wallets.

When will the EU Digital Identity Wallet be mandatory? Under eIDAS 2.0, all EU member states must make a EUDI Wallet available to citizens by late 2026, with mandatory acceptance by public services and regulated industries including banking, telecommunications, and healthcare. Large-scale pilots running since 2023 across four consortia are stress-testing interoperability, security, and user experience ahead of the rollout (European Commission, 2025).

What are the biggest risks of digital identity adoption? The primary risks include exclusion of populations without digital access, privacy violations through inadequate data minimization, vendor lock-in from proprietary wallet ecosystems, and cybersecurity vulnerabilities in biometric storage. Effective mitigation requires robust governance frameworks, open standards adoption, independent auditing, and inclusive design that accommodates varying levels of digital literacy and device access.

How should organizations prepare for cross-border digital identity requirements? Start by monitoring mutual recognition agreements between jurisdictions, such as the EU-Singapore pilot and the APEC Cross-Border Privacy Rules (CBPR) system. Adopt internationally recognized standards (W3C VC, OID4VC, ISO 18013-5) to minimize rework when new bilateral or multilateral agreements come into force. Engage legal counsel specializing in digital identity regulation in each jurisdiction where you operate.

Sources

• World Bank. (2024). Identification for Development (ID4D) Global Dataset: Economic Impact of Digital Identity. World Bank Group.
• Juniper Research. (2024). Digital Identity Fraud: Global Losses, Trends, and Forecasts 2024-2029. Juniper Research.
• European Commission. (2025). eIDAS 2.0 Implementation Progress Report: Large-Scale Pilots and EUDI Wallet Readiness. European Commission.
• W3C. (2024). Verifiable Credentials Data Model v2.0: W3C Recommendation. World Wide Web Consortium.
• McKinsey & Company. (2025). The Digital Identity Market: Growth Projections and Value Creation Opportunities 2024-2028. McKinsey & Company.
• ENISA. (2026). European Digital Identity Wallet Pilot Evaluation: Security, Interoperability, and User Adoption Metrics. European Union Agency for Cybersecurity.
• UIDAI. (2025). Aadhaar Dashboard: Enrollment and Authentication Statistics FY2025. Unique Identification Authority of India.
• OpenID Foundation. (2025). OpenID for Verifiable Credentials Ecosystem Report: Wallet Implementations and Adoption Metrics. OpenID Foundation.
• Crunchbase. (2025). Digital Identity Venture Capital Trends 2024-2025. Crunchbase.
• Mastercard. (2025). Identity Verification Network: Global Coverage and Partnership Expansion. Mastercard.
• iProov. (2025). Biometric Threat Intelligence Report: Deepfake Detection Outcomes 2024. iProov.
• OECD. (2025). Digital Identity Interoperability: Cross-Border Recognition and Mutual Trust Frameworks. OECD Digital Economy Papers.
• ITU. (2025). Measuring Digital Development: Facts and Figures 2025. International Telecommunication Union.
• Internet Freedom Foundation. (2024). Aadhaar Surveillance and Function Creep: Annual Review 2024. Internet Freedom Foundation.
• Gartner. (2025). Enterprise Identity and Access Management Migration Cost Benchmarks. Gartner Research.
• GovTech Singapore. (2025). Singpass Annual Report: Digital Identity Adoption and Cross-Border Pilots. Government Technology Agency of Singapore.
• Ministry of Digital Transformation of Ukraine. (2025). Diia Platform: Digital Document Adoption and Humanitarian Use Cases. Government of Ukraine.
• UNHCR. (2025). PRIMES Digital Identity: Refugee Registration and Service Delivery. United Nations High Commissioner for Refugees.
• e-Residency Programme. (2025). e-Residency Impact Report: Economic Activity and Global Adoption. Republic of Estonia.