eID verification in Portugal: Chave Móvel Digital, CC and AML
How eID works in Portugal: the Chave Móvel Digital and the Cartão de Cidadão, Autenticação.gov access for businesses, the AML law that names both, age rules, the EUDI Wallet dates and a launch checklist.
By Alberto RosasCo-founder & CEO, DiditUpdated 
In short
eID in Portugal means two State credentials, both notified to the EU at level of assurance High: the Chave Móvel Digital (Digital Mobile Key) and the Cartão de Cidadão (Citizen Card).[1] A business reaches both through one gateway, Autenticação.gov, under a protocol with the State agency ARTE.[8][9]
- Accept the Chave Móvel Digital first: it works on any phone, and the AML law names it among the means a customer may ask to use.[12]
- It passed 5 million active users in July 2026, according to Renascença quoting ARTE.[21]
- Keep a document route for anyone without either credential.
eID in Portugal is simple for a business: one login, Autenticação.gov, and behind it two electronic identification (eID) means the European Commission lists as notified under eIDAS (the EU regulation on electronic identification) at level High.[1] Portugal's anti-money laundering (AML) law names both as ways to prove a customer's identity remotely.[12]
eID in Portugal at a glance: every scheme
All Portuguese schemes sit in the Autenticação.gov ecosystem run by the State agency ARTE.[8] The Chave Móvel Digital (CMD) links a mobile number to the person's identity document.[2] The Cartão de Cidadão (CC) is a chip card, readable over NFC (near-field communication) since 11 June 2024.[7]
| Scheme | Operator | Users (date) | Credential | Level and EU notification | Data a business receives | Private-sector access | Didit status |
|---|---|---|---|---|---|---|---|
| Chave Móvel Digital (CMD) | ARTE[2] | 5 million+ active (July 2026, according to Renascença)[21] | Phone number, 4-digit PIN, 6-digit code by SMS, email or push[3] | High, notified 8 April 2020[1] | Attributes from the Autenticação.gov catalogue, requested one by one[11] | Yes, by protocol with ARTE[9] | On request |
| Cartão de Cidadão (CC) | ARTE runs the electronic authentication[8] | Almost 340,000 contactless cards in the first three months (June to September 2024); total not published[7] | Chip card in a reader, or over NFC with the 6-digit CAN; either way the authentication PIN[7] | High, notified 28 February 2019[1] | Over 40 attributes, including civil ID number, names, date of birth, age, nationality and photo[11] | Yes, by protocol with ARTE[9] | On request |
| SCAP (professional attributes) | ARTE[9] | Not published | A certified professional role attached to a CC or CMD sign-in[9] | Pre-notified 30 May 2018[1] | The professional attribute, for example company director[9] | Yes, in the same adhesion form[10] | On request |
| gov.pt app documents | ARTE[6] | 1M+ installs (Google Play listing, read 5 October 2026)[15] | Digital documents shown in real time in the app[6] | Not on the EU notified list[1] | The document as shown; same legal value as the original in Portugal[6] | Shown to third parties in Portugal[6] | Not EU-notified |
The gov.pt app row is a document display, not an eID scheme.[1][6]
The same report counts more than 197 million authentications, of which about 152 million used the CMD. ARTE's own release was not located.[21]
From the Citizen Card to the EUDI Wallet: the timeline
- 2007Citizen CardLei 7/2007 creates the Cartão de Cidadão.
- 26 June 2014CMD lawLei 37/2014 creates the Chave Móvel Digital.
- 28 February 2019CC notifiedThe card joins the EU list at High.
- 8 April 2020CMD notifiedThe mobile key joins the EU list at High.
- 11 June 2024ContactlessNew cards work over NFC with CAN and PIN.
Portuguese eID milestones.[1][6][7]
Lei 19-A/2024 amended both laws: among other changes, it added the card access number (CAN) to the card's visible data and gave digital documents in the gov.pt app the same legal value as the originals when shown in real time in Portugal.[6]
The two December dates are our computation: 24 and 36 months from the first wallet implementing acts, counted from 24 December 2024.[16]
- 24 December 2026Wallets dueEach Member State offers an EUDI Wallet.
- 10 July 2027AMLR appliesArticle 22(6)(b): eID means meeting eIDAS at Substantial or High.
- 24 December 2027AcceptanceRegulated private services accept the wallet.
- 2031Old cards expireOlder Citizen Cards stay valid until 2031 at the latest.
What changes in 2026 and 2027.[7][16][17]
Not yet published
As of 5 October 2026, the official sources we reviewed give no date or name for Portugal's EUDI Wallet. The gov.pt app already holds digital documents with legal value in Portugal,[6] but none says it will become the EUDI Wallet.
The rules: eID law, AML and age checks in Portugal
The eID laws
Lei 7/2007 governs the Citizen Card and Lei 37/2014 the CMD.[6] Portaria 77/2018 regulates the CMD.[4]
The AML law that names the eID
Lei 83/2017 lists the means an obliged entity may use to prove a customer's identity data.[12]
Art. 25(2)(a)Lei n.º 83/2017
"Através da utilização eletrónica do cartão de cidadão com recurso à plataforma de interoperabilidade da administração pública, após autorização do titular dos documentos ou do respetivo representante"
Source: Diário da República, Lei n.º 83/2017[12]
Art. 25(2)(b)Lei n.º 83/2017
"b) Através de Chave Móvel Digital"
Source: Diário da República, Lei n.º 83/2017[12]
In English: (a) electronic use of the Citizen Card via the public administration's interoperability platform, with the holder's authorisation; (b) the Chave Móvel Digital. Point (c) adds the use of interoperability platforms under Regulation (EU) No 910/2014. The means apply whenever customers have them and ask to use them.[12]
The Banco de Portugal's Aviso 1/2022 says a means that uniquely identifies the holder satisfies the signature element (Article 21(5)), and allows videoconference as an alternative (Article 21(6), Annex I).[13] Its consumer portal lists the CMD for opening an account remotely.[14]
| Remote route | Legal basis | Extra safeguards |
|---|---|---|
| Chave Móvel Digital | Lei 83/2017 art. 25(2)(b)[12] | The customer has it and chooses it[12] |
| Citizen Card via the public administration interoperability platform | Lei 83/2017 art. 25(2)(a)[12] | Holder's authorisation[12] |
| Interoperability platforms | Lei 83/2017 art. 25(2)(c)[12] | Under Regulation (EU) No 910/2014[12] |
| Videoconference (banks) | Aviso 1/2022 art. 21(6), Annex I[13] | Traceable first deposit from a non-high-risk country, copy of documents, prior risk analysis, tests and a compliance officer's opinion[13] |
From 10 July 2027, AMLR Article 22(6)(b) accepts "the use of electronic identification means which meet the requirements of Regulation (EU) No 910/2014 with regard to the assurance levels 'substantial' or 'high'".[17] AMLA's final draft standards (30 September 2026, not yet law) make eID the default; document alternatives must be justified.[18] See the AMLR guide.
Regulators: banking, gambling, telecom
For online gambling, according to a reproduction of SRIJ Regulamento 99/2018 on informador.pt (not checked for later amendments), operators verify players with the Citizen Card or the CMD through autenticação.gov, or an SRIJ web service, and receive name, date of birth and civil ID number.[22] For telecom, we did not find a specific remote identity rule in the sources reviewed (5 October 2026).
Age checks
Autenticação.gov offers an age attribute ("Idade") and a date-of-birth attribute.[11] Whether "Idade" also comes with a CMD sign-in is not stated, though the gambling return above includes the date of birth.[22] According to ECO, Parliament approved in general on 12 February 2026 a bill that bans social media accounts under 13, requires parental consent from 13 to 16 and uses the CMD to confirm age; ECO reported on 31 July 2026 that the law should be ready in October; its final status was not confirmed on 5 October 2026.[23][24] EU guidelines under the Digital Services Act expect age verification for gambling and pornography.[20] The EU age-verification app is still in pilot: the Commission named Denmark, France, Greece, Italy and Spain in October 2025 as the first Member States to take it up,[19] and its technical portal adds Cyprus and Ireland for 2026, not Portugal.[25]
What the user sees with the Chave Móvel Digital
The sign-in happens on Autenticação.gov: the user types the PIN there, never in your app.[3]
Choose how to sign in
Chave Móvel Digital
Cartão de Cidadão
1The user picks Chave Móvel Digital on the Autenticação.gov page.[2]
Phone number and PIN
Continue
2The user enters the mobile number and the 4-digit PIN.[3]
Enter the security code
Six digits, sent by SMS, email or push.
Confirm
3A temporary 6-digit code confirms the second factor.[3]
Share your data
- Full nameShared
- Date of birthShared
Authorise
4The user consents to the attributes the service asked for.[11]
After consent the user returns to your site, which receives a signed assertion.[11] In the gov.pt app the user can approve with a QR code or biometrics, according to Renascença.[21] Biometric activation in the app, open only to Portuguese nationals with a valid Citizen Card and an active authentication certificate, compares the user's face with the card image.[4][5]
How the sign-in travels
PIN, code and consent
You check the signature
Simplified SAML flow.[8][11]
Autenticação.gov speaks SAML, OAuth and JWT; the manual adds signed SAML requests and a QR-code flow.[8][11] See the Chave Móvel Digital integration guide.
Choosing schemes by use case
One adhesion to Autenticação.gov can cover both the Citizen Card and the CMD.[8][9]
| Use case | Start with | Fallback | What the sources say |
|---|---|---|---|
| Banks and fintech | CMD and CC | Videoconference or document check | Lei 83/2017 art. 25(2); Aviso 1/2022[12][13] |
| Crypto | CMD and CC | Document check | Art. 25(2) applies if you are an obliged entity; AMLR from 10 July 2027[12][17] |
| Online gambling | CC or CMD via autenticação.gov | SRIJ web service | Regulamento 99/2018, according to informador.pt[22] |
| Telecom | CMD | Document check | None found |
| Marketplaces | CMD for sellers | Document check | None found |
| Mobility | CMD for identity | Document check for the licence | None found |
Default route
Chave Móvel Digital
- Any phone, no reader
- Level High, notified 2020
- Lei 83/2017 art. 25(2)(b)
Lei 83/2017
Second route
Citizen Card
- Reader or NFC phone
- Level High, notified 2019
- Lei 83/2017 art. 25(2)(a)
Lei 83/2017
Fallback
Identity document
- Any nationality
- Chip, liveness, face match
- Justify it under AMLR
AMLR art. 22(6)(a)
The three routes for a Portuguese onboarding.[1][12][17][18]
People without a Portuguese eID
Foreign residents can get a CMD linked to a passport or residence document, activated at a counter (with a Portuguese tax number, NIF, for residence documents)[2][4] Minors can have a CMD; under 16, a parent must attend the activation.[4]
Other EU citizens can use their own eID through Autenticação.gov's eIDAS route.[8] The eID schemes by country guide lists them. Everyone else needs a document check with chip reading, liveness and face match (see the NFC chip security guide).
1Offer the Portuguese eIDs first
Which electronic ID the customer holds
Autenticação.gov
Art. 25(2)(a) or (b).
eIDAS route
Check art. 25(2)(c).
Document check
Chip, liveness, face match.
2Screen and decide
Sanctions and PEP screening; the decision stays with you.
Launch checklist for eID verification in Portugal
- Confirm whether you are an obliged entity under Lei 83/2017.[12]
- Pick the attributes you need, one by one, from the Autenticação.gov catalogue.[11]
- Submit the adhesion form and send the protocol to eid@arte.gov.pt with the request number.[10]
- Ask ARTE for the entity price: there is no public price list.[9]
- Add the eIDAS route for customers from other EU countries.[8]
- Keep a document route for everyone else, and record why it was used.[18]
- Document how the eID meets the signature element under Aviso 1/2022 art. 21(5).[13]
- Plan EUDI Wallet acceptance before 24 December 2027 if the duty applies to you.[16]
How Didit helps with eID verification in Portugal
Didit adds Chave Móvel Digital on request.
For Portuguese users today, Didit verifies people with the document route: ID verification with NFC chip reading, liveness and face match, plus AML screening, in one workflow. A full KYC (Know Your Customer) check costs $0.33 and AML screening $0.20. For age-gated services, age estimation costs $0.10 per check.
MitID, BankID Sweden, the Finnish Trust Network, Smart-ID and Mobile-ID are live in our national eID product (docs). EUDI Wallet acceptance is coming soon. Prices are on our pricing page.
Didit provides
- Document checks with NFC chip reading, liveness and face match
- AML screening against sanctions, PEP and watchlists
- The evidence of every check
Stays with you
- The risk assessment and the choice of Article 25 means
- The onboarding decision
- The reasons for any document fallback
Bring Chave Móvel Digital to your sign-up
Tell us where your Portuguese users sign in, and start with the document route today.
Key takeaways
- Portugal has two eIDs notified at High: the Chave Móvel Digital and the Cartão de Cidadão.
- Lei 83/2017 art. 25(2) names both as remote identification means a customer may ask to use.
- One protocol with ARTE gives a business both, through Autenticação.gov.
- From 10 July 2027 the AMLR accepts eID means that meet Regulation (EU) No 910/2014 at Substantial or High.
Frequently asked questions
What is the eID in Portugal?
Portugal has two notified eID means, both at level High: the Chave Móvel Digital, notified on 8 April 2020, and the Cartão de Cidadão, notified on 28 February 2019. Both are used through the State login Autenticação.gov.[1][8]
Can a private company use Autenticação.gov?
Yes. Integration is open to public and private entities under a protocol with ARTE. The entity fills in the adhesion form and sends the protocol to eid@arte.gov.pt.[9][10]
Is the Chave Móvel Digital accepted for remote KYC?
Yes. Lei 83/2017 art. 25(2)(b) names it as a means to prove identity data. The Banco de Portugal's consumer portal also lists it as a valid way to open an account remotely.[12][14]
What data does a business receive?
The attributes it requests from the Autenticação.gov catalogue, one by one: over 40 for the Citizen Card, including civil ID number, names, date of birth, age and nationality. Which card-only fields come with a CMD sign-in is not stated in the sources we reviewed.[11]
How much does Autenticação.gov cost a business?
There is no public price list. It is free for users, and entities must contact ARTE for their terms.[9]
Can foreigners get a Chave Móvel Digital?
Yes. They activate it at a service counter with a passport, a Brazilian Citizen Card, or a residence permit or card plus a Portuguese NIF. The biometric activation in the gov.pt app is only for Portuguese nationals with a Citizen Card.[4]
Does the Portuguese Citizen Card have NFC?
Yes, cards issued from 11 June 2024. Contactless use needs the 6-digit CAN printed on the front and the PIN.[7]
Will Portugal use the CMD for social media age checks?
According to ECO, a bill approved in general on 12 February 2026 proposes that, with a ban for under-13s and parental consent from 13 to 16. ECO reported on 31 July 2026 that the law should be ready in October. Its final status was not confirmed on 5 October 2026.[23][24]
When must businesses in Portugal accept the EUDI Wallet?
Private services that must use strong user authentication have to accept it at the user's request by 24 December 2027 (our computation: 36 months from the implementing acts of 24 December 2024). Micro and small enterprises are exempt. No date for Portugal's own wallet appears in the sources we reviewed.[16]
Sources
- Overview of pre-notified and notified eID schemes under eIDAS, European Commission, updated 2 February 2026, read 5 October 2026.
- A Chave Móvel Digital, Autenticação.gov (ARTE).
- Como pedir e usar a Chave Móvel Digital, Justiça.gov.pt.
- Ativar a Chave Móvel Digital, gov.pt, updated 22 September 2026.
- Chave Móvel Digital com biometria, digital.gov.pt.
- Lei n.º 19-A/2024, Diário da República (amends Lei 7/2007 and Lei 37/2014).
- 340 mil portugueses já têm cartão de cidadão contactless, Government of Portugal, 11 September 2024.
- Serviço de Autenticação, Mosaico (ARTE), updated 5 June 2026.
- Integrate with Autenticação.gov, Autenticação.gov (ARTE).
- Pedido de adesão (entity adhesion form), Autenticação.gov (ARTE).
- Manual de Integração do Fornecedor de Autenticação v1.5.7, ARTE, November 2021.
- Lei n.º 83/2017, Diário da República (AML law).
- Aviso do Banco de Portugal n.º 1/2022, Diário da República.
- Abertura de conta, Banco de Portugal, Portal do Cliente Bancário.
- gov.pt, Google Play listing, read 5 October 2026.
- Regulation (EU) 2024/1183 (eIDAS 2), EUR-Lex, Official Journal of 30 April 2024.
- Regulation (EU) 2024/1624 (AMLR), Article 22, EUR-Lex, Official Journal of 19 June 2024.
- Final Report, draft RTS under Article 28(1) AMLR, AMLA, 30 September 2026.
- Commission releases enhanced second version of the age verification blueprint, European Commission, 10 October 2025.
- Guidelines on measures to ensure a high level of privacy, safety and security for minors online (C/2025/5519), EUR-Lex.
- Chave Móvel Digital ultrapassa os 5 milhões de utilizadores ativos, Renascença (Lusa, quoting ARTE), 24 July 2026. Secondary source.
- Regulamento n.º 99/2018 (SRIJ), reproduction on informador.pt. Secondary source.
- Assembleia aprova proibição do acesso livre a redes sociais a menores de 16 anos, ECO, 12 February 2026. Secondary source.
- Lei que restringe redes sociais a menores de 16 deverá estar pronta em outubro, ECO, 31 July 2026. Secondary source.
- EU age verification solution, technical portal, ageverification.dev, read 5 October 2026.
Compare every national eID on the eID verification page, and see what changes when the EUDI Wallet arrives.
One workflow for Portugal and every other market
Verify Portuguese customers by document today, and add national eIDs as your users need them.
Related articles
- Didit vs Unit21: KYC, KYB, AML and monitoring on one record
- Didit vs Trinsic: eID sign-in plus document checks, AML and KYB
- Didit vs Thomson Reuters: government databases plus the whole flow
- Didit vs Regula: hosted checks with full evidence, KYB and monitoring
- Top 10 AI compliance agents for KYC and AML review automation in 2026
- Top 5 Travel Rule compliance solutions for crypto businesses in 2026