IT-Wallet for businesses: Italy's EUDI-track wallet explained
IT-Wallet is Italy's digital wallet in the IO app, with 10.1 million activations by February 2026. What it holds, what a business will receive, the AML law, and what to run before private relying-party access opens.
By Alberto RosasCo-founder & CEO, DiditUpdated 
In short
IT-Wallet is Italy's national digital wallet, built into the government's IO app, and the country's route to the EU Digital Identity (EUDI) Wallet.[1] It counted 10.1 million activations by 17 February 2026.[3] Private businesses cannot request data from it yet: no relying-party rules for companies were published by 5 October 2026.
- It holds a digital driving licence, health card and disability card, opened with SPID (the Public Digital Identity System) or the CIE (electronic identity card).[2]
- Italian anti-money laundering (AML) law accepts SPID and CIE at level substantial or higher for remote onboarding today.[11]
If you searched "IT Wallet" to decide whether your sign-up should accept it: not yet, but plan for it. The government says IT-Wallet will be updated step by step until it fully matches the EUDI Wallet architecture.[1]
What IT-Wallet is
The IT-Wallet System was created by Decree-Law 19 of 2 March 2024, converted by Law 56 of 29 April 2024, which added Article 64-quater to the Digital Administration Code (CAD). It combines a public wallet in the IO app with private wallets from market operators.[1]
The Department for Digital Transformation leads. The State Mint and Polygraphic Institute (IPZS) runs the central infrastructure and issues the public attestations and the person identification data (PID). PagoPA runs IO and the public wallet.[4]
IT-Wallet
Italy's digital wallet system, public wallet in the IO app
Adoption: how many people use IT-Wallet
Activation is free, optional and open to adults holding the valid physical documents.[2] By 17 February 2026 there were 10.1 million activations; the licence and the health card had 8.5 million each, the European Disability Card 200,000.[3] That is the last dated official count; IPZS later gave only a rounded "12 million activations over the past year and a half", with no date.[4]
The government counts activations, not unique adults, so no share of the adult population has been published.[3] No count of presentations to businesses exists.
- 2 March 2024LawDecree-Law 19 creates the IT-Wallet System.
- 4 December 2024All-citizen launchFirst public release on 23 October 2024.
- 17 February 202610.1 millionActivations pass ten million.
- May 2026TestingTest environment opens to private wallet providers.
- 24 December 2026EU deadlineEvery Member State must offer an EUDI Wallet.
Founding decree to EU deadline.[1][2][3][4][6]
What the user sees
Today the journey is activation: install IO, sign in with CieID or SPID, and add documents; nothing is added without an explicit request. The documents replace the physical ones in set contexts, such as the licence at a police check.[2]
Sign in to IO
Use your digital identity.
Sign in with CIE
Sign in with SPID
1The user signs in to IO with CieID or SPID.[2]
Add a document
Driving licence, health card or European Disability Card.
Add
2The user picks which documents to add.[2]
Document added
Supplied by the issuing body.
3The issuing body supplies the data to the wallet.[2]
Presentations will follow the EUDI Architecture and Reference Framework (ARF). On the same device, the website hands an OpenID for Verifiable Presentations (OpenID4VP) request to the wallet app; on a computer, it shows a QR code.[10] Italy has not published its screens or attribute list, so this strip shows the ARF flow, not IT-Wallet screens.
Verify your identity
Share your details from your digital wallet.
Use IT-Wallet
Use an ID document instead
1The service offers the wallet or a document.
Scan with your phone
Scan the code with the wallet app.
2Cross-device: a QR code moves the request to the phone.[10]
Share these details
Requested by Example Bank
- Full nameShared
- Date of birthShared
- AddressNot shared
Approve
3The wallet authenticates the requester by access certificate, checks the request against its registration, names it, then the user approves.[10]
Details received
The service checks the signature and continues.
4The service verifies the signed data and decides.[10]
An EUDI Wallet presentation over OpenID4VP, start to finish.
What a business receives
No attribute list for IT-Wallet presentations to private companies was published by 5 October 2026. What is fixed is the EU PID set, defined in Implementing Regulation (EU) 2024/2977 and issued for Italy by IPZS.[7][4]
| Status in the PID | Attributes | Source |
|---|---|---|
| Always (mandatory) | Family name, given name, date of birth, place of birth, nationality; metadata: expiry date, issuing authority, issuing country | CIR 2024/2977[7] |
| Optional | Sex, birth names, address fields, a personal administrative number | CIR 2024/2977[7] |
| Portrait | Optional today; mandatory only from 11 August 2028 | CIR 2026/1731[8] |
| Never | Anything beyond what the relying party registered to request | eIDAS Art. 5b[6] |
Plan for three gaps: the sources reviewed do not say whether Italy's PID will carry the tax code; address is optional, so keep a proof of address step; and until 11 August 2028 you cannot count on a portrait for a face match.[7][8]
Attributes arrive signed by their issuer, with selective disclosure,[10] in SD-JWT VC or ISO/IEC 18013-5 mdoc format.[8] The OpenID4VP verifier guide covers the checks.
Level of assurance and legal standing of IT-Wallet
A level of assurance (LoA) says how sure the system is that the person is who they claim: low, substantial or high under eIDAS, the EU regulation on electronic identification (Regulation (EU) No 910/2014, amended by Regulation (EU) 2024/1183). IT-Wallet is not on the EU list of notified schemes, which for Italy names SPID and the CIE, both at low, substantial and high.[5] For an EUDI Wallet the rule is clear: EUDI Wallets "shall be provided under an electronic identification scheme with assurance level high" (eIDAS Article 5a(11)).[6]
| Rule | What it says for IT-Wallet | Applies |
|---|---|---|
| CAD Art. 64-quater | Creates the IT-Wallet System, public and private wallets[1] | Since 2024 |
| Legislative Decree 231/2007, Art. 19 | Remote AML identification with SPID, CIE or a notified eID at level substantial or higher, a qualified signature certificate, or a procedure recognised by AgID[11] | Now |
| EU notified-schemes list | IT-Wallet not listed, no level published[5] | Now |
| Regulation (EU) 2024/1183, Art. 5a | Each Member State offers at least one EUDI Wallet, at level high, free for people[6] | 24 December 2026 |
| Regulation (EU) 2024/1183, Art. 5f(2) | Private relying parties required by law or contract to use strong user authentication for online identification must accept EUDI Wallets at the user's request; micro and small enterprises are exempt[6] | 24 December 2027 |
| Regulation (EU) 2024/1624 (AMLR), Art. 22(6) | Identity verified by a document or by eID at level substantial or high[12] | 10 July 2027 |
For remote AML identification in Italy today, Article 19(1)(a)(2) of Legislative Decree 231/2007 accepts a digital identity at substantial level or higher in the CAD Article 64 system (SPID and CIE), a notified eID at substantial or higher, or a qualified signature certificate.[11] IT-Wallet is not named, and no supervisor statement on it appears in the sources reviewed.
Article 19(1)(a)(2)Legislative Decree 231/2007
"L'obbligo di identificazione si considera assolto, anche senza la presenza fisica del cliente, nei seguenti casi: [...] 2) per i clienti in possesso di un'identità digitale, con livello di garanzia almeno significativo, nell'ambito del Sistema di cui all'articolo 64 [...]"
Source: Normattiva, Legislative Decree 231/2007, Article 19[11]
From 10 July 2027 the EU Anti-Money Laundering Regulation (AMLR) applies. Article 22(6)(b) allows "the use of electronic identification means which meet the requirements of Regulation (EU) No 910/2014 with regard to the assurance levels 'substantial' or 'high'".[12] Recital 11 of the Anti-Money Laundering Authority (AMLA) final draft standards of 30 September 2026, a proposal not yet law, adds that this includes EUDI Wallets.[13] See the EUDI Wallet deadlines guide.
How a business connects to IT-Wallet
As of 5 October 2026 no onboarding path, contract or price list is published for private companies that want IT-Wallet data. A national test environment opened in May 2026 for private wallet providers, on request to identitadigitale@pec.ipzs.it.[4] Guidelines are being written with the Agency for Digital Italy (AgID) and the National Cybersecurity Agency.[1]
EU rules already set the shape. You register in your Member State of establishment, stating who you are and the data you request (Article 5b).[6] Implementing Regulation (EU) 2025/848 applies from 24 December 2026 and defines a registration certificate (the attributes you registered to request) and an access certificate (which authenticates you).[9] The EUDI relying party guide walks through each step.
Today
SPID or CIE login
- Notified at substantial and high
- Meets Art. 19 for remote AML checks
- Convention with AgID or the CIE federation
Art. 19, Legislative Decree 231/2007
Today
Document route
- CIE chip read by near-field communication (NFC)
- Liveness and face match
- Covers customers without an eID
Art. 22(6)(a) AMLR from 2027
Not open yet
IT-Wallet presentation
- Register as a relying party
- Access and registration certificates
- OpenID4VP or ISO/IEC 18013-7 verifier
eIDAS Art. 5b, CIR 2025/848
See the SPID integration and CIE ID integration guides.
You can build the third route or use a provider that runs the verifier; whether a provider may register for you is not published.
Wallet checks your certificates
Check signature, revocation, device binding
The ARF presentation flow, simplified.[10]
Use cases and sector rules
The aim is that people present attestations directly to companies and public administrations.[1]
| Sector | Rule today | Where IT-Wallet fits |
|---|---|---|
| Banks, payments, crypto (Know Your Customer, KYC) | Art. 19 accepts SPID and CIE at substantial or higher[11] | Art. 5f(2) duty from 24 December 2027 where strong user authentication applies; micro and small enterprises exempt[6] |
| Adult content (age checks) | AGCOM Delibera 96/25/CONS: certified third parties, double anonymity[14] | Among the first to take up the EU age-verification solution;[16] piloting it in the national wallet during 2026[17] |
| Online gambling | SPID or CIE account opening from 13 November 2025, according to InformazioneFiscale | No IT-Wallet rule published |
| Telecoms | No Italy-specific eID rule found | Named in the Art. 5f(2) sector list[6] |
| Signing | Art. 19 also accepts a qualified signature certificate[11] | An EUDI Wallet can sign with qualified electronic signatures[6] |
For age checks, AGCOM requires "doppio anonimato": the age-proof provider must not learn which site the user visits, and the site must not receive identity data; SPID, CIE and wallets qualify only where that holds.[14] The rules apply from 12 November 2025 for sites in Italy or outside the EU and from 1 February 2026 for other EU sites.[19] AGCOM's list of 29 September 2026 names 79 services.[15] Methods are on the age verification page.
IT-Wallet limits and fallbacks
Activation needs adulthood, valid Italian documents and CieID or SPID.[2] That leaves out:
- Minors: the first phase is for adults only.[2]
- Foreigners without Italian documents: SPID needs an Italian identity document and the health card or tax-code card.[18]
- People who choose not to use it: wallet use is voluntary, and other means must stay open (eIDAS Art. 5a(15)).[6]
The ARF warns that cross-device custom URI schemes "are vulnerable to phishing and relay attacks".[10]
The fallback is the document route: read the CIE chip over NFC, check liveness and match the face to the document portrait.
1Offer the Italian eID first
SPID or CIE today, IT-Wallet once it opens.
Can the customer use an Italian eID or wallet
Verify the signed attributes
Check level, signature and validity.
Verify with a document
NFC chip reading, liveness, face match.
2Screen and decide
Sanctions and politically exposed person (PEP) screening; the decision stays with you.
Implementation checklist
- Map which of your products fall under the Art. 5f(2) acceptance duty.[6]
- Accept SPID and CIE now for remote Italian onboarding.[11]
- Keep a document route with NFC chip reading for everyone else.
- List the PID attributes you need and justify each one.[7]
- Prepare registration data for the register in your Member State of establishment.[6][9]
- Run the EUDI conformance tests on your verifier.[10]
How Didit helps with IT-Wallet
Didit adds IT-Wallet on request. In Italy, Didit verifies users with the document route: NFC chip reading of the CIE, liveness and face match, plus AML screening in the same workflow. EUDI Wallet acceptance is coming soon. A full KYC check costs $0.33, NFC verification $0.15 and AML screening $0.20.
Didit provides
- Document checks with NFC chip reading, liveness and face match
- AML screening against sanctions, PEP and watchlists
- The evidence of every check
Stays with you
- The risk assessment and the policies
- The onboarding decision
- Relying-party registration
Plan IT-Wallet into your sign-up
Tell us where your Italian users sign in, and start with the document route today.
Key takeaways
- IT-Wallet counted 10.1 million activations by 17 February 2026.
- Private relying parties cannot request IT-Wallet data yet (5 October 2026).
- SPID and CIE at level substantial or higher meet Italian AML law for remote onboarding today.
- Plan for the EU PID set, no guaranteed portrait before 11 August 2028, and wallet acceptance by 24 December 2027 where strong user authentication is required.
Frequently asked questions
Can a private company accept IT-Wallet today?
Not yet. No onboarding path for private relying parties was published by 5 October 2026. The test environment opened in May 2026 is for private wallet providers.[4]
How much does IT-Wallet cost a business?
No relying-party price has been published. eIDAS only makes the wallet free of charge for people (Article 5a(13)).[6]
What data will a business receive from IT-Wallet?
Italy has not published the list. The EU PID set makes family name, given name, date of birth, place of birth and nationality mandatory, with address and an identifier optional.[7] A portrait is mandatory only from 11 August 2028.[8]
What level of assurance does IT-Wallet have?
No level has been published for IT-Wallet, and it is not on the EU notified-schemes list.[5] EUDI Wallets must be provided at level high.[6]
Can IT-Wallet be used for AML customer due diligence in Italy?
Not by name today: Article 19 of Legislative Decree 231/2007 covers SPID, CIE and notified eIDs at level substantial or higher.[11] From 10 July 2027, AMLR Article 22(6)(b) accepts eID at substantial or high.[12] AMLA's draft standards, not yet law, would count EUDI Wallets as such eID.[13]
Can minors use IT-Wallet?
No. The first phase is for adults who hold the valid physical documents.[2] The sources reviewed describe no route for minors.
Can foreigners use IT-Wallet?
Only with Italian documents. Activation needs CieID or SPID, and SPID requires an Italian identity document plus the health card or tax-code card.[2][18] Others need the document route.
How long does an IT-Wallet integration take?
None has been published, and Italy has no onboarding path for private relying parties yet. EU registration rules apply from 24 December 2026,[9] which is not an IT-Wallet opening date.
How can a business test IT-Wallet?
Private wallet providers can request the national test environment from IPZS.[4] A relying party can run its verifier against the EUDI conformance tests published with ARF v3.0.0.[10]
Sources
- Sistema IT-Wallet, Department for Digital Transformation, last updated 6 August 2026.
- IT-Wallet: tre documenti digitali su app IO per tutti i cittadini, IO, 4 December 2024.
- IT-Wallet supera quota 10 milioni di attivazioni, Department for Digital Transformation, 17 February 2026.
- The IT-Wallet System Opens Testing to Private Companies, IPZS press release, 23 July 2026 (roles, test environment, activation count).
- Overview of pre-notified and notified eID schemes under eIDAS, European Commission, updated 2 February 2026.
- Regulation (EU) 2024/1183 (eIDAS 2), EUR-Lex, Official Journal of 30 April 2024.
- Implementing Regulation (EU) 2024/2977, person identification data, EUR-Lex.
- Implementing Regulation (EU) 2026/1731, EUR-Lex.
- Implementing Regulation (EU) 2025/848, registration of wallet-relying parties, EUR-Lex.
- Architecture and Reference Framework v3.0.0, European Commission EUDI Wallet project, 23 July 2026.
- Legislative Decree 231/2007, Article 19, Normattiva.
- Regulation (EU) 2024/1624 (AMLR), Article 22, EUR-Lex.
- Final Report, draft RTS under Article 28(1) AMLR, AMLA, 30 September 2026.
- Delibera 96/25/CONS and Annex A, AGCOM, 8 April 2025.
- Comunicazione of 30 October 2025, AGCOM; the page hosts the list of services under Article 13-bis, version 5 of 29 September 2026.
- Commission releases enhanced second version of the age verification blueprint, European Commission, 10 October 2025.
- EU age verification solution, European Commission technical portal.
- Identità digitale, FAQ, AgID.
- Tutela minori, age verification, AGCOM.
See how wallets and national eIDs fit one onboarding flow on the EUDI Wallet page, and compare every national scheme on the eID verification page.
One workflow for Italian users and everyone else
Start with the document route and AML screening, and add Italian eIDs as they open to businesses.
Related articles
- Didit vs Unit21: KYC, KYB, AML and monitoring on one record
- Didit vs Trinsic: eID sign-in plus document checks, AML and KYB
- Didit vs Thomson Reuters: government databases plus the whole flow
- Didit vs Regula: hosted checks with full evidence, KYB and monitoring
- Top 10 AI compliance agents for KYC and AML review automation in 2026
- Top 5 Travel Rule compliance solutions for crypto businesses in 2026