Mobile-ID in Estonia and Lithuania: a guide for businesses

Last reviewed: 5 October 2026 · Not legal advice

Mobile-ID lets a customer in Estonia or Lithuania prove who they are with their phone number, their personal code and a PIN typed on the phone. For a business, a Mobile-ID login returns a signed name and personal code, at a level of assurance (LoA) of High.

We run Mobile-ID sign-ins next to Smart-ID.

What Mobile-ID is

Estonia's Information System Authority (RIA) describes it as "a mobile phone's SIM card with a public and secret key" that "functions as a document similar to the ID card". You need an ID card to apply, and Mobile-ID cannot encrypt documents.^[2] RIA calls the ID card and Mobile-ID "state-backed electronic identity solutions".^[1]

Adoption: how many people use Mobile-ID

Sources: RIA, SK ID Solutions citing Lithuania's regulator RRT.^[1][2][8]

Lithuania's figure counts certificates, not people, up from 457,117 at the end of 2024; we found no published count of Lithuanian users.^[8] In Estonia, Smart-ID has "a market share of nearly 60 percent" of authentications and the ID card "close to 23 percent", with Mobile-ID "making up the balance", according to ERR News (29 January 2026); no primary source gives its share of adults or monthly transactions.

What the user sees in a Mobile-ID login

Estonia's state login gateway TARA documents the flow: phone number and personal code, then a verification code that "must match the code shown on the mobile device", then PIN1.^[5]

TARA documents the steps, not the phone's screens; the phone screen above is an illustration. We found no QR or app-to-app variant as of 5 October 2026, so the steps are the same on any device. Smart-ID differs; see our Smart-ID integration guide.

What a business receives from Mobile-ID

TARA's identity token shows what an Estonian Mobile-ID login carries.^[5]

TARA issues phone_number "only" when Mobile-ID was used.^[5] The Lithuanian attribute set was not confirmed by a primary source as of 5 October 2026.

Mobile-ID level of assurance and legal standing

In Estonia, the Police and Border Guard Board issues the tools "in accordance with the Identity Documents Act".^[2] Lithuania notified only its national identity card.^[4]

Customer due diligence in Estonia

Estonia's anti-money laundering (AML) act, RahaPTS, lists the remote routes for credit and financial institutions.^[10]

§ 31(3)RahaPTS

"1) e-identimise süsteemi, millest on teatatud ... (EL) nr 910/2014 ... artikli 9 kohaselt ja mis vastab ... artikli 8 lõike 2 punktis b või c sätestatud usaldusväärsuse tasemele" ... "2) kvalifitseeritud usaldusteenust"

Source: Riigi Teataja, RahaPTS^[10]

In English: a notified eID scheme at Substantial or High, or a qualified trust service. Estonian Mobile-ID is in the notified scheme at High, so it matches point 1 on its wording.^[4][10] § 31(1) requires such a route (or a video tool meeting § 31(31)) for customers living outside the European Economic Area or sending over €15,000 a month (natural persons) or €25,000 (legal persons).^[10]

Customer due diligence in Lithuania

Lithuania's AML law, Article 11, allows remote identification with an EU-issued eID at High or Substantial, or with a qualified electronic signature backed by a qualified certificate, on condition that the person's identity was established when the means was issued.^[12] SK's summary of RRT's end-2025 data lists Mobile-ID certificates alongside the count of valid qualified e-signature certificates.^[8] Our reading is that this points to the signature route; confirm with counsel.

From 2027: AMLR Article 22(6)

The EU Anti-Money Laundering Regulation (AMLR, Regulation (EU) 2024/1624) applies from 10 July 2027.^[14]

Article 22(6)(b)Regulation (EU) 2024/1624

"the use of electronic identification means which meet the requirements of Regulation (EU) No 910/2014 with regard to the assurance levels 'substantial' or 'high' and relevant qualified trust services as set out in that Regulation."

Source: EUR-Lex, Regulation (EU) 2024/1624^[14]

The Anti-Money Laundering Authority (AMLA) sent final draft due diligence standards to the Commission on 30 September 2026; not law yet. Recital 11 says eID means count "regardless of whether they are notified under Article 9 [...] as long as they comply with the requirements of either 'substantial' or 'high' assurance levels", and "should be used wherever possible". A firm using document checks instead "shall be able to justify why".^[15] The EU Digital Identity Wallet is the other eID route; see our EUDI Wallet guide.

How a business connects to Mobile-ID

SK ID Solutions runs the Mobile-ID service for relying parties (RPs) in Lithuania and Estonia.^[6] The state gateway TARA is for public institutions: private firms may use it only for cross-border eIDAS logins.^[5]

Three ways to reach Mobile-ID; only the first two serve a private business at home.^[5][6]

What Mobile-ID costs a business

SK's Mobile-ID price list applies from 1 June 2026, priced per transaction with a monthly minimum.^[6] See the rates.

The two ends of SK's Mobile-ID price list.^[6]

We found no published Mobile-ID onboarding lead time as of 5 October 2026. The Smart-ID API guide covers SK's code side.

Use cases and sector rules

• KYC and AML onboarding. Know your customer (KYC) checks for banks and payment firms, under RahaPTS § 31 in Estonia and Article 11 in Lithuania.^[10][12]
• Gambling and age checks. Estonia's Gambling Act bars under-21s from games of chance and remote games of chance (§ 34(2)), and § 53(1) requires remote operators to verify every player's identity and record the personal code.^[11] Lithuanian operators must collect identity data before a remote gambling contract.^[13] Age follows from the signed date of birth; we found no age-only Mobile-ID claim.^[5]
• Signing. Mobile-ID signs as well as logs in, and RIA warns Estonian users that without a new SIM it "cannot be used for digital signing or authentication" from 19 May 2027.^[1]

For telecom, we found no Estonian or Lithuanian rule that names Mobile-ID for SIM registration.

Limits and fallbacks

• Foreigners and non-residents. Applying requires an Estonian ID card, so people without one cannot get Estonian Mobile-ID.^[2]
• Minors. Each operator sets "its own rules about issuing mobile-IDs, such as age limits".^[3] Smart-ID's FAQ sets 15 as the age for registering Smart-ID through Mobile-ID in Estonia.^[17]
• Number changes. A number that changes owner loses its Mobile-ID.^[3]
• SIM swap (Estonia only). Estonian users must replace their SIM before 19 May 2027.^[1] We found no confirmed deadline for Lithuanian SIMs as of 5 October 2026: mobile-id.lt prints the same date in a sentence about Estonian operators.^[9]
• Scams. RIA and mobile-id.lt warn of fake SIM-replacement calls and messages.^[1][9] In 2019, phished Mobile-ID logins were used to open Smart-ID accounts; since 1 July 2019 a code goes to the Mobile-ID device first.^[16]

1. 1 July 2019MitigationA code to the Mobile-ID phone guards new Smart-ID accounts.
2. 2 July 2022New name"Mobile-ID" replaces "Mobiil-ID" on the EU list.
3. Dec 2024High in LithuaniaRRT recognises Mobile-ID at High.
4. 19 May 2027Estonian SIM deadlineOld Estonian SIMs stop working.
5. 10 July 2027AMLR appliesArticle 22(6) names eID at Substantial or High.

Mobile-ID milestones that affect a relying party.^{[16][4][7][1][14]}

Keep a second route: a document check with chip (NFC, near-field communication) reading, liveness and a face match; see NFC chip verification.

eID first, document fallback. Recording the reason prepares you for the AMLA draft's justification rule.^[15]

Mobile-ID implementation checklist

• Check your national AML route with counsel.^[10][12]
• Choose a direct SK agreement or a provider that holds one.^[6]
• Collect the phone number and personal code in your form.^[5]
• Tell Estonian users about the 19 May 2027 SIM swap.^[1]
• Build the document fallback.
• Record the level of assurance and the reason for each fallback.

How Didit helps with Mobile-ID

Mobile-ID is live on Didit for eID verification in Estonia and Lithuania, next to Smart-ID, MitID, BankID Sweden and the Finnish Trust Network, with a document route in the same workflow. You need no SK agreement of your own.

In the console, go to Workflows, the ID Verification step, Countries, pick Estonia or Lithuania, and tick Mobile-ID under "Wallets accepted"; by API, set methods.EST.wallet or methods.LTU.wallet. The user enters their Mobile-ID phone number and approves a comparison code on the phone. Didit never asks for the PIN.

A sign-in returns the full name, date of birth, the Baltic personal code, the level of assurance (Didit's own label: High) and a signature check. No address, no portrait. Results arrive by webhook or API, per the digital ID wallets docs.^[18]

Others fall back to document verification with NFC chip reading ($0.15), liveness and face match; the full KYC check is $0.33. Add AML screening at $0.20. Only completed eID sign-ins are billed; Mobile-ID costs $0.20 (pricing page) and every eID is on the digital ID wallets page.

Frequently asked questions

Sources

1. Mobile-ID users must replace their SIM card to keep using the service, id.ee (RIA), 6 August 2026.
2. Electronic identity (eID), Information System Authority (RIA).
3. Applying for and activating Mobile-ID, id.ee (RIA).
4. Overview of pre-notified and notified eID schemes under eIDAS, European Commission, read 5 October 2026.
5. TARA technical specification, RIA.
6. Price list, SK ID Solutions, valid from 1 June 2026.
7. Smart-ID and Mobile-ID recognized as state-approved tools in Lithuania, SK ID Solutions, 19 December 2024.
8. SK ID Solutions issued almost three million certificates in Lithuania in 2025, SK ID Solutions citing RRT, 7 May 2026.
9. Mobile-ID, mobile-id.lt.
10. Rahapesu ja terrorismi rahastamise tõkestamise seadus (RahaPTS), § 31, Riigi Teataja.
11. Hasartmänguseadus (Gambling Act), § 34 and § 53, Riigi Teataja.
12. Pinigų plovimo ir teroristų finansavimo prevencijos įstatymas, Article 11, consolidated text, INFOLEX.
13. Dažniausiai užduodami klausimai (frequently asked questions), Lithuanian Gambling Supervisory Authority.
14. Regulation (EU) 2024/1624 (AMLR), EUR-Lex, Official Journal of 19 June 2024.
15. Final Report, draft RTS under Article 28(1) AMLR, AMLA, 30 September 2026.
16. It is more difficult for criminals to create Smart-ID accounts behind people's backs, id.ee (RIA), 20 March 2020.
17. Age limitations for using Smart-ID, Smart-ID help.
18. Digital ID wallets, Didit documentation.

New to the topic: read what eID verification is, the eID schemes by country, eID verification in Latvia, and our eID verification page.