Verifiable Credential

A verifiable credential is a set of statements that an issuer makes about a person, an organisation or a thing, packaged with a cryptographic proof so that someone else can check it. The statements are called claims. That a person holds a law degree is a claim. That a person may sign for a company is another. The proof, usually a digital signature, lets whoever receives the credential confirm two things for themselves. It shows which body issued the credential. It shows that nothing has been changed since.

The term comes from the technical community. The World Wide Web Consortium (W3C) publishes the Verifiable Credentials Data Model, a standard that describes how such a credential is structured.

A scanned diploma shows what the diploma says. To know whether it is genuine, the reader has to contact the university. A verifiable credential carries the means of checking inside it, so software can do the check. The person it describes keeps it and decides who sees it.

Three parties are involved, and the credential passes from the first to the second to the third. The issuer creates the credential and signs it. The holder receives it, stores it in a digital wallet and chooses when to present it. The verifier receives the presentation, checks the proof and decides whether to rely on what the credential says.

Take a hypothetical case. A bar association issues a credential stating that a lawyer is admitted to practise. The lawyer keeps it in a wallet on a phone. A bank that is opening a client account for the lawyer's firm asks for proof of admission. The lawyer presents the credential. The bank's software checks the bar association's signature and the validity period, then accepts it.

Two features of this pattern differ from the way such checks are done today. The verifier does not need to ask the issuer whether the content is genuine. At most it looks up whether the credential has been revoked. The issuer, in turn, does not need to learn where the credential was used.

One question is left open by the technology. The proof shows which issuer signed. It does not show that the issuer was entitled to make the statement, or what the statement is worth in law. Rules about who may issue what, and with what effect, have to come from somewhere else. In the EU they come from the eIDAS Regulation.

It calls it an electronic attestation of attributes. The phrase verifiable credential does not appear in the regulation. Article 3(44) of the eIDAS Regulation defines an electronic attestation of attributes as an attestation in electronic form that allows attributes to be authenticated. An attribute is a characteristic, quality, right or permission of a natural or legal person or of an object (Article 3(43)). These definitions were added in 2024 by Regulation (EU) 2024/1183.

The two vocabularies describe the same pattern from different sides. The table sets the technical terms beside the legal ones.

The match is close, not exact. The W3C standard describes a data format. The regulation describes legal categories and does not name a format. It leaves the reference standards and specifications to Commission implementing acts. So a credential in the W3C format is not automatically a qualified attestation, and an attestation under eIDAS does not have to use the W3C format. When a contract or a policy says verifiable credential, it is worth asking which legal category is meant.

The effect depends on which of three categories the credential falls into. Article 45b sets a floor for all of them and a stronger rule for two.

The floor is non-discrimination. An electronic attestation of attributes may not be denied legal effect or admissibility as evidence in legal proceedings on the sole ground that it is in electronic form, or that it is not qualified.

The stronger rule is equivalence with paper. A qualified electronic attestation of attributes has the same legal effect as a lawfully issued attestation in paper form. So does an attestation issued by, or on behalf of, a public sector body responsible for an authentic source. The table compares the three.

Cross-border recognition comes from Article 24a(9) for qualified attestations and from Article 45b(3) for those from public bodies. Equivalence with paper has a limit. The electronic attestation is worth what the paper one would be worth. What a paper diploma or a paper extract proves, and to whom, remains a matter for the law that governs that document.

It must contain the nine items listed in Annex V of the eIDAS Regulation, and a qualified trust service provider must have issued it (Article 3(45)). The first item is an indication that the attestation was issued as a qualified one, in a form suitable for automated processing. The next items identify the parties: data that unambiguously represents the issuing provider, including its member state, and data that unambiguously represents the entity the attributes refer to. If a pseudonym is used, that must be clearly indicated.

Then comes the substance: the attested attribute or attributes, the beginning and end of the period of validity, and an identity code that is unique for that provider. The last three items make the attestation checkable. It carries the qualified electronic signature or qualified electronic seal of the provider. It gives the location where the certificate supporting that signature or seal is available free of charge. It says where the validity status of the attestation can be checked.

Nothing may be added to the list. Qualified attestations are not subject to any mandatory requirement beyond Annex V (Article 45d(3)).

The provider has to check before it issues. It must verify the identity of the person who receives the attestation and, where applicable, the specific attributes (Article 24(1)). Article 24(1b) lists the ways attributes may be verified. They include a European Digital Identity Wallet, another qualified attestation, and other methods that give a high level of confidence and that a conformity assessment body has confirmed.

Revocation is final. A qualified attestation that has been revoked loses its validity from that moment, and its status cannot be reverted (Article 45d(4)).

They come from an authentic source where one exists. Article 3(47) defines an authentic source as a repository or system, held under the responsibility of a public sector body or a private entity, that is considered a primary source of information about a person or an object, or is recognised as authentic under Union or national law. A population register is one example. A company register is another.

A public body that keeps such a source may issue attestations itself. A qualified trust service provider may also issue them, after checking the attribute at the source. Article 45e obliges member states to make that check possible by electronic means, at the request of the user, for a minimum list of attributes that rely on public sector sources. The period is 24 months from the entry into force of the implementing acts for the European Digital Identity Wallet.

Annex VI holds the list. It covers address, age, gender, civil status, family composition, and nationality or citizenship. It covers educational and professional qualifications, titles and licences. It covers powers and mandates to represent natural or legal persons, and public permits and licences. For legal persons it covers financial and company data.

The last few entries are the ones a professional firm handles most. Today a firm that needs to know whether a director may sign for a company asks for a register extract or a power of attorney and reads it. Under this model the director could present an attestation of the mandate, verified against the register, and the firm's software could check it. Whether such an attestation is enough for a given transaction still depends on the national rules for that transaction.

The wallet is where the holder keeps attestations and the tool for presenting them. Article 45g requires providers of electronic attestations of attributes to let wallet users request, obtain, store and manage an attestation, irrespective of the member state where the wallet is provided. Qualified providers must offer an interface with the wallets. Public bodies that issue attestations must do the same (Article 45f(8)).

On presentation, the wallet must make selective disclosure possible (Article 5a(4)(a)). A holder can show that they hold a licence without showing their address. The relying party is responsible for authenticating and validating what it receives (Article 5b(9)).

The regulation also limits what the issuer learns. The wallet may not give providers of attestations any information about the use of those attestations (Article 5a(5)(b)). Providers may not combine personal data from the attestation service with personal data from their other services or those of commercial partners, and must keep it logically separate. A provider of qualified attestations must run that service in a manner that is functionally separate from its other services (Article 45h).