Signicat Consolidates Five eIDAS Audit Bodies Under TÜV Austria

Signicat named TÜV Austria on October 20 as the sole body auditing its eIDAS 2.0 compliance, replacing five assessors the Norwegian digital identity vendor inherited through eight acquisitions.

The appointment covers all of Signicat’s eIDAS-related audits, according to the company’s announcement. Until now, five separate certification bodies assessed different parts of the business.

For banks, insurers and other regulated firms that use Signicat for identity checks and electronic signatures, the change means one assessor’s view of the supplier instead of five. That bears on third-party due diligence files, on supplier oversight under the EU’s Digital Operational Resilience Act and on how the vendor is certified as the EU Digital Identity Wallet rolls out.

Why eIDAS 2.0 compliance drove the switch

Signicat’s acquisitions, including the UK’s Sphonic in 2022, left it with assessments split across bodies in different European jurisdictions. Each audit had its own scope, schedule and report.

The company ran a request for information among its existing conformity assessment bodies before choosing. Conformity assessment is the independent check that a trust service provider meets the legal requirements for the service it offers. Jon Ølnes, VP of Digital Identity and Regulation at Signicat, described the outcome of the process.

“We decided to run an RFI among the CABs and TÜV Austria had the best solutions and services to consolidate the situation and for the changes ahead as EUDI Wallets are introduced across Europe.”

Jon Ølnes, VP of Digital Identity and Regulation, Signicat

Clemens Wanko, Head of the Accredited Conformity Assessment Body (eIDAS) at TÜV Austria, said that “organisations require assurance frameworks that are both robust and scalable.” He tied the decision to the growing maturity of the European digital identity market and to adoption of eIDAS 2.0.

TÜV Austria already assesses Signicat’s identity proofing service. That gives the auditor a baseline of the company’s technical environment before the wider scope is added.

What the eIDAS 2.0 rules require of auditors

eIDAS 2.0 is Regulation (EU) 2024/1183, which amends the 2014 eIDAS Regulation. It entered into force in May 2024. It requires every Member State to offer citizens an EU Digital Identity Wallet, and the European Commission says that deadline falls at the end of 2026, according to its digital identity regulation page.

The regulation also keeps the audit cycle for qualified trust service providers. Under Article 20, a qualified provider must submit a conformity assessment report from an accredited body at least every 24 months. National supervisory bodies, such as RTR in Austria, then decide on qualified status and oversee providers.

That structure explains why audit scope matters. A supplier with five assessors has five reports, five sets of findings and five renewal calendars to keep aligned with its supervisor. A supplier with one has a single set.

Signicat said a single body also lets it combine eIDAS assessments with other certifications such as ISO 27001 and SOC 2. TÜV Austria publishes its own conformity assessment and certification offer for electronic ID services and trust service providers.

Which services and entities are covered

The announcement does not list the individual trust services or legal entities that move to TÜV Austria. Trust services under eIDAS include qualified electronic signatures, electronic seals, timestamps and electronic ID schemes, and the release names only identity proofing as already assessed by the new auditor.

It also gives no dates for the transition. Signicat said the move will be phased so that services stay continuously compliant, meaning no service should be left without a valid assessment while reports change hands.

Compliance teams that hold Signicat’s current certificates and audit reports will need to track which body covers which service until the phased move is complete. The bank-ready vendor pack from RegTech Post sets out the supplier documents a bank typically keeps on file for that purpose.

What it means for bank KYC and onboarding

Banks use digital identity suppliers for remote onboarding, ID document checks and signing. Those checks sit inside the customer due diligence process, so a gap in the supplier’s certification becomes the bank’s problem.

Identity proofing is the service most directly tied to KYC. Because TÜV Austria already assesses that service, the audit relationship for the part of Signicat’s catalogue closest to onboarding is not new. How the rest of the catalogue moves will determine how much documentation banks need to refresh. RegTech Post has covered how biometric KYC has matured and how banks handle global KYC requirements with technology.

The change also lands in third-party risk files. The Digital Operational Resilience Act (DORA) has applied since January 17, 2025. It requires financial entities to manage the risk of their ICT suppliers, keep a register of those arrangements and assess critical providers more closely. A supplier whose eIDAS 2.0 compliance is evidenced by one auditor gives a bank one body to ask about scope, findings and remediation.

A single auditor does not replace the bank’s own due diligence. An assessment report covers what the body examined, and a bank still decides how that evidence maps to its own controls and risk appetite.

Wider market for eIDAS 2.0 compliance

The wallet rules reach well beyond banking. Public-sector and cross-border services will draw on the same trust infrastructure, and each Member State’s supervisory body will oversee its own providers. Vendors that serve several countries face the same question Signicat did: how many assessors it takes to cover one product line.

Signicat’s route was consolidation after acquisitions. Others in the identity market, including the KYC providers that sell to banks, will face similar choices as they add wallet verification to their products. The European Commission has set a target of 80% of EU citizens using a digital identity wallet by 2030, a figure that raises the volume of identity checks that rely on audited trust services.

Buyers assessing AI-assisted identity tools have a related set of questions, covered in RegTech Post’s AI vendor due diligence template pack.

What comes next for Signicat and its customers

The next marker is the end of 2026, when Member States must have EU Digital Identity Wallets available to citizens. Signicat has said the transition to TÜV Austria will run in phases and has not published a completion date.

Customers can ask the vendor which of its trust services are assessed by which body at each stage, and when the last of the five earlier assessments lapses.