Qualified Electronic Attestations of Attributes (QEAA)

What is Qualified Electronic Attestations of Attributes (QEAA)?

Qualified Electronic Attestations of Attributes (QEAA) are secure, legally recognised digital credentials that verify specific attributes, characteristics, or entitlements of a person or organisation in electronic form. Examples include a person’s address, tax identification number, professional qualification, age, or authorisation to act on behalf of another person or organisation.

A QEAA is issued by a Qualified Trust Service Provider (QTSP) in accordance with the EU eIDAS Regulation, including eIDAS 2.0. Because it is qualified, it provides a high level of assurance, integrity and evidential value. Under eIDAS, QEAAs have legal effect across the European Union and are designed to provide an equivalent level of trust to relevant paper-based attestations carrying an official seal.

QEAAs verify a particular attribute rather than automatically disclosing a person’s complete identity record. This supports selective disclosure: users can share the information required for a specific transaction without unnecessarily sharing additional personal data. QEAAs can be used with an EUDI Wallet, but they can also support digital verification journeys outside the wallet, depending on the provider’s implementation and the relying party’s integration.

In simple terms, a QEAA is a qualified way to prove that a specific fact about a person or organisation is true. It is similar in principle to how a Qualified Electronic Signature (QES) gives a digital signature the legal effect of a handwritten signature: a QEAA applies qualified trust to an attribute or claim.

What does PID mean?

Personal Identification Data (PID) is the core identity information used to identify a person or organisation, such as their birth name, given name, date of birth, or unique identifier. In the EUDI ecosystem, PID is the foundation of a digital identity. However, PID does not necessarily contain every attribute an organisation may need for a specific transaction. Depending on the country and identity scheme, information such as a residential address, tax identification number, or personal administrative number may need to be obtained separately.

What is the difference between a QEAA, an EAA, and PID?

Under eIDAS 2.0, several types of digital credentials can be used to identify a person or organisation or prove specific attributes about them. While they may serve similar purposes, they differ in what they prove, who can issue them and the level of assurance and legal recognition they provide.

Acronym	Full Name	Issuer	Key Characteristics	Use Cases
PID	Personal Identification Data	National governments (or entities officially designated by member states)	Core identity data to identify a person or organisation; does not necessarily include all attributes needed for onboarding or eligibility decisions	General identity identification
EAA	Electronic Attestation of Attributes	Authorised public or private issuer	Digital attestation confirming a specific attribute; applicable to both regulated and non-regulated journeys	Mostly digital journeys (regulated & non-regulated)
QEAA	Qualified Electronic Attestation of Attributes	QTSP (Qualified Trust Service Provider)	Qualified form of EAA; issued in accordance with eIDAS requirements; provides enhanced assurance, integrity, and evidential value	Higher-trust and regulated use cases
Pub-EAA	Public-sector Electronic Attestation of Attributes	Public-sector body or responsible authority connected to an authentic source	Legal status and use depend on the applicable eIDAS framework and national implementation	Public-sector / nationally defined use cases

Note on terminology: IDnow distinguishes between attributes (the individual pieces of information being verified) and digital credentials (the digital proof used to attest to them). In regulatory and compliance contexts, we use the precise eIDAS terminology, such as QEAA and EAA. In broader or international contexts, we may refer to these more generally as qualified or verified digital credentials, where this terminology is more widely understood.

How do QEAAs work?

A typical QEAA process includes the following steps:

1. The required attribute is identified. For example, a bank may need to verify a customer’s residential address or tax identification number.
2. The customer or organisation is identified and authenticated. The assurance level and verification method depend on the attribute and use case.
3. The QTSP verifies the attribute against an appropriate source or supporting evidence. This may include a public register, an authorised database, an identity document, or another reliable source.
4. A QTSP issues the QEAA. The attestation is cryptographically secured using a qualified electronic signature (QES) or qualified electronic seal (QSeal), ensuring that its origin, authenticity, and integrity can be independently verified.
5. The relying party verifies and uses the attribute. The recipient can check whether the attestation is authentic, valid, and unaltered before using it in an onboarding, compliance, or decision-making process.

Did you know? QEAAs may be delivered through an EUDI Wallet or through other digitally integrated channels. For example, depending on the implementation, a provider may deliver a machine-readable QEAA through an API or JSON-based workflow for direct use within an organisation’s existing systems. IDnow supports QEAA issuance and delivery both outside and as part of the EUDI Wallet, enabling organisations to integrate qualified attestations directly into their existing digital onboarding and compliance workflows.

What are the benefits of QEAAs for organisations?

• Verify specific attributes without collecting unnecessary personal data. Selective disclosure reduces the amount of personal information shared during a transaction, supporting privacy and data minimisation requirements.
• Meet AMLR and KYC obligations. QEAAs provide qualified, auditable evidence of the customer data required under AMLR, helping organisations stay compliant when attributes such as residential address, tax identification number, or personal administrative number are not available via national eID or PID.
• Reduce manual document handling. Digitally issued attestations reduce repeated requests for paper certificates, uploaded documents and manual verification checks, improving operational efficiency and customer experience.
• Strengthen fraud prevention. Cryptographically secured attestations make tampering easier to detect and provide stronger, verifiable evidence of origin, reducing identity fraud risk.
• Improve cross-border verification. QEAAs are based on the EU trust-services framework and support trusted digital transactions across all 27 Member States, simplifying cross-border onboarding and compliance.
• Create reusable verification evidence. A qualified attestation can be reused across multiple interactions and relying parties, reducing repeated verification requests and improving user experience, provided the attribute remains valid and the relying party accepts the credential.

How do QEAAs support AMLR compliance?

The EU Anti-Money Laundering Regulation (AMLR) requires obliged entities, including banks, gaming & gambling platforms, insurance companies and other regulated financial institutions, to collect and verify specified customer information as part of customer due diligence. Under AMLR, organisations must obtain identity information and residential address (mandatory), as well as tax identification number (where available) and personal administrative number (where applicable).

AMLR does not require organisations to use QEAA specifically. The compliance obligation concerns obtaining and verifying the required data at the appropriate level of assurance. However, a QEAA can provide a qualified, digitally verifiable way to obtain attributes that are not consistently included in national PID or eID schemes.

This makes QEAA particularly relevant for:

• Customer onboarding and KYC
• Address verification and KYC refreshes
• Tax identification number collection
• Personal administrative number verification, where applicable
• Cross-border customer due diligence
• Fraud-resistant account opening and servicing

QEAAs and the EUDI Wallet

QEAAs are an important part of the wider eIDAS 2.0 and European Digital Identity Wallet ecosystem. They can supplement PID by allowing users to store and share additional verified attributes, such as proof of address, professional qualifications, or eligibility.

The EUDI Wallet is expected to become an important channel for storing and sharing digital identity data and attestations. However, QEAA services do not have to be wallet-only: depending on the provider and integration, qualified attestations can also support digital workflows outside the EUDI Wallet.

What is the difference between a QEAA and a digital certificate?

A digital certificate is a broad term for an electronic certificate used for purposes such as authentication, encryption, signing, or sealing. A QEAA is a specific type of qualified electronic attestation under eIDAS that confirms an attribute about a person or organisation. Its purpose is not necessarily to identify the user in full, but to provide trusted evidence of a particular fact or entitlement.

What are examples of QEAA use cases?

QEAAs can be used wherever an organisation needs trusted, digitally verifiable evidence of a specific attribute. Examples include:

• Financial services: Verifying address, tax identification number, or personal administrative number during customer onboarding.
• Attribute-based lending: Using qualified income or tax-related attributes to support credit eligibility and lending decisions.
• Insurance: Verifying address, eligibility or other attributes required for policy administration and risk assessment.
• Professional services: Confirming professional qualifications, licences or authority to act on behalf of a person or organisation.
• Healthcare and public services: Supporting trusted evidence of eligibility, authorisation, or other regulated attributes.
• Mobility and age-restricted services: Verifying driving entitlement, age or other eligibility attributes where appropriate.

How can IDnow help with QEAAs?

IDnow combines identity verification and qualified trust services through the IDnow Trust Platform. This enables organisations to verify identity, proof relevant attributes, and use qualified trust services through a single integration, subject to the applicable product scope and regulatory requirements.

IDnow’s QEAA offering is designed to support flexible attribute proofing and can provide qualified attestations through digitally integrated workflows, including delivery outside the EUDI Wallet. This helps regulated financial institutions address attribute gaps in existing onboarding processes while preparing for the broader eIDAS 2.0 and EUDI ecosystem.

IDnow also supports Electronic Attestations of Attributes (EAA) for suitable non-regulated and lower-assurance use cases, where a qualified attestation may not be necessary.

---

FAQs about Qualified Electronic Attestation of Attributes