Digital Identity Wallets, Payments & Regulation: Key Insights | SPA Newsletter – January 2026
Dear SPA Members and Industry Colleagues,
As we welcome 2026, we reflect on a busy and productive 2025 and look forward to advancing our efforts in the new year. The past year has seen significant progress across key areas critical to the future of payment security and innovation. Here is an update on our main topics, what has been achieved, and what lies ahead.
Digital Identity Wallet for Payments
We concluded 2025 with the publication of a paper in partnership with the Secure Identity Alliance (SIA), examining how the EUDI Wallet could interact with Europe’s payments ecosystem — and what it will take to make that work. Download paper here.
The topic was subject of a round table discussion at Trustech 2025 in Paris in which Alain Martin represented the SPA. While we have already received a lot of positive comments, we further encourage all participants of the payments ecosystem to share additional thoughts to further refine this paper.
Biometric Cards
In 2025, the SPA Biometric Payment Card Working Group has been diligently finalizing the standardisation of the interface between an external enrolment device and the Biometric Payment Card in contact and contactless modes. We anticipate that 2026 will see the formal introduction and promotion of this important standard in payment card technology.
Instant Payments at the Point of Sale
SPA made a substantial contribution to the report of the EU DG-FISMA PSMEG (Payment Systems Market Expert Group)’s Instant payments at PoS Subgroup. Our efforts focused on removing barriers to the deployment of instant payments at the point of sale in Europe, advocating for the use of the EMVCo contactless protocol and of existing European kernels in terminals.
The EPSG Volume is now open for public consultation, with a strong and substantive contribution from SPA aimed at removing barriers to the deployment of instant payments at the point of sale, in line with our proposals to the PSMEG.
We invite the wider payments industry to actively participate in this public consultation, especially in the instant payments section, as a key step towards building a standardized and interoperable instant payments ecosystem.
Regulatory Updates: Cyber Resilience Act (CRA), DORA, and NIS2
SPA is extremely concerned with the duplication of efforts due to the Cyber Resilience Act mandating a new EU certification for payment smart cards, while existing certifications completely fulfil the CRA requirements. This would result in additional cost, efforts and complexities without effectively improving security for end users. SPA continues to engage with regulators and industry stakeholders on the Cyber Resilience Act, emphasizing the importance of pragmatism and advocating that existing certification frameworks for payment cards should suffice to comply. We are actively working with CEN/CENELEC and EPSG to convince regulators of this position and call for a collaborative discussion among all stakeholders to align certification efforts with CRA.
Regarding DORA and NIS2, progress has been steady, and we expect further developments in 2026 that will complete SPA’s regulatory evaluations and ensure compliance. SPA plans to update its views about NIS2 in 2026.
Post-Quantum Cryptography (PQC) Migration
Recognizing the evolving threat landscape, SPA has successfully initiated and will lead a task force within EPSG focused on post-quantum cryptography migration. This task force aims at developing a common industry position and removing technical barriers to ensure the sustainability and security of payment solutions in a post-quantum world. This initiative will be a key focus throughout 2026.
Offline Transactions and Cyber Resilience
Building on our commitment to resilience, SPA is preparing an updated position paper on offline payment use cases. This paper will highlight the critical role of offline transactions in maintaining payment functionality during power outages and other disruptions, reinforcing the resilience of payment systems against cyber threats and infrastructure vulnerabilities.
ESG Initiatives and Accessibility
Together with a number of other parties, SPA has actively participated in “Purchasing 2030”, a recent initiative by French banking group BPCE to estimate and reduce the carbon footprint of payment cards throughout their life cycle.
Regarding the recently issued EU accessibility law, SPA is reinforcing its commitment to inclusivity and sustainability when providing and using payment technologies. In a position paper, guidance is provided how SPA members can support financial institutions to comply with their legal duties.
Looking Ahead: Consolidation and Security at the Core
2026 will be a year of consolidation, building on the solid foundation laid in 2024 and 2025. Our focus will remain on security, resilience, and innovation, with particular emphasis on:
- Advancing the biometric card enrolment standard
- Supporting instant payment adoption and standardization
- Leading the industry in post-quantum cryptography migration
- Enhancing offline payment resilience
- Engaging with regulatory frameworks pragmatically and proactively
- Promoting ESG and accessibility initiatives
We thank you for your continued support and collaboration. Together, we will navigate the complexities of the payments landscape and drive forward a secure, resilient, and innovative future.
Wishing you all a prosperous and successful New Year!
Warm regards,
Andreas Strobel
President, SPA
