Many participants, one shared infrastructure
RO Wallet is more than an app on your phone. For it to be useful in everyday life, several players work together behind the scenes: authorities that issue documents, public and private service providers that need to verify data or attestations, and those who keep everything running. Even though several roles operate behind the scenes, for you it all stays one simple app.
Who are the participants
Each one has a clear role - from who issues a document to who verifies it. The roles below are defined at European level, so you'll find them, in the same form, in every Member State.
The user
The individual who owns and uses the wallet (EUDI Wallet) to manage their digital identity and attributes. In Romania: citizens or residents with a compatible phone. You are effectively the wallet's boss: no one can issue, verify or share anything without your action and consent.
The identity provider (PID Provider)
Issues the Person Identification Data (PID) after you authenticate at a high level of assurance (LoA High). In Romania: the Ministry of Internal Affairs, through the Directorate-General for Population Records. The identity data is the foundation of the wallet: the other documents and attestations are added on top of it later.
Ministry of Internal Affairs - Directorate-General for Population Records
The attestation provider (Attestation Provider, QTSP/TSP)
Issues qualified (QEAA) or non-qualified (EAA) attestations about your attributes - for example your age, the driving licence on your phone (mDL), a diploma, a certificate or your student status. This role can be carried out by public authorities and institutions, as well as accredited private organisations such as banks, universities or other trust service providers.
The relying party (Relying Party / Verifier)
Requests and verifies the data you present, on a legal or contractual basis. In Romania: e-government services, banks, online shops. A relying party may only ask for the data it genuinely needs for that service - and must state up front what it's for.
The wallet provider (EUDI Wallet Provider)
We all use the same app, RO Wallet, made available by the wallet provider. Technical documentation and open-source code samples are published for relying parties, so they can verify the attestations received from the wallet within their own systems. In Romania: the Ministry of Internal Affairs, through the Directorate-General for Communications and Information Technology, alongside providers certified by the Member States, public or private. The wallet provider doesn't see what documents you keep in the app or what you share: its job is to deliver a secure app, not to monitor your activity.
Ministry of Internal Affairs - Directorate-General for Communications and Information Technology, certified providers from Member States (public or private)
The Access Certificate Authority (ACA)
Issues access certificates to issuers (the PID provider, providers of qualified QEAA attestations, Pub-EAA and non-qualified attestations) and to the relying parties in the ecosystem. It is separate from the provider of the List of Trusted Entities (LoTE) and may be operated by a different entity, covering both qualified and non-qualified roles. Through these certificates, your wallet can tell it's dealing with a real, authorised entity rather than an impostor - an extra layer of protection against fraud.
Special Telecommunications Service, acting as certificate authority
The Trusted List Provider (TLP)
Maintains and publishes the national lists of trusted providers. There may be separate TLPs for qualified entities (QTSPs - the providers of QEAAs), published by each Member State. In Romania: the Authority for the Digitalisation of Romania is the national supervisory body that publishes the trusted lists for qualified providers. The trusted lists are public, so anyone can check whether an entity is really entitled to issue or request data.
The registry of providers and relying parties
The entity that builds and maintains the register of all entities in the ecosystem: providers of Person Identification Data (PID), of qualified (QEAA) and non-qualified (EAA) attestations, of attestations issued by public bodies based on an authentic source (Pub-EAA), as well as the relying parties that use the European Digital Identity Wallets. In Romania: the Special Telecommunications Service manages the National Register of Wallet Relying Parties (RNBP). The registry brings transparency to the ecosystem: it's always clear who is part of it and in what capacity.
Special Telecommunications Service acts as developer, administrator, maintainer and support provider for the registry.
