Attestation provider is the ARF’s collective name for anyone who issues electronic attestations of attributes into a wallet: qualified trust service providers issuing QEAAs, public sector bodies issuing PuB-EAAs, and other organisations issuing non-qualified EAAs.
ARF termReviewed 7 October 2026
On the issuer side, where data is put into the wallet.
Issuer
Signs credentials: a member state, university, bank or employer
Issuance
EUDI Wallet
Belongs to the user, who decides what to share
Presentation
Relying party
The service that requests and checks the data
Trust layer: who is allowed to sign, and is it still valid?
Rules: the law and technical framework behind it all
The three kinds differ in legal weight, not in mechanics. All of them issue into the user’s wallet unit over OpenID4VCI. QEAAs and PuB-EAAs, issued by or on behalf of a public body responsible for an authentic source, have the same legal effect as lawfully issued paper attestations. A non-qualified EAA can come from any organisation, such as an employer, a university or a bank, and its weight depends on whether the relying party trusts the issuer.
Before issuing, the provider checks that it is talking to a genuine wallet using the Wallet Unit Attestation, and binds the attestation to a key held by that wallet unit. It also publishes revocation status, usually through a status list, so verifiers can check validity without contacting it.
Defined in
Regulation (EU) 2024/1183 Art. 45b to 45f; ARF Annex 1
If your organisation already holds facts other people need to prove, such as a licence, a membership or a qualification, you can become an attestation provider and issue them into wallets.
Build with it: Authbound documentation →
Authbound handles the protocols, formats, trust lists and revocation checks behind these terms. See what people build with them.
