Issuer-controlled Key Attestation and TS3 Wallet Unit Attestation - with a credential definition, an issuer can now require Key Attestation and specify the exact assurance level for key storage and user authentication, in line with ISO/IEC 18045:2022
Wallet Provider backend - TS3 wallet unit attestation and an evidence-based Key Attestation issuance model as per the EUDI ARF TS3 v1.5 data model, pairing a Wallet Instance Attestation with a Key Attestation
Selective disclosure for nested objects and array elements - when a credential definition marks both a parent object and its fields as selectively disclosable, the issued credential carries recursive disclosures as per SD-JWT (RFC 9901)
Structured validity for Legal Person Identification Data - LPID attestations now return a structured validity result on credential and verification reads
Purpose-built attestation for Age Verification - the Age Verification extension requests the purpose-built age-verification attestation by default, a data-minimising choice expressed in Digital Credentials Query Language (DCQL) as per OpenID4VP 1.0
Live status tracking and platform maintenance - live status tracking in issuance and verification history is more reliable, newly created signing keys are ordered correctly, and the platform's dependencies and packaging have been modernised
Hardware-backed wallet and key attestation - the wallet now presents a Wallet Unit Attestation (WUA) together with a wallet-provider-signed Key Attestation, as per EUDI ARF TS3 v1.5
TS3 WUA data model - the Data Wallet and its OpenID4VC SDK now model the WUA to the EUDI ARF TS3 v1.5 data model, pairing a Wallet Instance Attestation (WIA) with a Key Attestation
Trust and origin checks on the DC API - requests must be signed, and the verifier must be verified against the OWS trust list before credential sharing
Native user-interface migration - a single native toolkit on each platform, Jetpack Compose on Android and SwiftUI on iOS, with the issuance, verification, payment, and settings screens migrated
Strong Customer Authentication for IBAN account payments - Strong Customer Authentication (SCA) now recognises the Strong User Authentication (SUA) IBAN account-payment credential under EUDI ARF TS12, and on iOS the payment confirmation screen shows a recurring payment schedule and covers account payment, e-mandate, and Qualified Electronic Signature Access Credential (QESAC) flows
More robust proof-of-possession - proof-of-possession now holds across deferred issuance, concurrent flows, and app restarts, following DPoP (RFC 9449)
Browser-based authorisation - RFC 8252 OAuth 2.0 support for smoother sign-in, more reliable multi-credential issuance, and consistent trust indicators from the first passwordless login
Data Agreement Policy for all verifications - Data Agreement Policy details are also available for ordinary, non-TS12 verification transactions on iOS and Android, so users can see the data agreement and its policy for any verification
Qualified electronic signing through the CSC v2.2.0 API - qualified and remote signing through Qualified Trust Service Providers now works with either CSC 1.0.4.0 or 2.2.0.0, selected per organisation in the QTSP secure vault
Trusted-list validation aligned with ETSI TS 119 602 - validation now runs against a remote lookup service instead of parsing trusted-list files within the verifier
Direct identity matching for Passwordless Login - operators can now choose an identity-resolution method in the dashboard, resolve the subject directly from a presented credential, and select a claim
Consistent transaction data handling - a schema-driven form now validates TS12 Strong Customer Authentication data for payments, e-mandates, and qualified electronic signatures in the dynamic credential request flow, and non-TS12 Passwordless Login transaction data is now accepted during issuance
Annex C and Digital Credentials API refinements - sandbox organisations can now attach the reader certificate chain when signing Annex C of ISO 18013-7 (ReaderAuth)
Privacy-by-design guidance for verifiers - the Age Verification extension now warns when the holder's exact date of birth is exposed and recommends selective disclosure in line with the GDPR data-minimisation principle
Verification and issuance correctness - SD-JWT PID array claims, including nationalities, now display correctly; verification QR codes and deep links preserve characters such as &, <, and >; and deferred Pre-Authorised credentials can be issued
Trusted-list validation aligned with ETSI - the wallet can now run checks against a remote lookup service and evaluate the certificate chain against the ETSI TS 119 602 and ETSI TS 119 612 trusted lists
Trust checks gate issuance and verification - trust checks complete before the exchange screen appears on both iOS and Android
Capability, standing, and credential scope evaluation - each party is evaluated for its specific role, its current standing based on trust lists, and, where permitted, the exact credential type in play, matched by standards
Native UI on modern native stacks - SwiftUI runs on a single, consistent, more maintainable UI foundation across platforms
Sturdier handling of ISO 18013-5 mdoc credentials - CBOR and COSE checks cleanly reject broken credentials rather than bringing the wallet down
Simpler, more compatible OpenID4VCI issuance - the redundant client assertion has been removed from the token request on iOS and Android; Android retains wallet-attestation client authentication, and batch issuance now resolves cryptographic binding methods
Payments and strong customer authentication metadata - EWC TS12 transaction data is now correctly added when a payment or login is confirmed via the Digital Credentials API path
Backup, restore, and everyday stability - on iOS, the last-backup date reads synchronously and DataPods retain the correct pod credentials through re-authentication; on Android, the restore progress indicator no longer freezes because restore work is now tied to the screen's lifecycle