EPC Scarlet and Digital Identity Wallets in Payments: A UK View
Europe is agreeing common rules for how digital identity wallets are accepted in payments, and for who is liable when something goes wrong. On 19 October 2026, Finextra reported that the European Payments Council (EPC) had approved "Scarlet", a common framework for accepting EU Digital Identity Wallets in payments, including a liability allocation. For a UK payment service provider (PSP) or merchant that sells into the EU, the useful question is not what Scarlet will eventually look like in full. It is what is settled today, what is not, and what to do in the meantime. This commentary is deliberately concise, because the public evidence behind it is thin and we would rather say so than fill the gap.
What has been reported
The reported fact is short. Finextra, citing the EPC, reported on 19 October 2026 that the EPC approved Scarlet. The framework is described as a common framework for accepting EU Digital Identity Wallets in payments, and it comes with a liability allocation.
Our reading of that report is that Europe is moving towards common acceptance rules, and a stated allocation of liability, for digital identity wallets used in payment authentication. That is an interpretation of the direction of travel, and it is useful for planning. It is not a description of how the framework works.
We have not described the framework's technical detail, because the reporting we have does not give it. Anyone designing against Scarlet should read the EPC's own documents rather than rely on a commentary like this one. That also applies to the exact wording of the approval, which should be confirmed against the primary source before anyone treats it as final.
What is settled, and what depends on the Payment Services Regulation
The cleanest way to use this news is to separate three things: what the reporting supports, what remains open, and what we simply do not know.
What the reporting supports
On the reporting, three points are fairly firm. The EPC has approved a common framework. The framework concerns the acceptance of EU Digital Identity Wallets in payments. And it includes a liability allocation. Those are the points a PSP or merchant can reasonably note today.
What is still open
The reporting refers to the Payment Services Regulation (PSR) as forthcoming. We read that wording as meaning the regulation is not yet final. Anything that depends on the final text of the PSR therefore remains open. That includes how a legal regime will sit alongside a framework agreed by a payments body, and what obligations will apply to whom. We cannot say how those pieces will fit together, and nor can anyone relying on the evidence we have.
What we do not know
We do not know the detail of Scarlet's rules, the timetable for adoption, or whether and how the framework applies to firms outside the EU. We do not know what the liability allocation says in practice. Those gaps matter most to exactly the readers this article is written for, so treat any confident claim about them, including from us, with caution.
Why the liability allocation matters as much as the wallet
Wallets attract the headlines. Liability decides budgets.
The pain point for PSPs and merchants selling into the EU is that they do not know how identity wallets will change payment authentication, or who carries the loss when something goes wrong. A stated liability allocation is therefore a part of the framework that could turn into contract terms, risk models and pricing conversations with a PSP or acquirer.
There is a parallel in our own monitoring, and we flag it as interpretation. Across October, the question of who authorises a transaction, and who is liable for it, has been the dominant theme in agentic commerce for a third consecutive run. The domain is different, but the pattern looks similar: once identity and authority become inputs to a payment, liability moves from a technical footnote to a commercial negotiation. We would expect the same to be true of identity wallets, though the evidence for Scarlet specifically is limited to what is reported above.
The UK angle for firms with EU exposure
Scarlet is an EU framework, and the reporting does not make it a UK one. The link to UK readers is commercial: UK PSPs serving merchants in the EU, and UK merchants and platforms with EU customers. Whether and how the framework applies to them is not something the sources we have reviewed address. That is a question for your PSP, your acquirer and your legal advisers, not an assumption to make.
There is a UK wallet story running alongside, and it is worth keeping separate. The Competition and Markets Authority (CMA) has proposed opening iPhone contactless (NFC) access to Apple Pay rivals. According to the CMA, UK fintechs and banks could then ship tap-to-pay wallets and adjacent services on iPhones, including payment apps, digital IDs, travel passes and digital keys. That is a proposal only, and it is not final.
Put the two side by side and a theme emerges. In the EU, wallets that carry identity are being given common acceptance rules in payments. In the UK, a regulator is considering opening a mobile wallet market in which digital IDs are one of several adjacent services. Nothing in the evidence says the UK will adopt Scarlet, or that the two developments are connected. They do, however, suggest that wallets will increasingly sit where payments and identity meet. For a team planning a wallet or an embedded payments product, our Embedded Finance & Digital Wallets work starts from exactly that overlap.
What to watch, and what to do now
What to watch
- The final text of the Payment Services Regulation. The reporting treats it as forthcoming, so this is the main open dependency.
- The EPC's own documentation on Scarlet. Primary sources will carry the detail that commentary cannot.
- How your PSP or acquirer communicates the change. Providers will interpret the framework for their customers first.
- How liability appears in your contracts. A liability allocation in a framework only matters commercially once it shows up in the agreements you sign.
What to do now
- Map your EU exposure. List which products, merchants and customers actually touch the EU, and which PSPs and acquirers sit behind them. If the list is short, so is the problem.
- Ask your providers. Put the question plainly to each PSP and acquirer: how do you intend to handle EU Digital Identity Wallets and the Scarlet framework, and how will liability be treated in our agreement?
- Keep identity and authentication replaceable. Design the identity step in your payment flow as a component you can swap, not something woven through the checkout. If rules change when the PSR settles, you want to change a component, not rebuild a flow.
- Do not build to unpublished detail. Our October intelligence also shows agent-commerce standards multiplying without convergence, and our reading is that committing early to one scheme risks rework. The same caution applies here until the PSR is final.
- Write down your assumptions. Record what you assumed about scope, timing and liability, and who agreed it. When the detail arrives, you will know quickly what has changed.
Where Innovify fits
Innovify is a technology partner with deep expertise in banking, financial services, fintech and insurance. We help mid to large businesses, including brands that are not financial companies, build and launch wallets and embedded finance products, and we design compliance in from day one. We build for regulated clients.
On a topic like this, where the rules are still settling, the useful contribution is architecture and sequencing: separating the parts of a wallet or payment flow that depend on identity, authentication and liability so they can change independently, and helping teams decide what to build now and what to wait for. If you are planning a wallet or payments product with EU exposure, our embedded finance and digital wallets team can help you work through those choices.
FAQ
What is the EPC Scarlet framework?
Scarlet is reported as a common framework, approved by the European Payments Council, for accepting EU Digital Identity Wallets in payments. It comes with a liability allocation. The reporting we have does not give more technical detail, so read the EPC's own documents before designing against it.
Is Scarlet settled, or does it depend on the Payment Services Regulation?
The approval of the framework is reported as a fact. The Payment Services Regulation is described as forthcoming, which we read as not yet final, so anything that depends on its final text remains open. We cannot say which specific obligations will change.
Does Scarlet apply to UK firms?
The sources we have reviewed do not say. Scarlet is an EU framework. UK PSPs and merchants that sell into the EU should ask their providers and legal advisers whether and how it applies to them, rather than assume either way.
Why does the liability allocation matter?
It decides who carries the loss when an identity-backed payment authentication goes wrong, and that can flow into contracts, risk models and pricing with PSPs and acquirers. We do not know what Scarlet's allocation says in practice, so check the primary documents.
What should a UK firm with EU exposure do now?
Map where your products touch the EU, ask your PSPs and acquirers how they will handle the framework and liability, and keep identity and authentication as replaceable components in your design. Avoid building to detail that has not been published.
Conclusion
Scarlet is a signal that Europe is agreeing common rules and a liability allocation for identity wallets in payments. What is settled is limited: a common framework has been approved, and it covers acceptance of EU Digital Identity Wallets in payments with a liability allocation. Much else depends on a Payment Services Regulation that is not yet final. For UK firms with EU exposure, the sensible response is to map exposure, ask providers hard questions and design for change, rather than to build to detail that does not yet exist.
