EMVCo drafts one credential standard so merchants stop building per-wallet integrations
EMVCo published a draft framework for verifiable digital credentials in card-based payments, aimed at giving merchants one consistent data structure to authenticate against regardless of which wallet or payment network a customer uses.
EMVCo, the body that maintains the global EMV chip-card specifications, put out a draft framework on July 6, 2026 proposing a single standard for verifiable digital credentials in card-based payments. The problem it targets is integration sprawl: merchants currently build separate integrations for each wallet and payment network they support, each with its own credential format and validation logic. EMVCo's proposal would let a merchant implement one consistent data structure for digital credential authentication and have it work the same way regardless of which wallet or network a given customer's card runs on. The framework is still in draft, and no adoption timeline has been set.
Why it matters
Every fragmented credential format a merchant has to individually support is also a fragmented attack surface, more integration code means more places for authentication logic to have a gap. A single verified data structure across wallets and networks is the same standardization logic that made WebAuthn valuable for login: one correctly implemented validation path beats a dozen wallet-specific ones that each have to get it right independently.
This is worth tracking alongside Google and Mastercard's separate AP2 agentic payments work, both are EMVCo-adjacent efforts to standardize how payment authorization gets verified as the number of parties in a transaction, wallets, agents, issuers, keeps growing.
Source: FIDO Alliance
Related on Start with Identity
- BlogFIDO Alliance to publish its wallet certification documents and opens a forum for issuers and regulators
At Authenticate 2026 on October 20, the FIDO Alliance said it will publish the Credential Manager Reference Architecture and a Framework for Verifier Identifica
- BlogA loose PHP comparison let attackers sign in as WordPress admin through SAML
Two unauthenticated bypasses in the miniOrange SAML 2.0 Single Sign On plugin, CVE-2026-61979 and CVE-2026-15981, treat OpenSSL's error return as a valid signat
- BlogMCP's 2026-07-28 spec hardens OAuth and adds enterprise-managed authorization
RFC 9207 issuer validation is now mandatory, dynamic client registration is deprecated in favour of client ID metadata documents, and an enterprise extension le
- PodcastA Digital Identity Digest
Short weekly episodes from standards veteran Heather Flanagan that "translate geek to human" on identity standards, wallets, and the web platform.
- PodcastAuth0
The late Vittorio Bertocci's interviews with the authors of OAuth, OpenID Connect, FIDO, and SAML. Ended in 2022, and still the best audio archive on identity s
- PodcastIdentity at the Center
The longest-running weekly show on identity and access management programs, hosted by two practitioners. The best single feed for keeping up with the field.