Relying party
A relying party is the organisation that requests a verifiable credential from a holder and relies on it to make a decision, such as a bank onboarding a new business or a shop checking a customer is old enough to buy an age-restricted product.
A relying party sends a presentation request over a protocol such as OpenID4VP describing which credential and claims it needs, then checks the response cryptographically against the issuer that originally signed it before acting on the result, rather than calling the issuer or the holder to confirm anything by phone or email. Becoming a relying party does not require building a credential issuer or a wallet: it only requires the ability to send a request, verify a signature against a trust list, and interpret whatever claims come back, which is a much smaller integration than the issuer side of the same ecosystem. Trust in the credential's content rests on the issuer, but trust that the issuer itself is legitimate rests on the relying party checking the issuer against a national or EU-wide Trusted List before accepting anything it signed. Under eIDAS 2.0, every EU member state must ensure relying parties in regulated sectors such as banking, telecom, healthcare and transport can accept EUDI Wallet credentials, and relying parties above a certain size or in specific regulated industries are required to accept the wallet where a citizen offers one. Because the protocol and trust model are standardised across the Union, a relying party that integrates once can accept credentials from any wallet issued anywhere in the EU, whether the holder is an individual proving their age or a business proving it is registered, without a separate contract or technical connection to each issuer.
Related terms
Can any organisation become a relying party without becoming an issuer too?
Yes, and most do. Verifying a credential only requires checking a signature against a published trust list and reading the disclosed claims, which is far simpler than the issuer's job of proving identity, managing keys, and maintaining revocation status. A bank checking a business credential and the government body that issued it can be entirely different organisations with entirely different technical footprints.