Digital identity is one of the clearest public infrastructure wins of the decade. It is also one of the most fragmented. Adoption is accelerating fast: by 2029, roughly 5.6 billion people will carry a digital wallet, yet most of those credentials stop working the moment a user crosses a national frontier. As autonomous AI agents begin executing purchases on behalf of people across jurisdictions, the cracks are becoming impossible to paper over.
The upshot is a quiet reversal of the original promise. Travellers are uploading passport scans again because their home-issued IDs do not travel.
- Roughly 3 in 10 OECD countries recognise no foreign digital identity at all.
- Under the EU's EUDI wallet (eIDAS 2.0), only firms established inside an EU member state can register to consume citizen IDs.
- The Philippines' PhilID is reserved for locally incorporated companies.
- Forced image uploads multiply the databases that hold passport scans.
- Each new jurisdiction adds technical debt and regulatory friction.
The security promise that is leaking
The whole pitch for digital ID was minimisation. Prove what you need, share nothing more. That collapses when a hotel in Madrid asks a Japanese tourist to email a passport scan because the Japanese credential is unreadable. The scan lands in a Madrid database. The issuing government has lost control of its citizen's data sovereignty, even after spending millions on a secure stack.
For businesses, the attack surface widens with every country they touch. Each new verification partner adds another vault of identity documents to defend.
Our analysis: the problem is policy, not technology
The frustrating part is that the underlying plumbing works. OpenID for Verifiable Credentials, SD-JWT and similar standards exist and are deployed. What stops cross-border use is sovereign choice. Governments want their identity schemes to deliver domestic advantage first and global utility second. That is a defensible political position. It is also the reason the gap exists at all.
Agentic commerce makes the cost concrete. A buyer AI that cannot verify a user's home-issued digital ID has to fall back on scans, screenshots and one-off checks. The economic upside of automation dissolves at the border, and the privacy upside does too.
Who wins? Domestic ID providers and local verification vendors whose compliance moats keep out foreign competition. Who loses? Cross-border platforms, international travellers, and any business whose product depends on frictionless global commerce. The vendors most exposed are those serving multiple markets simultaneously—SaaS platforms, payment processors, travel aggregators.
The practical move for these vendors is to design for the worst case. Assume the user's domestic ID is unreadable. Build a fallback that minimises stored PII even when documents must be uploaded. Tight retention windows. Regional storage. Encryption at rest. Boring, profitable work that auditors love.
A worked example: a travel booking site serving multiple markets
Say you run a booking site for boutique hotels across Europe and Asia. A guest from Seoul tries to check in. Your Korean ID verifier says yes. Your Italian hotel partner says no, because their compliance stack only accepts EU-issued credentials. Your staging environment cannot patch this with a plugin.
Your two realistic options: refuse the booking, or accept a passport scan, run it through a third-party verifier, store it in a regional bucket with aggressive retention, and document the whole flow in your DPIA. The second path works today. It also creates a juicy target, and it undoes the very thing the Korean ID was meant to solve.
What to watch next
Watch for the EU to publish the first list of non-EU identity schemes accepted under EUDI. Watch for a regional bloc outside Europe to copy the EU model, which would seed the first large-scale interoperability hub. And watch agentic commerce vendors to start marketing "cross-border ID aware" as a premium tier. The threat model for AI-driven account fraud is only beginning to be understood, and any platform that relies on legacy verification is already behind.
Key takeaways
- Digital ID interoperability is fundamentally a policy problem dressed up as a tech problem.
- Image uploads are silently backfilling the gap that digital IDs were meant to close.
- Agentic commerce hits the same border that human users do.
- Vendors should design for unreadable foreign IDs from day one, not as an afterthought.
Frequently asked questions
How large is the digital wallet user base expected to get?
Projections indicate the global digital wallet population will reach into the billions by the end of the decade, with adoption accelerating across both developed and emerging markets.
Which regions restrict cross-border digital ID use?
Roughly 3 in 10 OECD countries offer no foreign recognition of digital identities. Specific examples include the EU's EUDI wallet, which currently scopes participation to EU-established businesses, and the Philippines' PhilID, restricted to locally incorporated companies.
Why are passport scans still common if digital IDs exist?
Foreign digital IDs are often unreadable by local verifiers, so platforms fall back to image-based checks that get stored in foreign databases.
What is the EUDI wallet?
The EU's planned digital identity wallet under the eIDAS 2.0 regulation, currently scoped so only EU-established businesses can register to accept citizen IDs.
How does this affect AI agents?
Agents cannot verify unreadable foreign IDs and must drop back to manual uploads, erasing most of the automation benefit.