Identity Verification Weekly: Developer ID Checks, Crypto Cards, and Germany’s EUDI Law

On September 30, Google began enforcing its Android developer verification requirements in Brazil, Indonesia, Singapore, and Thailand. Developers distributing apps through participating stores, including Google Play, must verify their identity and register their apps. The requirements are expected to expand globally in 2027.

For full distribution, individual developers may need to provide a government-issued photo ID and proof of address. Google also offers a limited-distribution option for smaller projects, while advanced users can follow a separate process to install apps from unverified developers.

Why it matters: Identity verification is becoming part of the infrastructure behind app distribution. Google’s approach introduces a way to link publicly distributed applications to identifiable developers, making it harder for malicious actors to repeatedly publish harmful software under new identities. 

It also raises practical questions about verifying developers across jurisdictions, handling different identity documents, and protecting personal data collected during registration.

An investigation by The Banker has highlighted services offering virtual payment cards that can be purchased with cryptocurrency without standard identity checks. These cards reportedly allow buyers to make purchases through Visa and Mastercard payment networks.

Journalists traced some of the card details to three US banks. One possible explanation is that the cards were originally issued to legitimate corporate customers before their details were resold to third parties. The investigation raises questions about who ultimately controls and uses the cards.

Why it matters: Verifying a customer when a payment card is issued does not necessarily establish who uses that card later. If card credentials are transferred or resold, the original Know-Your-Customer (KYC) check may no longer provide meaningful assurance about the actual user. 

Card issuers and service providers can use additional checks, such as identity re-verification, biometric authentication, and transaction monitoring, to help close this gap. However, these measures depend on their ability to identify and verify the person actually using the card, which may not be possible when card details are resold to third parties.

Germany’s parliament has approved legislation establishing the legal framework for the European Digital Identity Wallet (EUDI Wallet). The legislation supports the introduction of a smartphone-based digital identity that citizens can use to prove who they are and present digital credentials to public and private services.

A notable element is the provision for users who do not want to rely on biometric identification: individuals will have the option to choose whether or not to include a facial photo in their EUDI Wallet. This change reflects ongoing concerns about accessibility, privacy, and individual choice in digital identity systems. Germany plans to begin introducing its wallet in 2027.

Why it matters: The rollout of digital identity wallets across Europe calls for enrollment and authentication processes that accommodate different privacy preferences and accessibility needs. Regardless of whether users choose biometric or alternative methods, reliable identity proofing remains essential. 

Service providers, in turn, need to be able to verify wallet credentials and their issuers while continuing to support customers who use physical identity documents.