EUDIW conformance: certification, FCAF and how to prepare

What does FCAF test, and what does it not?§

According to Using the FCAF, its coverage is limited to functional requirements:

• protocol specifications for interactions with peers in the ecosystem;
• credential formats;
• mandatory user interactions and functionality.

A production-ready, compliant EUDI Wallet must meet many other requirements, which FCAF leaves to other frameworks. Cybersecurity and privacy evaluation are part of certification, but not of FCAF.

FCAF organises tests around a System Under Test (SUT). In its initial phase the only SUT in scope is the Wallet Solution. The framework is expected to add PID Providers, Attestation Providers, Relying Parties and infrastructure components later (SUTs). The Wallet Solution tests are grouped by the counterpart the wallet talks to, such as relying parties, PID providers and attestation providers.

Its intended audience today is wallet providers, testing laboratories and conformity assessment bodies (CABs).

How does Credimi run FCAF test cases?§

Credimi is an open-source platform that runs FCAF test cases inside automated pipelines, hosted at credimi.io or self-hosted.

• Catalog. As of 20/10/2026 the Credimi catalog holds 617 FCAF test cases in 184 scenarios, taken from the FCAF Wallet Solution content.
• Real flows. Pipelines drive your wallet app on Android devices, emulators and iOS simulators with Maestro, and call live credential issuers and verifiers with StepCI. Each run is then judged against the FCAF and protocol test cases.
• Evidence. Every step's inputs and outputs, including the protocol messages, are recorded with a timestamp in the run's append-only history, from which the run can be replayed. Video, screenshots and logs are stored with the run. The FCAF report links each test case to SHA-256 hashed evidence in that history.
• Report. Each run produces an FCAF report as PDF and JSON: an executive summary with the evidence hash, then one page per test case with its assertions and normative references. See a complete example (PDF, 21 MB, 617 test cases).
• Every release. The run-wallet-apk endpoint and the GitHub Action run the same scenarios on every commit.

Credimi does not certify wallets and is not a conformity assessment body. It helps you find failing test cases before an assessment and arrive with a record of what you ran. For the details, read FCAF conformance testing for EUDI wallets.

What does an FCAF test look like in Credimi?§

Each FCAF test case is a short YAML file: which wallets it applies to, the normative references it checks, the evidence a pipeline run captured, and the assertions to run on that evidence. This one checks that a PID in SD-JWT VC format carries the email claim:

id: WS_RP_DM_AddressData_Emailaddress_PID_IETF-sd-jwt-vc_001
applicability:
  credential_format: ietf_sd_jwt_vc
  document_type: pid
evidence:
  pid_sdjwt:
    from: pipeline.pid.presentation.sdjwt.all-claims.outputs.pid_sdjwt
assertions:
  - id: email_present
    validator: sdjwt.claim_present
    input: evidence.pid_sdjwt
    params: { claim: email }
verdict:
  pass_when: all_assertions_pass

The assertions use a library of 145 reusable validators for OpenID4VP requests and responses, DCQL, SD-JWT VC claims and key binding, ISO mdoc elements, JOSE and PID rules. Adding a test case usually means writing one such file; the evidence always comes from a real run, never from a fixture. The test definitions are open source in the Credimi repository.

How does this compare with other ways of testing?§

Approach	Good for	Leaves to you
Reading FCAF and testing by hand	Understanding the test cases; one-off checks	Repeating the same steps on every release; keeping evidence
Protocol conformance suites (for example the OpenID Foundation suite)	Checking a protocol implementation against a simulated counterpart; the route to OpenID certification	FCAF test cases; a real wallet on a real device
Assessment by a laboratory or CAB	The conformity assessment required for certification	Finding and fixing failures before the assessment
Credimi pipelines	Running FCAF and protocol test cases on real devices against live issuers and verifiers, on every release, with evidence	The formal assessment and certification

These approaches complement each other: automated runs during development, a formal assessment for certification.