FIDO announces a wallet reference architecture (CMRA) and a Verifier ID framework at Authenticate 2026
At Authenticate 2026 on October 20, the FIDO Alliance said it will publish its Credential Manager Reference Architecture and a Framework for Verifier Identification, and opened an External Advisory Forum on digital credentials.
What happened
On October 20, 2026, at Authenticate 2026 in Carlsbad, California, the FIDO Alliance announced that it will make key working documents from its digital wallet certification work public, and launched an External Advisory Forum for issuers, governments, regulators and industry associations. FIDO said the documents "will be made available publicly in the coming weeks."
- Credential Manager Reference Architecture (CMRA): defines how credential managers (digital wallets) are expected to implement functional, security and interoperability requirements, as a global baseline across national digital ID, payments, workforce and travel credentials, with profiles built on top. It is the foundation of FIDO's Credential Manager Certification Program.
- Framework for Verifier Identification: describes how a credential manager receives structured and verified information about the website or service asking for a person's information, so users can review and approve sharing through a clear interface.
The same conference also featured a 16-check passkey maturity rubric (Bronze to Platinum) from FIDO UX Working Group members, per the Day 1 recap.
Why it matters
Wallet credentials are reaching CIAM flows through identity verification, age checks and onboarding. Until now a verifier had little way to judge a wallet beyond its brand, and a wallet had little way to tell a user who was really asking. These two documents target exactly those gaps.
Deepak's take
Verifier identification is the piece I would watch. Passkeys beat phishing because the credential is bound to an origin; a wallet credential is meant to be shown to many verifiers, so it cannot work that way. Without a shared way for wallets to identify the requester, a convincing fake site can ask for an ID credential and the wallet's prompt is the only defence. FIDO has announced the framework, not published it, so the hard questions (who vouches for a verifier, and what the wallet shows when no one does) are still open.
What to do
- Teams accepting wallet credentials: plan for verifier registration as a future onboarding step, similar to registering an OAuth client.
- Watch for publication on FIDO's digital credentials page before citing any specific CMRA or Verifier ID requirement.
- Further reading: decentralized identity for CIAM.