gleifpdf/20

GLEIF | oo cioial st A ditati Supplemental user guide in support of the accreditation process. GLEIF ACCREDITED

The Accreditation Manual is provided to Applicant LOUs and Candidate LOUs as a supplemental user guide in support of the accreditation process.

The contents of this document do not supersede interpret or change in any way the terms of the Master Agreement. In all cases, the Master Agreement is the prevailing document in the event of any contradictions contained in this Manual. In using this document, the reader accepts and understands these conditions.

Ll

Chapter 3: Accreditation Process 3.1 Overview The Accreditation Process is in place to ensure that all Applicant/Candidate LOUs meet the minimum financial and operational control requirements of the GLEIF and that a local accredited operating unit’s control environment is reasonable to protect the integrity of LElI operations. Throughout the Accreditation Process, the Applicant/Candidate LOU is obliged to inform GLEIF without undue delay about any events or developments which affect the accuracy of information provided to GLEIF such as changes in legal status e.g. form of incorporation, change of signatory power of its officers and the like. Such changes could impact the Accreditation Process and/or any agreed time schedule. Applicant and Candidate LOUs will be submitting all accreditation materials via GLEIF's customer portal and LOU Communications Portal. Details for accessing both tools the portal will be provided during process orientation after a non-disclosure agreement has been signed. All documents received will be date stamped and a receipt sent to the submitter. Applicant/Candidate LOUs may not submit documents via email directly to GLEIF, unless requested, so that a complete audit trail for all documents can be maintained. They will be able to submit documents throughout the accreditation process, however, once documents are designated as ‘FINAL, the LOU Communications Portal will be restricted to read-only for users and any proposed changes will need to be discussed with and approved by GLEIF before taking any action. The Accreditation Process is comprised of six steps. During the first three steps, the Applicant LOU is referred to as an Applicant. At this point, no formal contract has been signed and the Applicant LOU is gaining an understanding of the GLEIF control requirements and reviewing its own operations to determine the feasibility of becoming a LOU. Once the Master Agreement has been signed, the Applicant LOU becomes a Candidate LOU. The Candidate LOU is focused on successfully completing the Accreditation Process and obtaining an Accreditation Certificate. Please note that for many questions, the Applicant/Candidate LOU is required to submit supporting documentation as part of their response. The Applicant/Candidate LOU should only submit documentation relevant to the question being asked. This may include full documentation or excerpts from manuals, policy statements and the like. All such documents (full or excerpt) must be tra

nslated into English for submission.

The Accreditation Process is focused only on LEI-related operations and processes

within the Applicant/Candidate LOU'’s organization. It is critical that Checklist

responses and the corresponding documentation presented address this specific

operational area.

©GLEIF2019 1911 VO1

Chapter 3: Accreditation Process 12 3.2 Flowchart The following is the standard Accreditation Process flow represented as a swim lane chart with associated roles. Accreditation Process Flow Start Accreditation Develop Accreditation Plan

[e]

- (= o . o o A < Agree on Accreditation Plan "EI' Sign Master fp' Agreement Assess Accreditation Documentation Implement Accreditation Requirements

[e]

[

[ 3 el [= O o ©GLEIF2019 1911VO1

Chapter 3: Accreditation Process 13 3.3 Process Flow Steps Role Step Description Applicant 1 Start Accreditation GLEIF's requirements are explained in the following key documents and the Applicant LOU should review each in detail to understand service and control expectations. In order to begin this process, the Applicant LOU must provide a non-disclosure agreement signed by an authorized representative of the organization. The ‘Authorized Representative’ is defined as an individual with sufficient authority to enter into contracts, such as the Non-Disclosure Agreement or Master Agreement, with GLEIF. This individual’s authority to represent the Applicant must be verifiable via available public sources. GLEIF will permit the Authorized Representative role to be delegated to an appropriate person in an Applicant/Candidate’s organization upon receipt of a letter from an Officer of that organization making such a request and identifying a single individual for this designation. The non-disclosure form can be found on the GLEIF website.

o Master Agreement - This is the contract that sets out the rights and obligations of GLEIF and the LOU. It is executed between the Applicant LOU and GLEIF after joint agreement on the Accreditation Plan.

o Accreditation Manual - This is an Appendix to the Master Agreement which explains the Accreditation process, procedures and requirements.

o Accreditation Checklist - This is an Appendix to the Master Agreement and is used by the Applicant LOU to assess its operational status regarding GLEIF's requirements and decide if it wishes to pursue becoming a local operating unit.

It is also the key tool for the Candidate LOU completing the Accreditation Documentation. The Checklist documents the minimum levels of internal controls expected to be in place and functioning effectively within an accredited local operating unit.

o Service Level Agreement (SLA) - This document details services to be delivered and performance metrics which an Accredited LOU must meet to achieve and maintain its accreditation.

These materials in addition to others are located on GLEIF website: www.gleif.org ©GLEIF2019 1911 VO1

Chapter 3: Accreditation Process 14 3.3 Process Flow Steps Role Step Description Applicant LOU 2 Develop Accreditation Plan

Once the Applicant LOU has reviewed and considered GLEIF's requirements, and decided to move forward, an Accreditation Plan is developed. This is the key document prepared by the Applicant LOU for initial assessment. The Plan is a free-text format and the Applicant LOU determines the appropriate level of detail. The Applicant LOU must address six key points:

o Who - Describe the nature of organization applying - what are its key services/customers, market position, size/revenue, competition.

o Why - Describe the reason(s) supporting the organization’s desire to be a LEl-issuer — what are key business drivers, strategic objectives and plans, economic model, business plan?

© What - Describe how you envision your LOU in operation. What countries do you support? Do you plan to use third party services or registration agents? How do you plan to grow the business? Where do you see your LOU in 5 years? How do you see your LOU operations fitting in with GLEIF's strategy and vision? Do you have a strategic plan? What marketing resources/plans have you developed to support your vision?

o Where - Identification of all jurisdictions in which the local operating unit plans to serve and the reference sources which will be used to validate LEls.

o How - During the planning process, the Applicant LOU will have reviewed the details of the Accreditation Checklist and needs to analyze how well it presently complies with the expected controls and how remediation of control gaps will be addressed.

o Timeframe - Based upon an understanding of the requirements, what is the preparation timeframe for completion and submission to GLEIF of the Accreditation Documentation?

Applicant LOUs must submit the “Applicant Plan Checklist” with the Plan submission. This additional checklist catalogs all the required components of the Plan. All components are required in order for GLEIF to consider a Plan complete and ready for review. This form can be found on our website. The Applicant is responsible for advising GLEIF that their materials are ready for review. ©GLEIF2019 1911 VO1

Chapter 3: Accreditation Process 15 3.3 Process Flow Steps Role Step Description GLEIF 3 Agree on Accreditation Plan

Applicant LOU GLEIF will review the Accreditation Plan and any supporting materials submitted in order to evaluate the readiness of the Applicant LOU to move forward with the Accreditation Process. As part of this evaluation, the Applicant LOU may schedule a review session to discuss its submission. This review session will be planned for one hour’s duration and minimal extra time will be allotted at the discretion of GLEIF. This is to ensure fairness to all Applicant LOUs. GLEIF will complete its evaluation process within forty-five (45) business days of receipt of the final Plan. In order to complete this, GLEIF may request a review session with the Applicant which will be scheduled at a mutually agreeable date and time. If, after this discussion, it is agreed that an on-site visit is required, the requesting party will bear the costs. Once it is agreed that the Accreditation Plan is acceptable and meets all review criteria, e.g., synergy with GLEIF strategy, going concern, compliance with all GLEIF internal control requirements including also the cost recovery principle, etc., a recommendation is presented to the GLEIF CEO and Board. Once approved, the Applicant LOU moves on to Step 4.

GLEIF L Sign Master Agreement

Applicant LOU If the Applicant LOU wishes to continue the process, the Master Agreement must be executed. Once the Master Agreement has been countersigned, the Applicant LOU then becomes a ‘Candidate LOU’, it is then considered a “Candidate”. GLEIF publishes a list of all Candidate LOUs on GLEIF's website for full disclosure purposes.

©GLEIF2019 1911 VO1

Chapter 3: Accreditation Process 16 3.3 Process Flow Steps Role Step Description Candidate LOU 5 Implement Accreditation Requirements The Candidate LOU will now focus on the information gathering process utilizing the Accreditation Checklist. The Accreditation Checklist is the key tool for completing the Accreditation Documentation. It is designed to reflect the requirements of the MA. The Checklist is included in the Master Agreement. It is divided into twelve (12) separate sections all of which need to be completed. Throughout the Checklist, additional supporting documentation is requested in order to validate and/or support the Candidate LOU’s responses. These requests are noted under the “Additional Documentation Requested” column and, in some cases, a suggested example is noted. These are provided for illustrative purposes only and the Candidate LOU is free to provide whatever documentation it believes to be appropriate and relevant. The Candidate LOU must complete its analysis and assessment of compliance with GLEIF requirements and submit its Accreditation Documentation within six (6) months (180 calendar days) of the Effective Date of its MA. The Candidate LOU must clearly reference how supporting documents address specific questions in the Accreditation Checklist. In case where certain questions of the accreditation Checklist document can be skipped, as per the Appendix 02-Certificate List, the Candidate LOU must clearly reference the certificate name in the “Additional Documentation Requested” column space. Throughout the development of its Accreditation Documentation, the Candidate LOU is obliged to inform GLEIF, without undue delay, about any events or developments covered by, or having potential impact on, the agreed Accreditation Plan. The Candidate is responsible for advising GLEIF that their materials are ready for review. Any Accreditation Documentation submitted must be properly authorized by the Candidate LOU'’s Authorized Representative(s) as identified as part of Step 1. ©GLEIF2019 1911 VO1

Chapter 3: Accreditation Process 17 3.3 Process Flow Steps Role Step Description GLEIF 6a Assess Accreditation Documentation GLEIF has a maximum of ninety (90) calendar days to review the Accreditation Documentation once a complete, authorized submission is received. Upon receipt, GLEIF is responsible for reviewing the completeness of Accreditation Documentation. This includes the Checklist and all supporting materials presented by the Candidate LOU. Upon initial review, if all required materials have been submitted, the Documentation will be moved forward for detailed assessment. If not, it may be returned to the Candidate LOU with a full explanation so that it can be resubmitted if the Candidate LOU chooses to do so. Except if agreed in advance in writing, the Candidate LOU may not submit documents separately; it is expected the Accreditation Documentation will be submitted as a single submission to GLEIF. If the Candidate LOU repeatedly submits incomplete Accreditation Documentation, GLEIF may terminate with immediate effect the Master Agreement. ©GLEIF2019 1911 VO1

Chapter 3: Accreditation Process 18 3.3 Process Flow Steps Role Step Description

GLEIF 6b As part of the Accreditation Process, GLEIF will be performing data quality checks and reviewing the results of test cases provided to the Candidate LOU. Candidate LOUs will be required to execute the GLEIF- developed test cases using their current LEI system and provide the results to GLEIF. Candidate LOUs will also be required to test and verify technical capabilities to connect and upload data to the GLEIF network. General comments relating to test results will be shared with the Candidate LOU. The level and type of data quality testing will vary based upon the stage of maturity of the Candidate LOU. Applicants should carefully consider the scope of jurisdictional locations as well as the scope of entities (non-fund entities, fund entities) for which they desire to offer LEl services. Depending on the jurisdictions and the type of entities selected to serve in each jurisdiction, GLEIF will prepare and provide test cases. On a case-by-case basis, GLEIF will assess how many test cases Candidates shall receive but as a minimum requirement, Candidates need to successfully complete one test case for each jurisdiction indicated in their application form. Once the accreditation program is successfully completed, Accredited LEl Issuers (LOUs) may offer LEI services for either non-fund entities only or for both non-fund and fund entities in the respective jurisdiction(s). The Accreditation Certificate will specify all jurisdictions as well as the type of entities per jurisdiction which have been accredited by GLEIF. After accreditation, if a LOU wishes to add new jurisdictions to its portfolio or to add LEl services for fund entities in a given jurisdiction, the LOU must make a formal request to GLEIF listing the jurisdictions to be added, the respective registry sources to be used as well as the entity types to be served per jurisdiction. GLEIF will review the request and provide test cases for processing. As in the initial accreditation process, the LOU must successfully complete the test case(s) before (fund or non-fund) LEls may be issued or maintained for these jurisdictions.

©GLEIF2019 1911 VO1

Chapter 3: Accreditation Process 19 3.3 Process Flow Steps Role Step Description GLEIF 6c Upon successful completion of the activities in 6a and 6b, GLEIF will work with the Candidate to ensure that they are prepared to provide LEl services in concert with GLEIF's infrastructure and protocols. This activity is referred to as “onboarding”. These activities focus on the integration of LOU operations with GLEIF required services, registry and jurisdictional verification and conformity with Master Agreement specifications. The Candidate is also required to facilitate a real-time, live demonstration of their LEI production system based upon a set of scripted activities which will be provided by GLEIF. ©GLEIF2019 1911 VO1

Chapter 3: Accreditation Process 20 3.3 Process Flow Steps Role Step Description 6d GLEIF Accreditation, in consultation with other GLEIF team specialists, will prepare an assessment report which is reviewed and approved by the GLEIF CEQO. A notification will be shared with the GLEIF Board and the ROC to inform about the result of the accreditation application. The Board'’s decision will be made without undue delay and @ minuted. decision will be minuted. GLEIF will then advise oo the Candidate LOU of the outcome of the assessment in writing. Certificate of Accreditation ° If Pass - Accreditation Certificate, the Candidate LOU will be granted its Accreditation Certificate and P the designation of accredited local operating unit. * If Fail - does not meet standards, the Candidate LOU mm will receive a summary of the assessment report for oD clarification and the MA will be terminated; it can Accreditation Subject / Title reapply again at a date of its choosing. Alternatively, W - GLEIF, at its option, may reject the submission = and grant the Candidate LOU more time to AW K prepare its documentation. M“m M«M « If granted Pass - Provisional, GLEIF will provide a full explanation as to what authority the LOU has been granted, what needs to be remediated for full accreditation, and the allocated timeframe. GLEIF is required to reassess all changes made by the Candidate LOU in order to render a decision with respect to final status; if not completed in a timely manner, the Candidate LOU's status will be changed to ‘not approved’ and the Master Agreement will be terminated. Any dispute arising out of the recognition or de-recognition of a LOU shall be reviewed with the goal of resolution - see Appeals and Complaints in the Master Agreement. ©GLEIF2019 1911 VO1

Contents 3 AboutthisManUAL.......ccoiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii ittt ieiiieaetetisasstesosssnsssssssassssosssasnsssssnsslh - eLel =T [ e L ToT o T e Yo -3 Yool f=Te [1 e T ATeT oY BT all 4 1= o o3 (000 11 e Loy ol 0T o 1 -3 - Chapter 1: Accreditation ReqUIremMENtS.....cciiiiiiiiiiiiiii it iieetieiereneteanesenesennessncsenncesneeas® TTAccreditation Elgibility .. ..ooooi el O T2 FUNAAMENEAIS . oo el O 12 CertifICAt LISt e el O T3 COSt RE OV Y .. e e ] 1.4 0rganizational REPULATION . ... e [ Y @] o) e el =Y =3 Y 1.6 AccreditationInternal Control Standards. ..o i i 8 1.7 ACCreditatioN Ol . .. e e et 8 LRI @l al Lo STl W] L 0 PPN - 1.9 Accreditation Appeals and Complaints .. ...ttt et B 1.10 Continuous Improvement of Accreditation.........coooiiiiiiiii 9 11MUseof Third Party Reportsin Accreditation...... ... il 9 112 Use of Third Party Service Providersin Accreditation...........cooiiiiiiiii i ciiiie a9 L = =T o) N1 U T o | o Ve Chapter 2: Roles and Responsibilities........ccoiiiiiiiiiiiiiiiiiiiiiiiiiii it icireieeeenneeenennnnesennnnes. 10 2 APPICANtLOU . .o T10 2.2Candidate LOU .. e 10 2.3Accredited LOU . .. e e 10 8] C I = | =T | o P [0 Chapter3: Accreditation ProCeSS.....uvieiiiiiiieieieieneereneeeeeneerensesenncesensessnsessnnsessnsassnsaaesll G0 O =T = PP I | B2 OW Ot . o el 12 B B PrOCESS FlOW S DS . vttt ettt e e 13 B RACT NI e 21 B S ACCreditatioON SUP PO T . e e e 22 3.6 ACCreditation CertifiCate . .. oot e 22 3.7 Agreement Change PrOCESS ... ittt et ettt et e e 22 Chapter 4: Guide | General Information for Accreditation Documentation Submission.....................23 41 AContactDetails | BENtity Structure .. ..o e 23 4.2 C0rganization STrUCTUIE . . ...ttt et e e el 20 4.3 D Financial Data, Audits and General Governance . .........oviiii i i .. 25 44 E Cost Recovery ReEQUINEMENES . .. .ttt e ittt e e 25 L el I T Y = Vo321 o 4.6 GRequiredWebsite TemS . ... o e e 26 47 HRecords ManagemMent . ... o el 26 4.8 1 Software DeVelOPmMENt . ... e 2T 4.9 JNetworks & INfrastrUCtUre . .. ..o e e 2T LI0KIT Security & ComMPlIaNCE . ..ot e e e e e e 2T 411LDataQuality Management . . ... e 2T Appendix 02 - Certificate List.....coiiiiiiiiiiiiiiiietiiieeiieteeneeseeeeresnnnseeesesncnssesessssnnsnscasenens 28 ©GLEIF2019 1911 VO1

Chapter 3: Accreditation Process 21 3.4 RACI Chart Obligation Role Description Responsible Responsible to perform the assigned task Accountable Accountable to make certain work is assigned and performed Consulted Consulted about how to perform the task appropriately Informed Informed about key events regarding the task Task Applicant LOU GLEIF Candidate LOU 1. Start Accreditation Responsible Accountable 2. Develop Accreditation Plan Responsible Consulted Accountable

1. Agree on Accreditation Plan Responsible Responsible

Accountable 4. Sign Master Agreement Responsible Responsible

Accountable 5. Implement Accreditation Plan Informed Responsible

Accountable

1. Assess Accreditation Documentation Responsible Informed

Accountable

©GLEIF2019 1911 VO1

Chapter 3: Accreditation Process 22 3.5 Accreditation Support In order to provide for fairness to all Applicant and Candidate LOUs, GLEIF will not provide ad hoc advice to Applicant/Candidate LOUs regarding their application responses and/or documents. GLEIF provides sufficient definitions and information on its website for this purpose. However, the Applicant/Candidate LOU may, upon request, schedule up to three (3) review conference calls or video conferences with GLEIF during the Accreditation Process - Each call will be planned for one hour’s duration and minimal extra time will be allotted at the discretion of GLEIF. This is to ensure fairness to all Applicant and Candidate LOUs. For these calls, the Applicant/Candidate LOU may be asked to submit a preliminary Accreditation Plan/Documentation materials and/or supporting documentation relating to the controls/ topics at issue and provide a specific list of questions depending on the nature of the request. Questions and answers may be published on the GLEIF website for reference by all Applicant/ Candidate LOUs - this information will not be attributable to any specific Applicant/Candidate LOU. This support is completely optional to the Applicant/Candidate LOU which can submit its Accreditation Plan and Documentation with or without it. GLEIF reserves the right to request and schedule review meetings for its own purposes of clarification and will follow the same procedure of providing the Applicant/Candidate LOU a list of questions in advance depending on the subject and circumstances and setting a mutually agreeable schedule. 3.6 Accreditation Certificate Upon successful completion of the Accreditation Process, GLEIF sends the Candidate LOU an Accreditation Certificate, granting the right to issue LEIs. GLEIF will explicitly and clearly enumerate in which countries the new local operating unit is accredited to issue LEIs and as well as an accreditation date. GLEIF also publishes all successful Accreditations on its website. 3.7 Agreement Change Process Post-accreditation, the LOU may desire to modify its internal operating procedures due to changes in the business or operating environment. In those cases, the LOU must follow the established Change Process as documented in the Master Agreement, Sub-Chapter lll. D GLEIF The GLEIF ACCREDITED logo must be displayed in an appropriate location on the accredited LOU’s website. ACCREDITED ©GLEIF2019 1911 VO1

23 Guide | General Information for Accreditation Documentation Submission

Section Title 4.1 A Contact Details | B Entity Structure

General Purpose Providing a business and technical overview of the organization applying for Accreditation.

Description A Contact Details (page 3) This section requires specific information regarding the organization’s management contacts for this process. This includes the preparer and approver of the documents and key reference resources (Operations and Finance) who may need to be contacted for additional information and clarification. It most importantly requests information about the ‘sponsor’ of this application initiative - this is the signatory at the bottom of the page who will be designated as the “Authorized Representative” for the Applicant and is responsible to certify that the application is correct and complete. This individual needs to be sufficiently authorized by the applying organization to represent the organization as well as serve as the key senior management sponsor throughout the Accreditation process. B Entity Structure (page 4) This section requires specific information regarding the organization structure of the Applicant/Candidate LOU. The Applicant/Candidate LOU may be a stand-alone organization or part of a larger organization. GLEIF will require basic information about parent-child relationships, in general, if applicable background information however, the main focus will be on the Applicant/ Candidate LOU organization. For purposes of clarity, “Government” refers to an Applicant/Candidate LOU which is, or is part of, an administrative agency, nation state or state-owned company; “Private” is a privately controlled legal entity which is not listed on a stock exchange; “Public-listed” is an entity which is listed on a stock exchange and has shareholders - “Public-Non-Listed” is an entity which is funded from public sources, but does not have stockholders. “Accounting Framework” and “Internal Controls Framework” refer to commonly recognized business models in use globally. This is helpful but not essential information. Fiscal Year - please specify when the Applicant/Candidate LOU's fiscal or accounting year starts and ends. This is helpful background information for billing planning. B Entity Structure (page 5) The Applicant LOU is asked to identify any beneficiary ownership associated with their organization and its intended tax strategy in relation to the delivery of LEI services. The Applicant

LOU is also required to disclose its registry/ sources of data and current or expected jurisdictions on a separate form.

© GLEIF 2019 1911 VO1

Chapter 4: Guide | General Information for Accreditation Documentation Submission 24 Description B Entity Structure (page 6) This section asks the Applicant LOU to describe its current audit activities from a variety of sources. This may aid the Applicant LOU in identifying any current third party report that could be used to confirm the adequacy of internal controls independent of the organization. These reports may be accepted by GLEIF in lieu of other documentation if current and relating to LEl services. Access Groups Checklist Template - Public - included on www.gleif.org Completed Data - Confidential as per the NDA Update Frequency Asrequired subject in the Master Agreement. Section Title 4.2 C Organization Structure (page 7) General Purpose Providing guidance on the documentation requirement which will assist the Applicant LOU to complete the Accreditation Process. Description The purpose of this page is to advise the Applicant LOU as to the types of information/reports which will either be required or may be helpful during the Accreditation Process. A key point to note is that distinctions are made as to what reports would generally be expected to be in place for certain types of organization. See the “Applicability” columns. Access Groups Public - included on www.gleif.org Completed Data - Confidential as per the NDA Update Frequency Asrequired in the Master Agreement. ©GLEIF2019 1911 VO1

Chapter 4: Guide | General Information for Accreditation Documentation Submission 25

Section Title 4.3 D Financial Data, Audits and General Governance (page 8)

General Purpose Describing of the basic financial position of the Candidate LOU and general questions regarding governance and organizational structure.

Description The purpose of this section is to provide GLEIF with an overview of certain financial and operational aspects of the Candidate LOU.

A key point to note is that the Candidate LOU must clearly explain how its operations are structured within an organization. For example, it could be a stand-alone entity with no other affiliations. It could also be a department/ function within another organization.

This section applies to the Candidate LOU in the context of its parent/owner/ controlling entity, if applicable. All relevant entities need to be represented in the Candidate LOU’s answers.

Access Groups Public - included on www.gleif.org Completed Data - Confidential as per the NDA

Update Frequency Asrequired in the Master Agreement.

Section Title 4.4 E Cost Recovery Requirements (page 9)

General Purpose Understanding how the Candidate LOU intends to comply with GLEIF's Cost Recovery Requirements.

Description A critical principle of GLEIF is that a local operating unit must operate its LEI activities on a not-for-proft basis. Cost Recovery requirements are a specific set of quantitative measures based upon direct costs incurred by a local operating unit in the production and support of the LEI operations. This section asks questions about the Candidate LOU’s awareness of and agreed compliance with this principle.

Access Groups Public - included on www.gleif.org Completed Data - Confidential as per the NDA

Update Frequency Asrequired subject to GLEIF review and discussion process and as set out in the Master Agreement.

©GLEIF2019 1911 VO1

Chapter 4: Guide | General Information for Accreditation Documentation Submission 26

Section Title 4.5 F LOU Services (page 10-13)

General Purpose Explaining the Candidate LOUs internal operations regarding service requirements for LOU services as per the Master Agreement

Description This set of questions parallels and reflects the services detailed in the Service Level Agreement.

Access Groups Public - included on www.gleif.org Completed Data - Confidential as per the NDA

Update Frequency Asrequired in the Master Agreement.

Section Title 4.6 G Required Website Items (page 14)

General Purpose Informing and confirming with the Candidate LOU the minimum requirements for its LEI website.

Description Self-explanatory.

Access Groups Public - included on www.gleif.org Completed Data - Confidential as per the NDA

Update Frequency Asrequired in the Master Agreement.

Section Title 4.7 H Records Management (page 15)

General Purpose Informing and confirming the Candidate LOU'’s obligations regarding historical LEI information.

Description Record retention and management is critical to the effectiveness of LEI operations and the GLEIS. The Candidate LOU must understand GLEIF requirements in this area. Available/retrievable historical data will become increasingly critical as the LEl population expands.

Access Groups Checklist Template - Public - included on www.gleif.org Completed Data - Confidential as per the NDA

Update Frequency Asrequired in the Master Agreement.

©GLEIF2019 1911 VO1

Chapter 4: Guide | General Information for Accreditation Documentation Submission 27

Section Title 4.8 | Software Development (page 16)

4.9 J Networks & Infrastructure (page 16) 410 KIT Security & Compliance (page 17)

General Purpose Explaining the information technology general controls in place.

Description The purpose of these sections is to provide GLEIF with an understanding of certain IT operational practices at the Candidate LOU’s data center whether it is in-house or outsourced.

If a Candidate LOU has a current third party controls assessment report (e.g. SAS70, SSAE16 SOC2) it can be submitted as supporting documentation. GLEIF requests the Candidate LOU to cross-reference the report(s) to the Checklist items to provide a clear record of understanding.

Access Groups Checklist Template - Public - included on www.gleif.org Completed Data - Confidential as per the NDA

Update Frequency Asrequired in the Master Agreement.

Section Title 411 L Data Quality Management (page 18 - 20)

General Purpose Understanding the Candidate LOU's internal procedures regarding the maintenance and measurement of LEI-related data quality.

Description Data Quality is a critical characteristic, which must be maintained in order to preserve the integrity of LEl data. The Candidate LOU'’s internal procedures provides information about how it maintains and measures the quality of its data and complies with ISO 17442:2019. This section also asks about the Candidate LOU’s procedures with respect to identifying and handling potential duplicate LEls. Lastly, questions are asked regarding LEI publishing and upload procedures.

All of these principles are reflected in the SLA which is available on GLEIF's website.

Access Groups Checklist Template - Public - included on www.gleif.org Completed Data - Confidential as per the NDA

Update Frequency Asrequired in the Master Agreement.

©GLEIF2019 1911 VO1

28 [ ] [ ] Certificate List The step is not addressed by the standard at the top, so would need to be asked/observed. The step is addressed by the standard at the top, so it may be skipped. Checklist Checklist Question Question Text elDAS ETSI WEB- Web- ISO ISO Section Topic Number ETSIEN X-Ref TRUST* trust 200071** 27007** 319 401 X-ref D 11 Has an independent audit of your financial Yes Principle statements been performed for your last 1 completed fiscal year? D 1.2 Has your audit firm/government regulatory Yes Principle agencies issued any management letters 1 relating to LEl operations over the past three years? - This would include commentary Going relating to internal controls, accounting Concern - controls and methods of procedures. D Parentand 1.3 Do you have an internal audit function? LOU D 1.3.1 Have they performed any audits within your organization relating to LEl operations? D 1.4 Have you been subject to any regulatory audits/reviews in your current year's operations? D 1.5 Do you have a formal LEI Operations Budget for this year and next year's operations? D 21 Are third party services (e. g. augmented staff, cloud services, data centers) utilized in order to provide LEl services? D 2.2 Do you have intellectual property and/or LEI proprietary methods/ systems which are i i ices? e employed in the delivery of LEl services? D 2.3 Are you currently involved with any litigation matters which could effect LEl services? D 2.4 Are you subject to regulatory compliance Yes 711113 Yes Principle requirements which could effect LE| operations? 3 E 1 Do you clearly understand the technical requirements of the Cost Recovery Principle? E 2 Do you confirm that the LOU business operations will comply with the Cost Recovery Principle at and after accreditation? E Cost 3 Does your agreed business plan include Recovery transparent financial information and Require- assumptions regarding the LOU services ments described in Section F? E 4 Do you clearly understand the requirements of the annual verification process and the independent cost recovery audit? E 5 Please confirm that your budget information as submitted conforms to the following definitions: © GLEIF2019 1911 VO1

Appendix 02 - Certificate List 29 The step is not addressed by the standard at the top, so would need to be asked/observed.

The step is addressed by the standard at the top, so it may be skipped. Checklist Checklist Question Question Text elDAS ETSI WEB- Web- ISO 1ISO Section Topic Number ETSIEN X-Ref TRUST* trust 20001** 27001** 319 401 X-ref F 11 Will you execute a formal contract either physically or electronically with a Legal Entity for every LEl issued? F 1.2 Does your legal entity contract template include all requirements as defined in the Master Agreement Appendix 5? F 1.3 Do you have a standard process for receiving payment from a legal entity for which an LEI was provided? F 1.4 Verifying against an authoritative source the Yes Principle accuracy of the LE-RD provided by the LE? 2 F 1.4.2 Verifying existence and eligibility of the Yes Principle entity applying for the LEI? 2 F 1.4.3 Verifying that the individual signing Yes Principle the application is duly empowered? 2 Issue New F LEls 1.4.4 Ensuring an up-to-date list of applicable Yes Principle accounting standards and authoritative 2 sources is used for verifying that the reported relationship exists? F 1.4.5 Verifying the existence and eligibility Yes Principle of the relationship information reported? 2 F 1.4.6 Informing the Legal Entity that either its Yes Principle application shall require amendment, shall 2 be refused, or the LEI has been issued and incorporated into the Global LE| repository? F 1.4.7 Reporting the correct relationship information of the Legal Entity? F 1.4.8 Uploading new LEI and LE-RD as well as relationship records to GLEIF? F 1.4.9 Accepting without delay and processing applications for an LEI? © GLEIF 2019 1911VO1

Appendix 02 - Certificate List 30 The step is not addressed by the standard at the top, so would need to be asked/observed.

The step is addressed by the standard at the top, so it may be skipped. Checklist Checklist Question Question Text elDAS ETSI WEB- Web- ISO ISO Section Topic Number ETSIEN X-Ref TRUST* trust 20007** 27007** 319 401 X-ref F 211 Providing an interface or mechanism for the Legal Entity to update LE-RD F 21.2 Maintaining procedures for verifying the change is duly empowered to do so by: ¢ Reverifying the authority of the requestor of the change? ¢ Reconfirming the authorized person’s Enter contact details including email address? LegalEntity ¢ Reconfirming the requestor email Events . . address is not generic? F 213 Checking, if an update to the relationship information is also required? F 214 Verifying via an authoritative source the accuracy of the Legal Entity Event change? F 21.5 Informing the Legal Entity of changed LE-RD and uploading the changed LE-RD to GLEIF? F 311 Reviewing and responding to LEl and LE-RD challenges transmitted to the LOU by GLEIF? F 312 Ensuring that the relationship information is Manage also reviewed and changed, where applicable? Challenges F 313 Informing the Legal Entity of validated challenges and uploading the changed LE-RD to GLEIF as applicable? ©GLEIF2019 1911 VO1

About this Manual / Accreditation Tools / Contact Details 4 About this Manual The purpose of this document is to provide an overview of the Accreditation Process, which is required for all Applicant LOUs and Candidate LOUs seeking to become an accredited local operating unit (LOU). In order to support the integrity of the GLEIS, local operating units must incorporate the vision and internal control requirements of GLEIF within its operations. The Accreditation Process has two distinct phases: Application (also referred to as the Plan Phase) and Candidacy (also referred to as the Documentation Phase). Each will be explained in detail in this Manual. Applicant/Candidate LOUs are responsible for reviewing the materials posted by GLEIF on its website and determining if they wish to proceed and be evaluated for accredited status. At a summary level, the Applicant LOU creates an Accreditation Plan that is a strategic document outlining the goals, objectives and capabilities of the Applicant LOU and how it envisions complying with GLEIF operational and control environment as well as fitting in with the GLEIF strategy. After progressing to Candidate LOU status, the Candidate LOU prepares the detailed Accreditation Documentation materials after signing the Master Agreement which progresses GLEIF's evaluation process. Accreditation Tools Applicant LOUs can start the Accreditation Process by sending an E-mail to accreditationrequest@gleif.org attaching a signed NDA which can be obtained at www.gleif.org. All materials required for the first stage of Accreditation are listed in the Accreditation Plan Checklist which is provided as a guide for Applicants in the Plan stage. GLEIF will grant the Applicant LOU access to GLEIF's customer portal to identified individuals provided by the Applicant LOU. Authorized users are also provided access to a virtual LOU Communications portal for the uploading of application documentation. All materials must be loaded into this space for GLEIF consideration. Additionally, all further Applicant/Candidate LOU communication must be managed through the customer portal (OTRS). No external communications will be accepted in order to maintain a proper audit trail.

©GLEIF2019 1911 VO1

Appendix 02 - Certificate List 31 The step is not addressed by the standard at the top, so would need to be asked/observed.

The step is addressed by the standard at the top, so it may be skipped. Checklist Checklist Question Question Text elDAS ETSI WEB- Web- ISO ISO Section Topic Number ETSIEN X-Ref TRUST* trust 200071** 27001** 319 401 X-ref F 4.1 Do you have a process in place for a Legal Entity to request transfer of a LEI? F 4.2 Does your process ensure that: F 421 The defined and established transfer rules in the GLEIS are followed? F 422 Procedures for verifying the individual requesting the LEI transfer is duly empowered to do so are in place? Transfer F PR 4.2.3 The associated relationship information LE-RD is transferred as well? F 4.2.4 LE-RD is verified via an authoritative source? F 4.2.5 Relationship information is correctly transferred as well? F 4.2.6 The Legal Entity is informed (as applicable)? F 427 The LEl and its changed LE-RD are uploaded to GLEIF? © GLEIF2019 1911 VO1

Appendix 02 - Certificate List 32 The step is not addressed by the standard at the top, so would need to be asked/observed.

The step is addressed by the standard at the top, so it may be skipped. Checklist Checklist Question Question Text elDAS ETSI WEB- Web- ISO ISO Section Topic Number ETSIEN X-Ref TRUST* trust 20007** 27007** 319 401 X-ref F 5.1 Are there procedures in place for: Yes Principle 2 F 511 Notifying Legal Entity of upcoming Yes Principle renewal requirements? 2 F 512 Providing an interface or mechanism for Yes Principle the Legal Entity to renew? 2 F 513 Maintaining procedures for verifying the individual requesting the LEl renewal is duly empowered to do so? F 514 Uploading the relationship information Yes Principle as well? 2 F 515 Verifying via an authoritative source the accuracy of the LE-RD? F 5.1.6 Informing the Legal Entity about any missing Yes Principle or incorrect entries? 2 F 517 Checking for duplicates including Yes Principle relationship information? 2 F 518 Receiving secure payments for the renewal? F 519 Adjusting the LEI and relationship status Yes Principle Renewals as applicable to recognize renewal or 2 of LEIS non-renewal? F 5.1.10 Informing the Legal Entity of renewal or Yes Principle non-renewal status? 2 F 51M Uploading the changed LE-RD and the Yes Principle updated relationship information to GLEIF? 2 F 5.2 If you are planning to use multiple-year renewal contracts, can you please confirm that there are procedures in place for ensuring that the following will be performed on annual basis within the contract period: F 5.21 Informing the Legal Entity about any missing or incorrect entries? F 522 Checking for duplicates including relationship information? F 523 Adjusting the LEI and relationship status as applicable to recognize renewal or non-renewal? F 524 Informing the Legal Entity of renewal or non-renewal status? F 525 Uploading the changed LE-RD and the updated relationship information to GLEIF? © GLEIF 2019 1911 VO1

Appendix 02 - Certificate List 33 The step is not addressed by the standard at the top, so would need to be asked/observed.

The step is addressed by the standard at the top, so it may be skipped. Checklist Checklist Question Question Text elDAS ETSI WEB- Web- ISO ISO Section Topic Number ETSIEN X-Ref TRUST* trust 200071** 270071** 319 401 X-ref F 6.1 Are there procedures in place for checking against GLEIF's Check for Duplicates facility and process as defined? Please explain. Check for F Duplicates ] Are there procedures in place to avoid any types of duplicates in the system? Please explain. F 71 Are there procedures in place to ensure the Yes Code Lists implementation of the code lists updates within the defined timeframe? Please explain. F 8.1 Are there procedures in place for checking against GLEIF's Data Governance Pre-Check APl as defned? Please explain. Data F Governance B Are there procedures in place to avoid any data quality failures in the system? Please explain. F Metric Data IR Do you measure the Service Levels as defined Collection in the Service Level Agreement? F 10.1 Do you currently utilize third party services such as registration agents? F 10.11 Does your organization have a formal vetting process for evaluating the reliability of a third-party service provider or registration agents? If so, does it consider: F 10.2 Do you have a formal vetting process for evaluating the reliability of a third-party Third Party service provider or. registration agents? Resources/ If so, does it consider: Registration F Agents 10.21 Financial stability F 10.2.2 Market reputation F 10.2.3 Abilities to meet LOU and GLEIF control requirements? F 10.2.4 Evaluating the potential risks of utilizing the services provided © GLEIF2019 1911 VO1

Appendix 02 - Certificate List 34 The step is not addressed by the standard at the top, so would need to be asked/observed.

The step is addressed by the standard at the top, so it may be skipped. Checklist Checklist Question Question Text elDAS ETSI WEB- Web- ISO ISO Section Topic Number ETSIEN X-Ref TRUST* trust 200071** 270071** 319 401 X-ref G 11 Provide a transparent means for Legal Entities to understand the process of requesting an LEl or LEI transfer? G 1.2 Provide a transparent means for Legal Entities to understand the process of requesting an LEl or LEI transfer? Required G Website 13 Incorporate all terms and requirements of Items GLEIF's Terms of Use as defined in Appendix 9b of the Master Agreement? G 1.4 Display your accreditation certificate on your LOU homepage? G 1.5 Display the GLEIF logo? H 1 Do you maintain a complete audit trail in compliance with ISO 17442:2012 data attributions and other Common Data File format elements (Level 1business card data and Level 2 relationship data) for all actions affecting the content or status of LEI records? H 2 Is a particular function responsible for all Yes 71.2/ Yes Principle Yes Yes aspects of record retention as per your 710 3 established internal policies? What is your testing process and periodicity? H 3 Is periodic training provided to all relevant Yes 71.2/ Yes Principle Yes Yes personnel (including employees, contractors 710 3 and temporary staff) to make them aware of your Records Management procedures? Please provide a brief narrative and copies Records of all relevant policies Management H 4 Do you process paper records? If yes, are there specific retention policies regarding this? H 5 Do you create and maintain an internal list/ Yes 71.21 Yes Principle Yes index of relevant records and/or storage 710 3 archives which includes information relating to Retention Periods and is it periodically updated? Please provide a brief narrative and copies of all relevant policies H 6 Do you ensure indexing, scanning, retrieval, Yes 7.3.2/ Yes Principle Yes storage and destruction processes are 710 3 documented, communicated, and tested at least annually? Please provide a brief narrative and copies of all relevant policies © GLEIF2019 1911 VO1

Appendix 02 - Certificate List 35 The step is not addressed by the standard at the top, so would need to be asked/observed.

The step is addressed by the standard at the top, so it may be skipped. Checklist Checklist Question Question Text elDAS ETSI WEB- Web- ISO ISO Section Topic Number ETSIEN X-Ref TRUST* trust 200071** 270071** 319 401 X-ref H 71 All LEI data elements (Level 1business card data and Level 2 relationship data) for the current LElI and all of its associated changes? Please provide a brief narrative and copies of all relevant policies H 711 If yes, do the records include: H effective date of any change(s) H the entity responsible for the change(s) H the reason for each change(s) H who performed the change(s) Records H Management who authorized the change(s) H 72 Identification of Data Sources Yes 7.3.2/ Yes Principle Yes for each issuance/change? 710 3 H 8 Do you ensure access to relevant records is Yes 7.3.2/ Yes Principle Yes restricted to only those employees who are 710 3 appropriately authorized and need access to perform their duties? H 9 Do you ensure control procedures relating to Yes 7.3.2/ Yes Principle Yes Yes the physical and environmental protection of 7.6 3 relevant records, including archived datais in place and functioning properly? H 10 Do you ensure relevant records are only Yes 7.3.2/ Yes Principle Yes destroyed in compliance with your procedures 710 3 and any local or legal requirements? © GLEIF2019 1911 VO1

Appendix 02 - Certificate List 36 The step is not addressed by the standard at the top, so would need to be asked/observed.

The step is addressed by the standard at the top, so it may be skipped. Checklist Checklist Question Question Text elDAS ETSI WEB- Web- ISO ISO Section Topic Number ETSIEN X-Ref TRUST* trust 200071** 270071** 319 401 X-ref 11J 1 Do you have a document which describes the Yes 741771 Yes Principle Yes software development tools and environment 7.8 3 in place for the LEI operation? 11J 2 Do you have a formal process for developing Yes 741771 Yes Principle Yes and approving new software? 7.8 3 11J 3 Do you have any outsourced software development arrangements relating LEl operations? 11J 4 Do you have a process in place for identifying, Yes 741771 Yes Principle Yes tracking and correcting software errors/bugs? 7.8 3 11J 5 Do you have standard IT service management Yes 741771 Yes Principle Yes Yes processes in place? Please provide evidence 7.8 3 that these are followed and maintained as needed. This would include a patching process Software and upgrade/update policies and procedures. Develope- 11) ment/ 2 Please describe the current server/hosting Yes 741771 Yes Principle Yes N environment? Is it hosted, in-house, via a 7.8 3 and third party, etc.? Describe the use of any Infrastructurel cloud-based resources such as Amazon Web Services or Microsoft Azure. 11) 3 Do you perform any monitoring over Yes 741771 Yes Principle Yes Yes the LEl related IT infrastructure? 7.8 3 11) 4 Are there any redundancies built into Yes 741771 Yes Principle Yes the hosting platform and hardware? 7.8 3 11J 5 Has there been any unscheduled network or system downtime in the past twelve months? 11J 6 Do you have a current disaster recovery and/ Yes n Yes Principle Yes Yes or business continuity plan in place? How 3 oftenis it tested? Has the plan been invoked during the past 3 operating years? 11J 7 Do you have structured backup policies Yes n Yes Principle Yes Yes and practices? 2 © GLEIF2019 1911 VO1

Appendix 02 - Certificate List 37 The step is not addressed by the standard at the top, so would need to be asked/observed.

The step is addressed by the standard at the top, so it may be skipped. Checklist Checklist Question Question Text elDAS ETSI WEB- Web- ISO ISO Section Topic Number ETSIEN X-Ref TRUST* trust 200071** 270071** 319 401 X-ref K 1 Have you performed or engaged a third party to test system vulnerability, intrusion detection or perform penetration testing? Please list all vendors as applicable. Relevant process documents and most current reports K 2 Do you maintain firewall(s)? Relevant Yes 7.3179 Yes Principle Yes process documents and technical diagrams; 3 please describe its purpose and your monitoring procedures. K 3 Is access to source code and other critical Yes 72 Yes Principle Yes resources (documents, contracts etc.) 3 . monitored and tracked? Relevant process IT Security documents and technical diagrams and K Compliance Are there any users that are not subject to the Yes 7.2 Yes Principle Yes standard security policies of the Company/ 3 Business Unit/Department? Relevant process documents and list of exceptions K 5 Are there non-employees who have Yes 72 Yes Principle Yes access to critical company information 3 (source code, documentation etc.)? Relevant process documents and list of exceptions K 6 Are terminated employees/contractors Yes 72 Yes Principle Yes removed from access to LOU systems/ 3 resources in a timely manner? Relevant process documents and technical diagrams © GLEIF2019 1911 VO1

Appendix 02 - Certificate List 38 The step is not addressed by the standard at the top, so would need to be asked/observed.

The step is addressed by the standard at the top, so it may be skipped. Checklist Checklist Question Question Text elDAS ETSI WEB- Web- ISO ISO Section Topic Number ETSIEN X-Ref TRUST* trust 200071** 270071** 319 401 X-ref K 7 Do you have password policies for the Yes 7.2 Yes Principle Yes networks and systems, including length 3 and Complexity, and any expiration policies? Relevant process documents, technical diagrams and most current reports K 8 Do you have procedures in place to identify, Yes 7.3/ Yes Principle Yes report and remediate any security breaches? 79 2 K 9 Do you have any physical access restrictions Yes 7.3/ Yes Principle Yes to critical company assets such as servers 7.6 2 and data? Relevant process documents, IT Security technical diagrams and most current reports and K Compliance 10 Have you had any IT operational or security audits (i. e. SSAE 16, SAS70) performed in the past three years? Relevant process documents and results of last testing cycle K n Have you had any LEl-related security breaches in the past five years? Relevant process documents, technical diagrams and most current reports K 12 Do you have your compliance activities in Yes 73 Yes Principle Yes place to ensure compliance with respect 3 to all applicable Data Privacy Laws? © GLEIF2019 1911 VO1

Appendix 02 - Certificate List 39 The step is not addressed by the standard at the top, so would need to be asked/observed.

The step is addressed by the standard at the top, so it may be skipped. Checklist Checklist Question Question Text elDAS ETSI WEB- Web- ISO ISO Section Topic Number ETSIEN X-Ref TRUST* trust 200071** 270071** 319 401 X-ref L 11 Does your organization have a governance Yes 79 Yes Principle Yes Yes framework that enables it to adhere to GLEIS 3 standards? If yes, please explain how this governance framework is structured. L 1.2 Does your organization have a continuous Yes Yes improvement process for data quality in place? If yes, please explain what the process steps are. L 1.3 Does your organization have a continuous Yes improvement process for adapting to procedural changes as required for adjustments to ROC or GLEIF standard and operating principles? Please explain. L 1.4 Does your organization have a defined implementation period expectation for different types of adjustments? Please explain. L 21 Do you have an established data library that defines proper values for fields entered in a LEl request? L Data Quality 2.2 Do you prevent unlikely or incorrect data Management in submissions of LEl requests? L 2.3 Do you maintain procedures for: L 2.31 Do you maintain procedures for: Verifying the LE-RD based on the Legal Entity jurisdiction, entity category and legal form? L 2.32 Do you maintain procedures for: Ensuring an up-to-date list of authoritative sources used for verification is maintained, accessible and usable at all times with no restriction for all below services? L 2.32A Issue new Lei L 2.328B Enter Legal Entity Events L 2.32C Manage Challenges L 232D Transfer of LEls and LE-RD L 2.32E Renewal of LEls (Inlc.multiple-year renewal contract) © GLEIF2019 1911 VO1

Appendix 02 - Certificate List 40 The step is not addressed by the standard at the top, so would need to be asked/observed.

The step is addressed by the standard at the top, so it may be skipped. Checklist Checklist Question Question Text elDAS ETSI WEB- Web- ISO ISO Section Topic Number ETSIEN X-Ref TRUST* trust 200071** 270071** 319 401 X-ref L 233 Do you have sufficient proficiency for understanding or interpreting authoritative sources? L 2.34 Do you use other sources not listed in the GLEIF Registration Authorities list for verification/validation? If yes, please specify. L 2.4 Do you have sufficient language proficiency in the jurisdictions you are applying for understanding and interpreting the following? If yes, please list all languages. L 2.41 The information you receive from the legal entity? L 2.4.2 The information provided in the corresponding authoritative source for validation? L 2.5 Do you have validation procedures in place for: L 2.51 Verifying that a Legal Entity is eligible for an LEl code? Data Quality L Management B ¥3p] Provision of corresponding language tags for the set of specified fields? L 253 Incorporating Transliteration data for all below services? L 253A Issue new LEI L 253B Enter Legal Entity Events L 253C Manage Challenges L 253D Transfer of LEls and LE-RD L 253E Renewal of LEls (Inlc.multiple-year renewal contract) L 254 Ensuring that LEls are only issued when validation process is successfully completed? L 255 Verifying the LEI Record Set is compliant with the Common Data File (CDF) format (as published per www.gleif.org) © GLEIF2019 1911 VO1

About this Manual / Accreditation Tools / Contact Details 5 [ ] [ ]

Accreditation Documents

Applicant LOUs will need to refer to the documents listed below to initiate and complete their

accreditation application to GLEIF:

Accreditation Stage Topic Document Location

Overall Accreditation Program Master Agreement https://www.gleif.org/en/about-lei/

. the-lifecycle-of-a-lei-issuer/gleif- (all Appendlces) accreditation-of-lei-issuers/required- documents#

Overall Accreditation Program Accreditation Manual https://www.gleif.org/en/about-lei/ the-lifecycle-of-a-lei-issuer/gleif-

App.02 S T T S ( PP ) accreditation-of-lei-issuers/required- documents#

Overall Accreditation Program Accreditation Checklist https://www.gleif.org/en/about-lei/ the-lifecycle-of-a-lei-issuer/gleif-

App.02 e e ( PP ) accreditation-of-lei-issuers/required- documents#

Plan Phase - Applicant LOU Non-Disclosure Agreement https://www.gleif.org/en/about-lei/ the-lifecycle-of-a-lei-issuer/gleif- accreditation-of-lei-issuers/required- documents#

Plan Phase - Applicant LOU Plan Accreditation Checklist https://www.gleif.org/en/about-lei/ the-lifecycle-of-a-lei-issuer/gleif- accreditation-of-lei-issuers/required- documents#

Plan Phase - Applicant LOU Registry Inventory https://www.gleif.org/en/about-lei/

Spreodsheet Form the-life:cyc!e-of-o-I(.-:‘i.-issuer/gleif-. accreditation-of-lei-issuers/required- documents#

Plan Phase - Applicant LOU Funds Questionnaire https://www.gleif.org/en/about-lei/ the-lifecycle-of-a-lei-issuer/gleif- accreditation-of-lei-issuers/required- documents#

Plan Phase - Applicant LOU Estimated LEI Volume Analysis https://www.gleif.org/en/about-lei/ the-lifecycle-of-a-lei-issuer/gleif- accreditation-of-lei-issuers/required- documents#

GLEIF Contact

Accreditation Requests accreditationrequest@gleif.org

General Accreditation Information accreditation@gleif.org

General Information info@gleif.org

©GLEIF2019 1911VO1

Appendix 02 - Certificate List 41 The step is not addressed by the standard at the top, so would need to be asked/observed.

The step is addressed by the standard at the top, so it may be skipped. Checklist Checklist Question Question Text elDAS ETSI WEB- Web- ISO ISO Section Topic Number ETSIEN X-Ref TRUST* trust 200071** 270071** 319 401 X-ref L 2.5.6 Ensuring a LEI complies with GLEIF Operational and Technical Standards (Data Quality Rule Setting) during all below services: L 256A Issue new LEI L 2568B Enter Legal Entity Events L 256C Manage Challenges L 256D Transfer of LEls and LE-RD L 256E Renewal of LEls (Inlc.multiple-year renewal contract) L 257 Researching the content of the challenge and verifying the challenge via an authoritative data source? Please explain. L 2.6 Do you comply with ISO 174427 L 3.1 Do you have procedures in place for handling Data Quality each of the following: Checking that the Management LEI code does not exist already in the Global LEI Index? L 3.2 Do you have procedures in place for handling each of the following: Checking, that the legal entity does not have an assigned LEI code already? L 3.3 Do you have procedures in place for handling each of the following: Checking that no duplicate relationships exist? L 3.4 Do you have procedures in place for handling each of the following: I[dentifying Exclusivity Violations by using automated routines? L 3.5 Do you have procedures in place for handling each of the following: Checking the received feedback from GLEIF's Check for Duplicates facility? L 3.6 Do you have procedures in place for handling each of the following: Ensuring that all newly issued LEls are processed by GLEIF's Check for Duplicates facility? © GLEIF2019 1911 VO1

Appendix 02 - Certificate List 42 The step is not addressed by the standard at the top, so would need to be asked/observed.

The step is addressed by the standard at the top, so it may be skipped. Checklist Checklist Question Question Text elDAS ETSI WEB- Web- ISO ISO Section Topic Number ETSIEN X-Ref TRUST* trust 200071** 270071** 319 401 X-ref L 4.1 Have you integrated the Data Governance Yes Yes Pre-Check APl into your processes? If yes, please describe briefly. L 4.2 Do you process the received feedback from Yes GLEIF's Data Governance Pre-Check L 4.3 Do you ensure that all newly issued and updated LEls are processed by GLEIF's Data Governance API to fulfil the Completeness Service Level Target? Please explain briefly. Data Quality L Management ISl Do you have procedures to ensure: Timely response to any GLEIF communication concerning doubts, inconsistencies, or data quality issues of the uploaded data? L 5.2 Do you have procedures in place to ensure: Uploading LEl records at least daily? L 5.3 Do you have procedures in place to ensure: Confirmation to GLEIF via the GLEIF interface/ communications protocol indicating a daily “live signal” given no LEI activity occurs? * Applicant would need to ** Subject to limitations confirm that the same control noted in report scope applied to certificates would be (e. g. locations) applied to LEls. Principles apply specifically to certificates only. © GLEIF2019 1911 VO1

G LE I F Enabling global identity Protecting digital trust Global Legal Entity Identifier Foundation (GLEIF) St. Alban-Vorstadt 12, PO Box 4002 Basel Switzerland accreditation@gleif.org gleif.org Chairman of the Board: Teresa Glasser Chief Executive Officer: Stephan Wolf © 2019 All rights reserved ©GLEIF2019 1911 VO1

6

Accreditation Requirements 1.1 Accreditation Eligibility Any organization in any geographic location may apply to become a local operating unit with the exception of a sole proprietorship or “natural person”. An organization which does not successfully complete the Accreditation Process due to timing deadlines or a decision of GLEIF may re-apply for Accreditation at a future date of its choosing. 1.2 Fundamentals Every Applicant/Candidate LOU is required to successfully complete the Accreditation Process in order to achieve accredited local operating unit status. The Accreditation Process evaluates an Applicant/Candidate LOU's financial, operational and information technology controls using GLEIF's internal control questionnaire which is referred to as the Accreditation Checklist. The specific areas of review are documented in this Manual. For the avoidance of doubt, GLEIF is obliged to accredit a Candidate LOU if and when its Accreditation Plan has been fulfilled and all criteria for Accreditation Documentation have been met. GLEIF believes, as part of its founding principles, that every Applicant/Candidate LOU shall be treated in a fully transparent manner with consistent processes and evaluation criteria. GLEIF acknowledges, however, that every Applicant/Candidate LOU will have its own unique profile and requirements as it considers entering into Accreditation. The same set of questions and documentation requirements will be presented to all Applicant/ Candidate LOUs. There are three (3) key documents that comprise GLEIF's Accreditation Documentation. They are the Master Agreement (MA and its appendices), the Accreditation Manual (this document), and the Accreditation Checklist. Basic definitions of each document can be found at Step 1 of the Accreditation Process section of this Manual. In addition to these materials, the Accreditation Process includes data quality test procedures utilizing test scenarios and sample data. These requirements are described in the Process Flow Step 3.3 Step 6b. As an Applicant/Candidate LOU reviews the Accreditation Checklist, the Applicant/Candidate LOU may believe that some questions are not applicable to its particular circumstances or operational model and should adapt its responses accordingly. 1.2.1 Certifications Organizations that hold any of the certificates included in the Appendix 02-Certificate List, at the end of this document, may be subject to a simplified Accreditation Process, through skipping certain

sections of the Accreditation Checklist document, where applicable. The decision to allow Candidate LOUs to skip sections of the Accreditation checklist is at the sole discretion of GLEIF.

© GLEIF 2019 1911 VO1

Chapter 1: Accreditation Requirements 7 1.3 Cost Recovery Accredited LOUs in the GLEIS must operate in a financially sustainable way. The Master Agreement describes in full the cost recovery principle and annual verification requirements. Accredited Local operating units must not consider the issuance and maintenance of LEls as driven by profit considerations. The Applicant LOU must acknowledge with the submission of its Accreditation Plan that it intends to operate on a cost recovery basis. The Accreditation Checklist requires that certain questions be answered and documentation provided to further validate this point during the Documentation Phase. 1.4 Organizational Reputation An Applicant LOU must have a good reputation in its marketplace as it is representative of the values and mission of the GLEIS. A business can achieve its objectives more easily if it has a good reputation amongst its stakeholders, especially the public, regulators and authorities, large customers, opinion leaders in the business community, and suppliers. Applicants should be aware that this aspect of its organization may be considered in the Accreditation Process as well as concerns or comments brought to GLEIF's attention. While the Accreditation Process is non-public, once an Applicant LOU executes the Master Agreement with GLEIF and is designated as Candidate LOU, this fact is published on GLEIF's website as a matter of public record. However, their detailed status within in the accreditation process will not be published. Continued good reputation is a standard that all are required to uphold. 1.5 Conflicts of Interest GLEIF defines a Conflict of Interest (COl) as:

“A set of circumstances that creates a risk that professional judgment

or actions regarding a primary interest will be unduly influenced by

a secondary interest. Primary interest refers to the principal goals of

the profession or activity, such as the protection of clients or duties

of public office. Secondary interest includes not only financial gain but

also such motives as the desire for professional advancement and the

wish to do favors for family and friends.” Given the value and sensitivity of the services the local operating units provide, GLEIF will not accept any degree of COI given the irredeemable reputational harm it could cause. The Applicant/ Candidate LOU is requested to report any potential COI situations to GLEIF's Head of Accreditation & Audit Services explaining the circumstances, actions,

and remediation implemented to address the COIl.

©GLEIF2019 1911 VO1

Chapter 1: Accreditation Requirements 8 1.6 Accreditation Internal Control Standards GLEIF has not adopted any single internal control standard as a requirement for LOU Accreditation. However, it has identified key control topics it considers critical to the overall integrity of LOU operations. These are reflected in the Accreditation Checklist. This is not a prescriptive model -the LOU is free to implement its own internal control structures based upon its own business requirements as long as they meet spirit and substance of the GLEIF standards. When developing the Accreditation Checklist, GLEIF considered and incorporated control standards referring to generally accepted models such as ISO, COSO, and CoBIT. It also reflects the principles of the CPSS-10SCO and ICC standards. 1.7 Accreditation Processing Order Accreditation processing order is based on a FIFO (First In First Out) principle depending on the timeliness and completeness of the Applicant/Candidate LOU’s submissions. Applications which are incomplete and/ or require additional documentation may be impacted with significantly delayed processing times which can effect the precedence of their application. 1.8 Confidentidlity Confidentiality is set out in the non-disclosure agreement. 1.9 Accreditation Appeals and Complaints Appeals and Complaints by the Applicant/Candidate Regarding Accreditation GLEIF's goal is to amicably resolve any complaints or appeals. The Applicant LOU or Candidate LOU has the right to petition GLEIF for an appeal and/or reconsideration of a decision. The Applicant or Candidate LOU must inform GLEIF by delivering to GLEIF's Head of Accreditation & Audit Services, in writing, the full facts and exact references to GLEIF's decision and the reason(s) why the Applicant LOU or Candidate LOU disagrees with the decision. This communication must be received within thirty (30) days of the date GLEIF communicated a decision to the Applicant LOU or Candidate LOU. Candidate LOUs also have the right to enter into independent Mediation or Arbitration (as documented in the Master Agreement) if they it believe that a satisfactory resolution has not been, or cannot be achieved. Complaints about an Applicant/Candidate Received by GLEIF GLEIF may advise an Applicant LOU or Candidate LOU of complaints received from outside parties. All such complaints must be received in writing with specific detail to be evaluated by GLEIF. The receipt of a complaint will be acknowledged to the complainant

within fourteen (14) days. GLEIF will review all such complaints with the Applicant/Candidate LOU, as appropriate within thirty (30) days of the receipt of the complaint.

For the avoidance of doubt, when an Applicant/Candidate LOU submits a third

party report as part of the Accreditation Documentation, the Applicant/Candidate

LOU must indicate which sections are applicable to which questions/sections of the

Accreditation Checklist. In these cases, the Applicant/Candidate LOU

unless requested by GLEIF. ©GLEIF2019 1911 VO1

Chapter 1: Accreditation Requirements 9 1.10 Continuous Improvement of Accreditation GLEIF regularly evaluates its accreditation criteria and process for best practices to ensure its relevance. Any material changes to this Manual or the Accreditation Checklist will be managed per the terms of the Master Agreement “Agreement Change Process.” 1.11 Use of Third Party Assessment Reports in Accreditation The Applicant/Candidate LOUs may integrate the control assessment and reporting requirements for becoming an accredited LOU with any independent auditing activity that is carried out with respect to its organization(s). If an Applicant/Candidate LOU has a current third party opinion/ report from independent, qualified internal auditors, external auditors or, regulatory auditors or independent consultants with respect to the subjects included in the Accreditation Checklist, these reports may be submitted as evidence as to the adequacy and effectiveness of internal controls. The Applicant/Candidate LOU must cross-reference such reporting to the appropriate Checklist item and provide direct responses to questions about areas not included in these reports. 1.12 Use of Third Party Service Providers in Accreditation The Applicant/Candidate LOU may utilize third party service providers for certain functions in the issuance and maintenance of LEls. The terms and conditions for this are detailed in the Master Agreement. Appendix 14. 1.13 Letters of Assurance It is critical that an accredited LOU maintain its financial viability both in practical terms as well as with respect to the reputation of the GLEIS as a whole. When performing its financial assessment, GLEIF evaluates both independent information, such as audit reports as well a unverified information from the Applicant/Candidate, such as operating budgets. GLEIF, at its sole discretion, may require an Applicant/Candidate LOU to provide a letter of assurance, guarantee or confirmation of financial sources and/or support from an Applicant/Candidate LOU'’s parent organization(s) indicating its ultimate responsibility for the Applicant/Candidate LOU'’s financial soundness. If such a document is not provided upon request, GLEIF, at its sole discretion may terminate any contractual obligations with the Applicant/Candidate LOU as per the process agreed in the Master Agreement.

©GLEIF2019 1911 VO1

(0] Roles and Responsibilities 2.1 Applicant LOU * Issues accreditation request * Prepares the Accreditation Plan * Submits the Accreditation Plan * Signs the Master Agreement 2.2 Candidate LOU * Provides all required documentation » Completes Accreditation requirements * Submits Accreditation documentation 2.3 Accredited LOU ° Complies with GLEIF requirements as defined in the Master Agreement including the Cost Recovery Principle and the Annual Accreditation Verification process. * Publishes Accreditation Certificate on its website 2.4 GLEIF * Processes all Accreditation Applications » Reviews and evaluates Accreditation Plan » Assesses feasibility and impacts on marketplace and GLEIS of Accreditation Plan » Signs the Master Agreement ° Reviews and evaluates Accreditation Documentation ° Communicates Accreditation decisions » Publishes newly accredited LOUs on GLEIF website » Monitors Accredited LOU activities and performance 2.5 GLEIF CEO * Reviews and approves all Applicant and Candidate accreditations 2.6 GLEIF Board * Monitors all Applicant and Candidate accreditations 2.7 ROC * Oversees Accreditation activities of GLEIF » Endorses GLEIF process of Accreditation » Supervises the GLEIS © GLEIF2019 1911 VO1