O:GLEIF, Protecting digital st verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Primary Document Public Document Version 1.0 2022-12-16 . . - I!Q ry - . F . ‘ - . O 2 ga_‘ _..; S SN A 38460 | :/ ; Soe— f.‘.
N L\ - ey B e 5 . N e S o‘__: .. / J ° ‘ A ° s O ~ . .
) . " - ’ o N | -
The DID URL to this Primary Document is: did:keri:EINmHd5g7iV-UldkkkKyBIHO52blyxZNBn9pg- zNrYoS?service=vlei-documents&relativeRef=/egf/docs/2022-12-16_verifiable-LEI-(VLEI)-Ecosystem- Governance-Framework-Primary-Document_v1.0_final.docx The 1.0 Draft can be viewed at: https://www.gleif.org/en/lei-solutions/gleifs-digital-strategy-for-the-lei/introducing-the-verifiable- lei-vlei verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 2 of 12 Primary Document Public Document Version 1.0 @ 2022-12-16_verifiable-LEI-(vLEl)-Ecosystem-Governance-Framework- 2022-12-16 Primary-Document _v1.0_final.docx
Business Requirements verifiable LEI (vLEI) Ecosystem Governance Framework Business Requirements v1.0 This document specifies certain business requirements for the vLEI services of GLEIF and Qualified VLEI Issuers (QVIs). Technical Requirements verifiable LEI (vLEI) Ecosystem Governance Framework Technical Requirements Part 1: KERI Infrastructure, v1.0 verifiable LEI (VLEI) Ecosystem Governance Framework Technical Requirements Part 2: vLEI Credentials, v1.0 verifiable LEI (VLEI) Ecosystem Governance Framework Technical Requirements Part 3: Technical Schema Types SAIDs Information Trust Requirements verifiable LEI (vLEI) Ecosystem Governance Framework Information Trust Policies, v1.0 A document that defines the information security, privacy, availability, confidentiality, and processing integrity policies that apply to vLEI Ecosystem stakeholders. Legal Agreements vLEI Issuer Qualification Agreement, v1.0 An agreement between GLEIF and an organization that has been qualified by GLEIF to operate as a Quialified vLEl Issuer (QVI). The vLEl Issuer Qualification Agreement will be the same for all QVIs. Appendices to vLEI Issuer Qualification Agreement Appendix 1: Non-Disclosure Agreement (NDA), v1.0 An agreement that outlines requirements for handling confidential information. Appendix 2: vLEI Issuer Qualification Program Manual, v1.0 The document that describes the Qualification program. Appendix 3: vLEI Issuer Qualification Program Checklist, v1.0 The document that details the control and process requirements for Qualification. Appendix 4: vLEI Issuer Contact Details, v1.0 A list of contact details of GLEIF and the Candidate vLEI Issuer during Qualification and of GLEIF and the QVI during ongoing operations. Appendix 5: Qualified vLEI Issuer Service Level Agreement (SLA) v1.2 A document that details the services to be provided by GLEIF and Qualified vLEI Issuers. Appendix 6: Qualified vLEI Issuer TrustMark Terms of Use, v1.0 A document that details the terms of use of the TrustMark by a QVI. Appendix 7: Qualified vLEI Issuer-Legal Entity Required Contract Terms, v1.0 A document that specifies the contract terms that must be included in the agreement between a QVI and a Legal Entity for vLEI services. verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 11 of 12 Primary Document Public Document Version 1.0 GLEIF 2022-12-16_verifiable-LEI-(vLEl)-Ecosystem-Governance-Framework- 2022-12-16 Primary-Document _v1.0_final.docx
Identifier and Credential Governance Frameworks GLEIF Identifier Governance Framework, v1.0 A document that details the purpose, principles, policies, and specifications that apply to the use of the GLEIF Root Autonomic Identifier (AID) and its GLEIF Delegated AlDs in the vLEI Ecosystem. Qualified vLEl Issuer Identifier and vLEI Credential Governance Framework, v1.0 A document that details the requirements to enable the Delegated AlIDs and the vLEI to be issued by GLEIF to QVIs which allows the QViIs to issue, verify and revoke Legal Entity vLEI Credentials, Legal Entity Official Organizational Role VLEI Credentials and Legal Entity Engagement Context Role vLEI Credentials. Qualified vLEl Issuer Authorization vLEI Credential Governance Framework, v1.0 A document that details the requirements for this vLEI to enable the simple, safe, secure instruction and authorization by a Legal Entity Authorized Representative (LAR) sent to a QVI for the issuance and revocation of vLEI Role Credentials. Legal Entity vLEI Credential Governance Framework, v1.0 A document that details the requirements for a vLEI as the entity level credential issued by a QVI to a Legal Entity. Legal Entity Official Organizational Role vLEIl Credential Governance Framework, v1.0 A document that details the requirements for vLEI Role Credentials issued to by a QVI to official representatives of a Legal Entity. Legal Entity Engagement Context Role vLEI Credential Governance Framework, v1.0 A document that details the requirements for vLEI Role Credentials issued to representatives of a Legal Entity in other than official roles but in functional or other context of engagement. verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 12 of 12 Primary Document Public Document Version 1.0 GLEIF 2022-12-16_verifiable-LEI-(vLEl)-Ecosystem-Governance-Framework- 2022-12-16 Primary-Document _v1.0_final.docx
Introduction The verifiable LEI (vLEI) Ecosystem Governance Framework is a Layer Four Ecosystem Governance Framework of the Trust over IP Foundation (TolP). The Legal Entity Identifier (LEl) is used as a key component in building a trust layer for identification and verification of organizational identity that can be used in any other Governance Frameworks that require organizational identity. The LEI had its beginnings in the aftermath of the global financial crisis responding initially to a call by global regulators to establish a standard international identifier *and related reference data that could be accessed and used in regulatory frameworks and supervision. The LEIl and the Global LEI System were envisioned from the start as a public-private partnership that should bring transparency and benefits to both the public and the private sectors. And although the LEl was used initially to identify legal entities in financial services, the need for identification of legal entities is not limited to the financial services domain. Now, years after the Global LEI System was established, which the Global Legal Entity Identifier Foundation (GLEIF) operates and maintains, this Governance Framework establishes GLEIF’s role in digital identity and Authentic Chained Data Container (ACDC) Credentials to add trust to interactions in the global digital economy. Terminology TolP Governance Requirements Glossary * Requirements include any combination of Machine-Testable Requirements and Human- Auditable Requirements. Unless otherwise stated, all Requirements MUST be expressed as defined in RFC 2119. * Mandates are Requirements that use a MUST, MUST NOT, SHALL, SHALL NOT or REQUIRED keyword. ¢ Recommendations are Requirements that use a SHOULD, SHOULD NOT, or RECOMMENDED keyword. o Options are Requirements that use a MAY or OPTIONAL keyword. » Machine-Testable Requirements are those with which compliance can be verified using an automated test suite and appropriate scripting or testing software. © Rules are Machine-Testable Requirements that are written in a Machine-Readable language and can be processed by a Rules Engine. They are expressed in a structured rules language as specified by the Governance Framework. verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 3 of 12 Primary Document Public Document Version 1.0 GLEIF 2022-12-16_verifiable-LEI-(vLEl)-Ecosystem-Governance-Framework- 2022-12-16 Primary-Document _v1.0_final.docx
Human-Auditable Requirements are those with which compliance can only be verified by an audit of people, processes, and procedures. ¢ Policies are Human-Auditable Requirements written using standard conformance terminology. The Policies used in the Governance Framework will use the standard terminology detailed in RFC 2119 keywords. Note that all RFC 2119 keywords have weight from an auditing perspective. An implementer MUST explain why a SHOULD or RECOMMENDED requirement was not implemented and SHOULD explain why a MAY requirement was implemented.
« Specifications are documents containing any combination of Machine-Testable Requirements and Human-Auditable Requirements needed to produce technical interoperability.
Localization
-
The official language of the vLEI Ecosystem Governance Framework SHALL be American English.
-
The Governance Framework Website SHALL include introductory remarks in the languages of the G20 countries.
-
For situations in which the vLEI Ecosystem Governance Framework MAY be needed in another language, GLEIF will consider these on a case-by-case basis.
Governing Authority 1. The Global Legal Entity Identifier Foundation (GLEIF), as Governing Authority, is responsible for the vLEI Ecosystem Governance Framework. 2. The LEI of GLEIF is 506700GE1G29325QX363. 3. The contact information for GLEIF is: St. Alban-Vorstadt 5, PO Box, 4002 Basel, Switzerland Contact: Karla McKenna, Head of Standards Karla.McKenna@gleif.or Administering Authority 1. The Global Legal Entity Identifier Foundation (GLEIF) also is the Administering Authorityfor the VLEI Ecosystem Governance Framework. Purpose The purpose of the verifiable LEI (vLEI) Ecosystem Governance Framework is to deliver a global infrastructure that enables decentralized verifiable digital identity of legal entities in all use cases where it is required and can enable industry and participant benefits. verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 4 of 12 Primary Document Public Document Version 1.0 GLEIF 2022-12-16_verifiable-LEI-(vLEl)-Ecosystem-Governance-Framework- 2022-12-16 Primary-Document _v1.0_final.docx
Scope The following entities are stakeholders in the Trust Community:
o GLEIF — Global Legal Entity Identifier Foundation operates and manages the Global LEI System (GLEIS);
e LElIssuer — An organization accredited by GLEIF to validate legal entity information and register new LEls and reference data which are sent to GLEIF for inclusion in the GLEIS;
e Qualified vLEl Issuer (QVI) — An organization qualified by GLEIF to issue Legal Entity vLEI Credentials, Legal Entity Official Organizational Role vLEI Credentials (OOR vLEI Credentials) and Legal Entity Engagement Context Role VLEI Credentials (ECR VvLEI Credentials)
o Legal Entity — a legal person or structure that is organized under the laws of any jurisdiction that meets the eligibility criteria for registering for a LEI;
o Official Organizational Role Persons (OOR Persons) — Persons who represent Legal Entities in official roles;
¢ Engagement Context Role Persons (ECR Persons) — Persons who represent Legal Entities in functional roles;
o VLEI User — any user of vLEI credentials in any applicable use case.
The scope of the vLEI Ecosystem Governance Framework is to enable these stakeholders to issue, hold and verify vLEI Credentials using the GLEIF Controller Network and to ensure that these activities take place in compliance with the vLEI Ecosystem Governance Framework.
Out of scope for the vLEI Ecosystem Governance Framework are the LEI governance processes and rules which are managed separately by GLEIF with its own specification and documents. In addition, although GLEIF encourages other governance frameworks to make use of the vLEI Ecosystem Governance Framework and the vLEI Credentials, these governance frameworks also are out of scope.
Objectives
The objectives of the VLEI Ecosystem Governance Framework for a global infrastructure for organizational digital identity based on the LEl are:
Drive LEl Adoption
o Expand the value LEls can bring to the global economy by enabling cryptographically verifiable vLEls;
» Make it easy and profitable for a wide range of QVIs to begin issuing VLEls;
o Attract developers to build vLEIs into applications that depend on digital trust;
o Assist regulators in understanding and incorporating LEIs and vLEls so that they are integrated into numerous critical business processes and workflows.
verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 5 of 12
Primary Document
Public Document Version 1.0 GLEIF 2022-12-16_verifiable-LEI-(vLEl)-Ecos
ystem-Governance-Framework- 2022-12-16
Primary-Document _v1.0_final.docx
o Establish GLEIF as a Global Root of Trust for Organizational Identifiers » Position VLEls as the simplest, strongest solution for any use case requiring digital verification of the attributes, transactions, or attestations of a legal entity or its official persons or persons in other functions; « Enable a vLEI chain of trust: GLEIF, QVIs, Legal Entities, OOR Persons, ECR Persons; « Support unlimited levels of delegated identifiers and associated Verifiable Credentials to provide both horizontal and vertical scalability. Enable New Uses for LEIs A list of use-cases, including those identified through vLEI research, includes: Verifiable corporate documentation and communications » Company and signatory-specific documents and reports; » Regulatory filing and reporting by a third-party filer on behalf of the filer/reporting entity or by an auditor; o Contracts and legal agreements; « Private, secure, peer-to-peer communication with customers, employees, and other stakeholders. Counterparty verification supporting digital business interaction/automation o Client/counterparty due diligence and Know Your Customer (KYC) compliance; » Import/export, supply chain, customs/border control, payment for goods (e-invoicing); « Authorized signatory verification; « e-invoice and e-payment instruction validation. Licensing and corporate registration o Trusted supplier/provider network membership and registration; « Payment systems membership and registration; o Business entity registration and licenses; « Educational institutions - qualification certification and verification. Other use cases « Digital wallets, digital asset management, and decentralized finance; « Verification of transacting parties; » Employee and authorized agent ID for any organizational use-case. Enhance Security, Reduce Fraud and Simplify Compliance « Enhance security of Autonomic ldentifiers (AIDs) and vLEI credentials by replacing an administrative root of trust with a cryptographic root of trust; verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 6 of 12 Primary Document Public Document Version 1.0 GLEIF 2022-12-16_verifiable-LEI-(vLEl)-Ecosystem-Governance-Framework- 2022-12-16 Primary-Document _v1.0_final.docx
» Ensure complete, cryptographically verifiable auditability of transactions and other interactions involving vLEIs and sub-identifiers;
o Resist quantum computer attacks;
« Combine with other verifiable factors to further increase security, such as:
a. identity / biometrics b. delegated multi-signature capabilities Enhance Independent Control, Efficiency, Scalability and Sustainability
« Eliminate dependence on any single SSI utility network by delivering the vLEl infrastructure using an interoperable and technology agnostic approach;
» Reduce dependence on SSI utility network governance structures beyond the control of GLEIF;
o Ensure highly performant global scalability;
« Establish global best practices for key management;
« Aid the development of a competitive market for all the software, tools, and services necessary to implement vLEls;
» Work with QVIs to ensure a sustainable commercial model for vLEIs for GLEIF, QVIs, and Legal Entities and other vLEI Ecosystem stakeholders.
Principles
-
The vLEl Ecosystem Governance Framework MUST enable GLEIF’s role to support and contribute to unique global persistent organizational identity as a public good.
-
The vLEIl Ecosystem Governance Framework MUST deliver on GLEIF’s vision that every legal entity be able to be identified uniquely, having only one global identity and this identity should include a digital identity.
-
The vLEIl Ecosystem Governance Framework MUST leverage the principle of free and open access and use of the data in the Global LEI System regarding legal entities and their entity- level and relationships.
-
The vLEI Ecosystem Governance Framework MUST support GLEIF’s intention to deliver the vLEl infrastructure using a technology agnostic approach and to use open source whenever possible.
-
The vLEl Ecosystem Governance Framework MUST support GLEIF’s use of open standards.
-
The vLEl Ecosystem Governance Framework MUST fulfil GLEIF’s intention to make the vLEI infrastructure widely available as broadly useful as possible.
-
The vLEIl Ecosystem Governance Framework MUST enable interoperability, for the digital identity data of an entity to be represented, exchanged, secured, protected, and verified interoperably using open, public, and royalty-free standards, as well as portability, the ability
verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 7 of 12
Primary Document
Public Document Version 1.0 GLEIF 2022-12-16_verifiable-LEI-(vLEl)-Ecosystem-Govern
ance-Framework- 2022-12-16
Primary-Document _v1.0_final.docx
of identity rights holders to move or transfer a copy of their digital identity data to the agents or systems of their choice.
-
The vLEl Ecosystem Governance Framework MUST empower vLEIl Holders to secure their digital identity data at rest and in motion, to control their own identifiers and encryption keys, and to employ end-to-end encryption for all interactions and to protect the privacy of their digital identity data when applicable.
-
The vLEIl Ecosystem Governance Framework MUST ensure verifiability and authenticity by empowering VLEI Holders to provide verifiable proof of the authenticity of their digital identity data.
-
The vLEI Ecosystem Governance Framework MUST allow vLEI Ecosystem stakeholders to be accountable to each other for conformance to the purpose, principles, and policies of the VLEI Ecosystem Governance Framework. All vLEI Ecosystem stakeholders MUST be responsible and be able to demonstrate compliance with any other requirements of applicable law. Nothing in the vLEI Ecosystem Governance Framework SHOULD require vLEI Ecosystem stakeholder to breach applicable law in order to perform its obligations under the VLEI Ecosystem Governance Framework.
General Requirements
-
All LEls contained in vLEIs MUST maintain a LEI Entity Status of Active and a LEI Registration Status of Issued, Pending Transfer or Pending Archival in the Global LEI System.
-
AllIssuers of vLEIs MUST verify that a Holder’s Autonomic Identifier (AID) is controlled by the Holder.
-
Al QVIs MUST have executed a vLEI Issuer Qualification Agreement.
-
AllQVIs MUST successfully complete Annual vLEI Issuer Qualification.
-
GLEIF MUST publish the vLEI Ecosystem Governance Framework on gleif.org and follow the policies in the Revisions section for all revisions of the vLEI Ecosystem Governance Framework.
-
VLEIs MUST be revocable following the policies specified in vLEI Ecosystem Governance Framework.
-
QVIs MUST ensure that parties providing Third-Party Services comply with the vLEI Ecosystem Governance Frameworks when providing vLEI services to a QVI.
Revisions 1. At a minimum, the vLEI Ecosystem Governance Framework MUST be reviewed annually. 2. Interim revisions to the vLEI Ecosystem Governance Framework to reflect necessary technical changes or updates also MAY be considered. verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 8 of 12 Primary Document Public Document Version 1.0 GLEIF 2022-12-16_verifiable-LEI-(vLEl)-Ecosystem-Governanc
e-Framework- 2022-12-16
Primary-Document _v1.0_final.docx
2.1 These revisions MAY be triggered by changes to vLEI Ecosystem services, processes, operations, technical architecture and infrastructure, Identifier or Credential Governance Frameworks.
- Revisions to the Primary Document are subject to the following policies:
a. Allrevisions to the Primary Document MUST be identified with a revision number that is a sequential integer.
b. Revisions to the Primary Document SHALL be subject to public review which will be conducted as community reviews by members of the Trust over IP Foundation for a period of at least 15 days.
- Revisions to the Controlled Documents are subject to the following policies:
a. All revisions to Controlled Documents MUST be identified with a revision number that is a sequential integer.
b. Revisions to the vLEl Issuer Qualification Agreement, including all of its appendices, SHALL NOT be subject to public review and will be reviewed and approved by GLEIF only.
c. All other Controlled Documents SHALL be subject to public review which will be conducted as community reviews by members of the Trust over IP Foundation for a period of at least 15 days.
- All revisions to the vLEI Ecosystem Governance Framework MUST be approved by GLEIF using its Change Management Process.
Extensions
-
GLEIF welcomes other Governance Frameworks to leverage the vLEI Ecosystem Governance Framework but does not anticipate the need at this time to specify formal extensions from other external Governance Frameworks that will leverage the vLEI Ecosystem Governance Framework.
-
The vLEIl Ecosystem Governance Framework is extended by the following internal governance frameworks: GLEIF Identifier Governance Framework, Qualified vLEI Issuer Identifier and vLEI Credential Governance Framework and 4 Credential Governance Frameworks
GLEIF Identifier Governance Framework, v1.0 A document that details the purpose, principles, policies, and specifications that apply to the use of the GLEIF Root Autonomic Identifier (AID) and its GLEIF Delegated AIDs in the vLEI Ecosystem. Qualified vLEl Issuer Identifier and vLEI Credential Governance Framework, v1.0 A document that details the requirements to enable the Delegated AlDs and the vLEI to be issued by GLEIF to QVIs which allows the QVIs to issue, verify and revoke Legal Entity vLEI Credentials, Legal Entity Official Organizational Role vLEI Credentials and Legal Entity Engagement Context Role vLEI Credentials. verifiable LEI (vLEI) Ecosystem Governance Framework v1.0
Page 9 of 12 Primary Document Public Document Version 1.0 GLEIF 2022-12-16_verifiable-LEI-(vLEI)-Ecosystem-Governance-Framework- 2022-12-16 Primary-Document _v1.0_final.docx
Qualified vLEI Issuer Authorization vLEIl Credential Governance Framework, v1.0 A document that details the requirements for this vLEI to enable simple, safe, secure instruction and authorization by a Legal Entity Authorized Representative (LAR) sent to a QVI for the issuance and revocation of vLEI Role Credentials. Legal Entity vLEI Credential Governance Framework, v1.0 A document that details the requirements for a vLEI as the entity level credential issued by a QVI to a Legal Entity. Legal Entity Official Organizational Role vLEI Credential Governance Framework, v1.0 A document that details the requirements for vLEI Role Credentials issued by a QVI to official representatives of a Legal Entity. Legal Entity Engagement Context Role vLEI Credential Governance Framework, v1.0 A document that details the requirements for vLEI Role Credentials issued to representatives of a Legal Entity in other than official roles but in functional or other context of engagement. Schedule of Controlled Documents DID URLs for all documents will be published with the v1.0 Draft of the Ecosystem Governance Framework. The v1.0 Draft can be viewed at: https://www.gleif.org/en/lei-solutions/gleifs-digital-strategy-for-the-lei/introducing-the-verifiable- lei-vlei Glossary verifiable LEI (vLEI) Ecosystem Governance Framework Glossary, v1.0 A document that lists all defined terms have been referenced in the vLEI EGF documents. Risk Assessment verifiable LEI (vLEI) Ecosystem Governance Framework Risk Assessment, v1.0 A spreadsheet that assesses certain risk categories regarding the operation of the vLEI Ecosystem and Infrastructure. Trust Assurance and Certification verifiable LEI (vLEI) Ecosystem Governance Framework Trust Assurance Framework, v1.0 This spreadsheet focuses on the ‘MUST’ statements within the other vLEI EGF documents and specifies the services/processes that will be used to evaluate compliance with these statements. Governance Requirements verifiable LEI (vLEI) Ecosystem Governance Framework Governance Requirements v1.0 This document specifies the governance of GLEIF in its role in the Global LEI System including the the regulatory oversight of GLEIF by the Regulatory Oversight Committee. Every LEl must be managed according to this governance which places GLEIF in the management role for the Global LEI System. verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 10 of 12 Primary Document Public Document Version 1.0 GLEIF 2022-12-16_verifiable-LEI-(vLEl)-Eco
system-Governance-Framework- 2022-12-16 Primary-Document _v1.0_final.docx