gleifpdf/58

GLEIF verifiable LEI (vLEI) Ecosystem Governance Framework 1.0 Trust Assurance Framework Document Version 1.1 Final 2023-04-03 Version Date: 2023-04-03 Status: Final DID URL for the Trust Assurance Framework: did:keri:EINmHd5g7iV-Uldkkk Ky BIH052bly xZNBn9pg- zNrYoS?service=vlei-documents&relativeRef=/egf/docs/2023-04- 03_verifiable-LEI-(vLEIl)-Ecosystem-Governance-Framework-Trust- Assurance-Framework_v1.1_Final.xlsx

GLEIF verifiable LEI (vLEI) Ecosystem Governance Framework 1.0 Trust Assurance Framework Document Version 1.1 Final 2023-04-03 Version Date: 2023-04-03 Status: Final The VLEI Ecosystem Governance Framework MUST _enable GLEIF’s role to support and contribute to unique global persistent X; GLEIF is acting 'as the Roo't of o R . . Trust under a sustainable business o organizational identity as a public good. Principles 1. model The VLEI Ecosystem Governance Framework MUST deliver on GLEIF’s vision that every legal entity be able to be identified X; existence of vLEls for Legal 5 uniquely, having only one global identity and this identity should include a digital identity. Entities The VLEI Ecosystem Governance Framework MUST leverage the principle of free and open access and use of the data in the X; no fees to data users accessing 3 Global LEI System regarding legal entities and their entity-level and relationships. VLEl information on GLEIS The VLEI Ecosystem Governance Framework MUST support GLEIF’s intention to deliver the vLEl infrastructure using a technology X; KERl implemented through open source agnostic approach and to use open source whenever possible. development and maintenance The VLEI Ecosystem Governance Framework MUST support GLEIF’s use of open standards. X; use of standards in vLEls (IS0, X; KER| implemented through Open source 5. W3C, TolP) development and maintenance The VLEI Ecosystem Governance Framework MUST fulfill GLEIF’s intention to make the vLEl infrastructure widely available as X ap'p|IC'abI|ItY of V!'EI to digital X; availability of Qualified vLEl Issuers on . . . . organizational identity across use . X; KERI interoperability and portability broadly useful as possible. . a global basis cases and domains The VLEI Ecosystem Governance Framework MUST enable interoperability, for the digital identity data of an entity to be represented, exchanged, secured, protected, and verified interoperably using open, public, and royalty-free standards, as well as X: KERI it bili d vortabilit portability, the ability of identity rights holders to move or transfer a copy of their digital identity data to the agents or systems of . interoperability and portability their choice. 7. The VLEI Ecosystem Governance Framework MUST empower vLEI Credential holders to secure their digital identity data at rest X: KERI " h d . and in motion, to control their own identifiers and encryption keys, and to employ end-to-end encryption for all interactions and

to . cryptography and security . A . . features; quantum proof protect the privacy of their digital identity data when applicable. The VLEI Ecosystem Governance Framework MUST ensure verifiability and authenticity by empowering vLE| Credential holders to X; VLEI Credential Identity X; vLEI Credential Identity Verification . A . . L o . e . . . X; Credential verification process provide verifiable proof of the authenticity of their digital identity data. Verification Requirements Requirements The VLEI Ecosystem Governance Framework MUST allow vLEI Ecosystem stakeholders to be accountable to each other for conformance to the purpose, principles, and policies of the vLEl Ecosystem Governance Framework. All vLEI Ecosystem X; confirmation during Annual vLEl Issuer stakeholders MUST be responsible and be able to demonstrate compliance with any other requirements of applicable law. X; annual certification Qualification for both Qualified vLEI Nothing in the vLEl Ecosystem Governance Framework SHOULD require VLEI Ecosystem stakeholder to breach applicable law in Issuer and GLEIF 10 order to perform its obligations under the vLEI Ecosystem Governance Framework. General All LE'Is conta'lned' in vLEIs MUST maintain a LE| Entity Status of Active and a LEI Registration Status of Issued, Pending Transfer or X; requirement in Credential X; check using GLEIF API X; check using GLEIF API Requirements |1. Pending Archival in the Global LEI System. Frameworks All Issuers of vLEIs MUST verify that a Holder's Autonomic Identifier (AID) is controlled by the Holder. X; mandat'ory checkin vLEI Issuer X; co'vered as part of th‘,e Credential 2. Credential Issuance workflow issuance process with KERI All QVIs MUST have executed a VLEI Issuer Qualification Agreement. X; executed VLE| Issuer Qualification 3. Agreements All QVIs MUST successfully complete Annual vLEI Issuer Qualification. X conflrmat'lo'n 01" Annual vLELIssuer Qualification by GLEIF

6.5 Key The specific holders of cryptographic keys MUST be kept confidential and shall be determined by Qualified vLEI Issuer internal policy. X; confirmation duntlr?g Annual VLEI Issuer Management |1. Qualification - GLEIF External GARs MUST approve a QVI Rotation Event that occurs no less than six months from the last QVI Rotation Event. — X; conflrmatlogs:lrilfr;cgafir;:ual VLEI Issuer _ Qualified vLEI Issuer Authorized Representatives (QARs) MUST contact GLEIF External GARs for approval of any QVI Rotation Event that occurs less than X; confirmation during Annual vLEI Issuer six months from the last QVI Rotation Event. Qualification Signing keys MUST be rotated whenever there is a likelihood of key compromise. X; confirmation duntlr?g Annual VLEI Issuer X; covered by KEBI Key Management 5. Qualification Architecture - The time and place of key rotation MUST be kept confidential among the key holders until after the rotation has been completed. _— X; conflrmatlogs:lrilfr;cgafir;:ual VLEI Issuer _ Encryption keys protecting private keys SHOULD be rotated prophylactically at least quarterly and MUST be rotated whenever the associated signing key X; confirmation during Annual vLEI Issuer 7. store host configuration changes. Qualification The Delegated AID of a Qualified VLEI Issuer MUST set the Do Not Delegate configuration trait to True. (NOTE: This may change in future versions in X; confirmation during Annual vLEI Issuer X; covered by KERI Key Management 6.6 Delegation order to accommodate horizontal scalability of the vLEI signing infrastructure.) Qualification Architecture 6.7 Key . Qualified vLEI Issuers MUST monitor their public Witnesses for their vLEl issuance and revocation registry for erroneous or malicious issuances and X; confirmation during Annual vLEI Issuer Compromise revocations (primarily issuances) in order to in-form their key management process that a key recovery may be required. Qualification Monitoring 1. 6.8 Key Compromise In any case of key compromise, a Qualified vLEI Issuer MUST: Recovery 1. -- Investigate as expeditiously as possible at its own expense the source of the key compromise and make a full report of the investigation to GLEIF. — X; conflrmatlogs:lrilfr;cgafir;:ual VLEI Issuer _ Make a recovery rotation event that forks their KEL and submit the recovering rotation event and signatures to GLEIF in order that GLEIF may anchor a X; confirmation during Annual vLEI Issuer [ confirmation seal in its KEL. Qualification - S

end a key recovery event explanation to GLEIF for publication in GLEIF’s public registry of Qualified vLEI Issuer recovery events. _— X; confi rmatlogs:lrilfr;cgafir;:ual VLEI Issuer _ 6.9 VLEI Issuance and Qualified vLEI Issuers MUST monitor their public Witnesses for their vLEI issuance and revocation registry for erroneous or malicious issuances and X; confirmation during Annual vLEI Issuer Revocation revocations (primarily issuances) in order to in-form their key management process that a key recovery may be required. Qualification Policies 1. 6.10 Challenge Message The Challenge Message MUST include a cryptographic nonce generated in real time. X; covered by KERI operations Policies 1. The Challenge Response Message MUST be Fully Signed by the Responder. X; covered by KEBI Key Management 3. Architecture | Ja [The Challenger MUST verify that: - ] The Fully Signed Response contains the same cryptographic nonce as the Challenge Message. X; covered by KEBI Key Management Architecture The signatures of the Responders were generated by the private keys that control the Responder’s AID. X; covered by KEBI Key Management Architecture 6.11 Policies for Sharing Contact sharing with new members of a group multi-sig AID MUST be performed by a threshold satisfying number of existing members. X; covered by KERI operations Authenticated AlDs 1. New members MUST be able to Spot Check through Identity Authentication and the Challenge Response process any new authenticated AID they receive X; covered by KERI Key Management 2. from existing members or their new group multi-sig AID. Architecture

GLEIF verifiable LEI (vLEI) Ecosystem Governance Framework 1.0 Trust Assurance Framework Document Version 1.1 Final 2023-04-03 Version Date: 2023-04-03 Status: Final 1 Credential Specifications 1.2 \SIpEC'IfICatIOn Previous versions explicitly cited by policies in this document MUST be supported for a period 18 months . X ersion Upgrades 1. New versions MUST be implemented within a period 12 months after final approval of the new version, unless otherwise X 2. superseded by revised policies in a new version of the vLEI Ecosystem Governance Framework. After upgrading to a new version, implementers MUST NOT begin using any breaking changes until the end of the time period required to adopt new versions. For example, v2.0 must be compatible with v1.0 until the end of the v2.0 adoption period. So v2.0 X q pi p p: ption p 3. must be used in a v1.0 compatible mode. 2 Security and All signatures for the vLEI Credentials MUST use Ed25519 Signatures CESR Proof Format. X; covered by KERI,VLEI Credential Privacy 1. Operations All VvLEI Credential schema MUST be SIS compliant. X; covered by KERI,VLEI Credential 2. Operations All instantiated vLEI Credentials MUST be ACDC compliant. X; covered by KERI,VLEI Credential 3. Operations perations X; covered by KERI vLEI Credential 3 Requirements Issuer and Holder Identifiers MUST be KERI AIDs that use the did:keri Method. prerations for vLEI ACDCs |1. All vLEI Credentials MUST include an ACDC version string field. X; covered by KERI,VLEI Credential 2. Operations X; covered by KERI vLEI Credential 3. All vLEI Credentials MUST support JSON serialization. Operations perations The following ACDC sections MUST include a SAID - Attribute (data payload) section, Schema section and Rules section. X; covered by KERI,VLEI Credential 5. Operations All source links MUST include the SAID of the referenced ACDC. X; covered by KERI,VLEI Credential 7. Operations perations Issuers MUST provide the SADs at issuance to Holders when issuing forms 2 and 3, by either including the SAD in the presentation X X X; covered by KERI vLEI Credential 10 or including a reference to the highly-available service endpoint from which the SAD can be retrieved. Operations AviEl . . o X; covered by KERI vLEI Credential Credential VLEI Credential schema MUST be compliant the SAID and SIS specifications. Operations Schema 1. All VvLEI Credential schema MUST include a SAID (as evidence of immutability). X; covered by KERI,VLEI Credential 2. Operations

-- Fach VLEI Credential MUST be in compliance with its specific vLE| Credential Governance Framework __ e KERI'VLEI e 3. Operations Each vLEI Credential MUST be chained to its source(s), if any, as required by the applicable vLEI Credential Governance Framework X; covered by KERI vLEI Credential 3.1 in accordance with the ACDC specification. Operations 5 Composable Event . Streaming The Proof Format for vLEI credentials MUST comply with the CESR Proof Format specification. X; covered lg KERL,VLEI Credential erations Representation P (CESR) 1. 6 Credential Registry and . S . . . . . . . . . . . . Each vLEl credential Issuer MUST maintain a highly-available issuance and registration registry in compliance with the Public X; covered by KERI vLEI Credential Revocation . e . X . Transaction Event Log (PTEL) Specification. Operations Registry Requirements |1. 7 Exchange VLEI credential Issuers MUST comply with the Issuance Exchange Protocol Specification for ACDC and KERI. X X; covered by KERI,VLEI Credential Protocols 1 Operations

GLEIF verifiable LEI (VLEI) Ecosystem Governance Framework 1.0 Trust Assurance Framework Document Version 1.1 Final 2023-04-03 Version Date: 2023-04-03 Status: Final 2. Official vLEI Schema Requirements i [The digest algorithm employed for generating schema SAIDs MUST have an spproximate cryptographic strength of 286 | x [ | | % I A Ve e i IR SR R R R S 2. CESR encoding indicates the type of cryptographic digest used to generate the SAID. I A s AN T N I A 3. official schema. [ e e S N A A IR S N I A 1. backward incompatible version. - 0000000000000 r - -t 00000 I e e O I e e e e e I e e O e I e e e I e e O I e e e - 0000000000000 r - -t 00000 I e e O I e e e e e I e e O e I e e e I e e O I e e e - 0000000000000 r - -t 00000 I e e O I e e e e e I e e O e I e e e I e e O I e e e - 0000000000000 r - -t 00000 I e e O I e e e e e

S verifiable LEI (VLEI) Ecosystem Governance Framework 1.0 Trust Assurance Framework Document Version 1.1 Final 2023-04-03 Version Date: 2023-04-03 Status: Final MUST' Statements GLEIF Identifiers (GLEIF Root AID, GLEIF Internal and External Delegated AIDs) An AID conformant'mth this Governance Framework MUST be created from two sets of asymmetric signing key palrs generated X; requirement in GLEIF Identifier X; covered as part of KERI Key 5 AID from a cryptographically-secure pseudo-random number generator (CSPRNG) or a true random number generator with at least Governance Framework Management Generation 1. 128 bits of cryptographic strength. g The AID MU'ST t'hen be derived from a cryptt')gra phic digest of a SEFIE'1|IZat{0'n of the publ'lc keys' of the first set of keY pairs a'nd a X; requirement in GLEIF Identifier X; covered as part of KERI Key cryptographic digest of second set of key pairs, as well as any other identifiers and configuration parameters associated with the Governance Framework Management 2. supporting infrastructure for the Root Identifier as specified in the Technical Requirements Part 1 KERI Infrastructure. 8 The cryptographic digest MUST have at least 128 bits of cryptographic strength. X; requirement in GLEIF Identifier X; covered as part of KERI Key 3. Governance Framework Management 6 AID All Controllers MUST establish their own Private Key Store. X; requirement in GLEIF Identifier X; covered as part of KERI Key Controllers 1. Governance Framework Management All Controllers MUST keep their private keys secret. X; requirement in GLEIF Identifier 2. Governance Framework A given Controller MUST control one and only one key pair from each set of keys. X; requirement in GLEIF Identifier X; covered as part of KERI Key 3. Governance Framework Management overnance Framewor process wi 5 Cdontlnmty GLEIF MUST have a Continuity Policy for the survival of control authority of all Controllers for the GLEIF Root AID and its Delegated | X; requirement in GLEIF Identifier an AlIDs, including Escrow Agents. Governance Framework Survivorship 7 GLEIF AID GLEIF MUST establish a list of initial GLEIF Controllers that specifies: Genesis 1 overnance Framewor X; requirement in GLEIF Identifier Which Controllers shall control the GLEIF Root AID, the GIDA and the GEDA. Governance Framework Aset o'f policies MUST be put in place that ensure f'a uIt—toIerant':e with 'respect to comr'no'n mode. f'allures of the 'mult|—5|g signing X; requirement in GLEIF Ide

ntifier authority of the set of GLEIF Controllers, e.g., a Designated Survivor policy and/or restrictions on joint travel and in-person A Governance Framework C. attendance of meetings). GLEIF MUST establish real-time Out-of-Band Interaction (OOBI) session(s) in which all initial GLEIF Controllers are present. An . . e . . . . | . . | . X; requirement in GLEIF Identifier example is a continuous web meeting attended by all parties on both audio and video. The essential feature is that there is a Governance Framework 2. mutual live presentation by all participants that verifies their live participation in the session. overnance Framewor All GLEIF'Controllers MUST r'nutually authe'ntlcate each other’s Ie'gal |(?ent|t|es bt?fore proceeding with any further 'steps. 'An X; requirement in GLEIF Identifier X; covered as part of KERI Identifier example is each Controller visually presenting one or more legal identity credentials for all other Controllers to verify against the Governance Framework Operations 3. list of initial GLEIF Controllers. P 5. Creation of . . . . . The following steps MUST be performed in the order listed and completed during each OOBI session for the GLEIF Root AID. GLEIF Root AID Each Root AID GLEIF Authorized Representative (Root GAR) MUST generate its own single signature AID that is a participating X; requirement in GLEIF Identifier X; covered as part of KERI Identifier member in the group of AIDs that will be used to create the GLEIF Root AID. Governance Framework Operations Each Root GAR MUST use an OOBI proto'col (su'ch asa QR c'ot'ie o'r live chat) to share '|ts own A!D and Service Endpoints with the X; requirement in GLEIF Identifier X; covered as part of KER| Identifier other Root GARs. For each Root GAR, this provides the participating AID and the service endpoint whereby the other Root GARs Governance Framework Operations may obtain the Key Event Log (KEL) of its participating AID. P

Each Root GAR MUST send a Challenge Message to every other Root GAR as defined in the Technical Requirements Part 1 for the | X; requirement in GLEIF Identifier X; covered as part of KERI Identifier purposes of cryptographic authentication of their Root GAR AID. The Challenge Message MUST be unique to each OOBI session. Governance Framework Operations c. Each Root GAR MUST verify in real time that a response to the Challenge Message was received from every other Root GAR. X; requirement in GLEIF Identifier X; covered as part O,f KERI Identifier Governance Framework Operations Each Root GAR MUST verify the signature of every other Root GAR. X; requirement in GLEIF Identifier X; covered as part o'f KERI Identifier Governance Framework Operations One of the Root GARs MUST be designated as the Root AID GLEIF Authorized Representative Lead (Root GAR Lead). X; requirement in GLEIF Identifier X; covered as part O,f KERI Identifier f. Governance Framework Operations The I'ioc'>t GAR Lead MUST select the AIDs from the' set of Root GARs for the ordered set'o'f authorized participant members in the X; requirement in GLEIF Identifier X; covered as part of KER| Identifier multi-sig group and configure and approve the weight threshold and ordered set of participants for both the current and next set . o Governance Framework Operations and threshold of participants. The Root GAR Lead MUST select the AIDs and Service Endpoints for the GLEIF Root AID Witness Pool. X; requirement in GLEIF Identifier X; covered as part O,f KER| Identifier h. Governance Framework Operations US'I ng the current public key and the next public key digest from each of the ;')artlupatlng AID IrTceptl'on Events and the Root X; requirement in GLEIF Identifier X; covered as part of KERI Identifier Witness AIDs, the Root GAR Lead MUST generate the GLEIF Root AID Inception Event and publish this to the Root GARs and to the . | ) . Governance Framework Operations Root AID Witnesses designated by that Inception Event. Each Root GAR MUST verify the set of public keys, the next public key digest, the threshold, the next threshold and Root AID X; requirement in GLEIF Identifier X; covered as part of KERI Key Witness identifiers in the Root AID Inception Event. Governance Framework Management Each Root GAR MUST verify the set of service endpoints for the Root AID Witnesses. X; requirement in GLEIF Identifier X; covered as part O,f KERI Identifier k. Governance Framework Operations Each Root GAR MUST sign and

publish to the Root AID Witnesses their signature on the Root AID Inception Event. X; requirement in GLEIF Identifier X; covered as part O,f KERI Identifier Governance Framework Operations Each Root GAR MUST verify that the Root AID Inception Event is fully witnessed by every Root AID Witness. X; requirement in GLEIF Identifier X; covered as part O,f KERI Identifier m. Governance Framework Operations -- Fach Root GAR MUST verify that the Root AID Inception Event i ully witnessed by every Root AID Witness. ____ 6. Creation of | The following steps MUST be performed in the order listed and completed during each OOBI session for each of the two GLEIF GLEIF Internal |Delegated AIDs, namely, the GLEIF Internal Delegated AID (GIDA) in this section and the GLEIF External Delegated AID (GEDA) in Delegated AIDs |S€ction 7. Each Internal Delegated AID GLEIF Authorized Representative (Internal GAR) that is a participating member in the group of AIDs | X; requirement in GLEIF Identifier X; covered as part of KERI Identifier MUST generate its own single signature AID that will be used to create the GIDA. Governance Framework Operations Each Internal GAR MUST use an OOBI protocol (su'ch as 2'1 QR code or'Il've c'hat) to share its owr'1 AID and'Serwce Endpoints with X; requirement in GLEIF Identifier X; covered as part of KERI Identifier the other Internal GARs. For each Internal GAR, this provides the participating AID and the service endpoint whereby the other . . ) L Governance Framework Operations Internal GARs may obtain the KEL of its participating AID. Each Internal GAR MUST send a Challenge Messag'e to every'oth'er Interna'l GAR as defined in the Technical Requlremer?ts Part1 X; requirement in GLEIF Identifier X; covered as part of KERI Identifier KERI Infrastructure for the purposes of cryptographic authentication of their GIDA. The Challenge Message MUST be unique to . | Governance Framework Operations c. each OOBI session. Each Internal GAR MUST verify in real time that a response to the Challenge Message was received from every other Internal X; requirement in GLEIF Identifier X; covered as part of KERI Identifier GAR. Governance Framework Operations Each Internal GAR MUST verify the signature of every other Internal GAR. X; requirement in GLEIF Identifier X; covered as part O,f KERI Identifier Governance Framework Operations One of the Internal GARs MUST be designated as the Internal Delegated AID GLEIF Authorized Representative (Internal GAR X; requirement

in GLEIF Identifier X; covered as part of KERI Identifier f. Lead). Governance Framework Operations The Internal GAR Lead MUST select the AIDs and Service Endpoints from the GLEIF Internal Delegated AID Witness Pool. X; requirement in GLEIF Identifier X; covered as part O,f KERI Identifier Governance Framework Operations The Interna'l (?‘AR Lead MUST se'lect the AIDs from the se"c of Internal GARs for the ordered set'm'c authorized participant members X; requirement in GLEIF Identifier X; covered as part of KER| Identifier in the multi-sig group and configure and approve the weight threshold and ordered set of participants for both the current and . L Governance Framework Operations h. next set and threshold of participants. Using the current public key and the next public key digest from each of the participating AID Inception Events, the Internal Delegated Witness AIDs, and the GLEIF Root AID, the Internal GAR Lead MUST generate the GLEIF Internal Delegated AID X; requirement in GLEIF Identifier X; covered as part of KERI Key Inception Event and publish this to the Internal GARs and to the Delegated AID Witnesses designated by that Inception Event. The Governance Framework Management published Inception Event includes as an attachment OOBIs for each of the Internal Delegated AID Witnesses.

Each Internal GAR MUST verify the set of public keys, the next public key digest, the Witness identifiers, the threshold, the next X; requirement in GLEIF Identifier X; covered as part of KERI Key threshold and the Root AID in the Internal Delegated AID Inception Event. Governance Framework Management Each Internal GAR MUST verify the set of Witness endpoints for the GIDA. X; requirement in GLEIF Identifier X; covered as part O,f KER| Identifier k. Governance Framework Operations Each Internal GAR MUST sign and publish to the Internal Delegated AID Witnesses its signature on the Internal Delegated AID X; requirement in GLEIF Identifier X; covered as part of KERI Identifier Inception Event. Governance Framework Operations Each Internal GAR MUST verify that the Internal Delegated AID Inception Event is fully witnessed by every Witness. X; requirement in GLEIF Identifier X; covered as part O,f KERI Identifier m. Governance Framework Operations 7. Creation of GLEIF External Delegated AIDs Each External Delegated AID GLEIF Authorized Representative (External GAR) that is a participating member in the group of AIDs | X; requirement in GLEIF Identifier X; covered as part of KERI Identifier MUST generate its own single signature AID that will be used to create the GEDA. Governance Framework Operations Each External GAR MUST use an OOBI protocol (sut':h as a'QR code or I'|v'e ch'at) to share its own'AID and S'erwce Endpoints with X; requirement in GLEIF Identifier X; covered as part of KER| Identifier the other External GARs. For each External GAR, this provides the participating AID and the service endpoint whereby the other . . | R Governance Framework Operations External GARs may obtain the KEL of its participating AID. Each External GAR MUST send a Challenge Messag'e to every' oth'er Extern'fll GAR as defined in the Technical Requlremer?ts Part 1 X; requirement in GLEIF Identifier X; covered as part of KER| Identifier KERI Infrastructure for the purposes of cryptographic authentication of their GEDA. The Challenge Message MUST be unique to . | Governance Framework Operations C. each OOBI session. Each External GAR MUST verify in real time that a response to the Challenge Message was received from every other External X; requirement in GLEIF Identifier X; covered as part of KERI Identifier GAR. Governance Framework Operations Each External GAR MUST verify the signature of every other External GAR. X; requirement in GLEIF Identifier X; covered as part O,f KER| Id

entifier Governance Framework Operations One of the External GARs MUST be designated as the External Delegated AID GLEIF Authorized Representative Lead (External X; requirement in GLEIF Identifier X; covered as part of KERI Identifier f. GAR Lead). Governance Framework Operations The External GAR Lead MUST select the AIDs and Service Endpoints from the GLEIF External Delegated AID Witness Pool. X; requirement in GLEIF Identifier X; covered as part O,f KER| Identifier Governance Framework Operations The Extern'al GAR Lea'd MUST select the A'IDs from the set of Exterr?al GARs for the ordered set of author'lz'ed participant X; requirement in GLEIF Identifier X; covered as part of KERI Identifier members in the multi-sig group and configure and approve the weight threshold and ordered set of participants for both the . e Governance Framework Operations h. current and next set and threshold of participants. Using the current public key and the next public key digest from each of the participating AID Inception Events, the External Delegated Witness AIDs, and the GLEIF Root AID, the External GAR Lead MUST generate the GLEIF External Delegated AID X; requirement in GLEIF Identifier X; covered as part of KERI Key Inception Event and publish this to the External GARs and to the Delegated AID Witnesses designated by that Inception Event. The Governance Framework Management published Inception Event includes as an attachment OOBIs for each of the External Delegated AID Witnesses. Each External GAR MUST verify the set of public keys, the next public key digest, the Witness identifiers, the threshold, the next X; requirement in GLEIF Identifier X; covered as part of KERI Key threshold and the Root AID in the External Delegated AID Inception Event. Governance Framework Management Each External GAR MUST verify the set of Witness endpoints for the GEDA. X; requirement in GLEIF Identifier X; covered as part O,f KERI Identifier k. Governance Framework Operations Each External GAR MUST sign and publish to the External Delegated AID Witnesses their signature on the External Delegated AID | X; requirement in GLEIF Identifier X; covered as part of KERI Identifier Inception Event. Governance Framework Operations Each External GAR MUST verify that the External Delegated AID Inception Event is fully witnessed by every Witness. X; requirement in GLEIF Identifier X; covered as part O,f KERI Identifier m. Governance Framework Operations 8. Rotation The following steps MUST be perform

ed in the order listed and completed during this OOBI session for each of the two GLEIF Event to Delegated AlDs, namely, the GLEIF Internal Delegated AID (GIDA) in this section and the GLEIF External Delegated AID (GEDA) in delegate the section 9. GLEIF Internal Delegated AIDs A threshold satisficing subset of Internal GARs MUST each rotate their participating AlDs. X; requirement in GLEIF Identifier X; covered as part O,f KERI Identifier Governance Framework Operations Using the current public key, the ne)ft public key digest from each of the participating AID Rotation Events, and the digests 'of the X; requirement in GLEIF Identifier X; covered as part of KERI Key GLEIF Internal Delegated AID Inception Event, the Internal GAR Lead MUST generate a GLEIF Internal Delegated AID Rotation ) | ] N Governance Framework Management Event and publish this to the other participating Internal GARs and to the Root AID Witnesses.

Each Internal GAR MUST verify the set of public keys, the next public key digest, and delegated Inception Event digests in that X; requirement in GLEIF Identifier X; covered as part of KERI Key C. Rotation Event. Governance Framework Management Each Internal GAR MUST sign and publish to the Root AID Witnesses their signature on the Root AID Rotation Event. X; requirement in GLEIF Identifier X; covered as part O,f KER| Identifier Governance Framework Operations Each Internal GAR MUST verify that the Root AID Rotation Event is fully witnessed by every Root AID Witness. X; requirement in GLEIF Identifier X; covered as part O,f KER| Identifier Governance Framework Operations 9. Rotation The following steps MUST be performed in the order listed and completed during this OOBI session for each of the two GLEIF Event to Delegated AlDs, namely, the GLEIF Internal Delegated AID (GIDA) in section 8 and the GLEIF External Delegated AID (GEDA) in this delegate the section. GLEIF External Delegated AIDs A threshold satisficing subset of External GARs MUST each rotate their participating AIDs. X; requirement in GLEIF Identifier X; covered as part O,f KERI Identifier Governance Framework Operations Using the current public key, the nex't public key digest from each of the participating AID Rotation Events, and the digests o'f the X; requirement in GLEIF Identifier X; covered as part of KERI Key GLEIF External Delegated AID Inception Event, the External GAR Lead MUST generate a GLEIF External Delegated AID Rotation . i L A Governance Framework Management Event and publish this to the other participating External GARs and to the Root AID Witnesses. Each External GAR MUST verify the set of public keys, the next public key digest, and delegated Inception Event digests in that X; requirement in GLEIF Identifier X; covered as part of KERI Key C. Rotation Event. Governance Framework Management Each External GAR MUST sign and publish to the Root AID Witnesses their signature on the Root AID Rotation Event. X; requirement in GLEIF Identifier X; covered as part O,f KERI Identifier Governance Framework Operations Each External GAR MUST verify that the Root AID Rotation Event is fully witnessed by every Root AID Witness. X; requirement in GLEIF Identifier X; covered as part O,f KERI Identifier Governance Framework Operations 8 Publication of GLEIF Root The GLEIF Root AID and GLEIF Delegated Internal and External AIDs MUST be published in a sufficiently strongly correlated and X; requ

irement in GLEIF Identifier AID and GLEIF fault-tolerant manner to establish it as the unique AID for GLEIF. Governance Framework Delegated AlDs 1. The set of publication points MUST include at least 4 of the list of publication points initially (highlighted below) following the X; requirement in GLEIF Identifier 2. creation of the GLEIF Root AID and GLEIF Delegated Internal and External AIDs. Governance Framework The GLEIF HTTPS website. X; requirement in GLEIF Identifier Governance Framework The HTTPS website of the GLEIF Regulatory Oversight Committee. X; requirement in GLEIF Identifier Governance Framework The HTTPS websites of all QVIs. X; requirement in GLEIF Identifier C. Governance Framework In the KERI Event Log hosted by GLEIF KERI Witnesses. X; requirement in GLEIF Identifier Governance Framework Published to at least 3 international newspapers in separate national jurisdictions (applies only to GLEIF Root AID). These X; requirement in GLEIF Identifier publications are: Financial Times UK edition, South China Morning Post - Business and American Banker. Governance Framework Published to github repositories: The Web of Trust github repository, Public GLEIF-controlled github repository X; requirement in GLEIF Identifier f. Governance Framework Published to public registries: IANA (IETF RFCs) registries, ISO registries X; requirement in GLEIF Identifier Governance Framework 9 Voluntary abandonment Abandonment |1. GLEIF MUST abandon its GLEIF Root AID if GLEIF no longer holds the role of root of trust for the vLEI Ecosystem. X; requirement in GLEIF Identifier Governance Framework | Ja. [private Key Compromise or Natural Disaster 0] If in the extremely unlikely event of tr'1e failure of all key recovery provisions specified in Technical Requlrement's. Pz?rt 1: KERI X; requirement in GLEIF Identifier X; covered as part of KER| Identifier Infrastructure, GLEIF MUST abandon its Root AID and Delegated Internal and External AlDs and create and publish its new Root . Governance Framework Operations AID and Delegated Internal and External AlDs.

GLEIF verifiable LEI (VLEI) Ecosystem Governance Framework 1.0 Trust Assurance Framework Document Version 1.1 Final 2023-04-03 Version Date: 2023-04-03 Status: Final 6 Issuer Policies . . . X; assessment and demonstration of L X; requirement in Credential A o 6.1 The Issuer MUST ensure that the Issuer of the QVI vLEI Credential is GLEIF. Governance Framework compliance for Qualified vLEI Issuer and Qualifications |1. GLEIF 62Credential | [The lssuer MUST: e e . . . X; assessment and demonstration of . . . . X; requirement in Credential " . . . use the QVI vLEI Credential schema defined in section 10.1. Governance Framework compliance for Qualified vLEI Issuer and X; Credential format in KERI code 1. GLEIF . . . X; assessment and demonstration of . . . . . X; requirement in Credential A " . . include the Claims marked as Required in section 10.1. compliance for Qualified vLEI Issuer and X; Credential format in KERI code Governance Framework 2. GLEIF 6.3 QVl Identity 1. Identity Verification |Assurance An Externa I' GLEIF Authorlzeq Representative (Externa I' GAR) MUST perform identity asst'Jranc'e of a person serving in the role of X; requirement in Credential X; assessment and demonstration of QVI Authorized Representative (QAR) to at least Identity Assurance Level 2 (IAL2) as defined in NIST 800-63A R i Governance Framework compliance for GLEIF (https://pages.nist.gov/800-63-3/sp800-63a.html). A minimum of two QARs MUST form the QVI multi-sig group. X; requirement in Credential X; asse'ssment and dt'er'nonstratlon of X; co'vered as part of tht'e Credential Governance Framework compliance for Qualified vLEI Issuer issuance process with KERI An External GAR MUST lead for the anchoring action for the QVI External Delegated AID described below. X; requirement in Credential X; assessment' and demonstration of C. Governance Framework compliance for GLEIF 2. |dentity Authentication A credential wallet MUST be set up for the QVI. X; requirement in Credential X; asse'ssment and dt'er'nonstratlon of Governance Framework compliance for Qualified vLEI Issuer The QVI MUST designate a QAR to act on its behalf. X; requirement in Credential X; asse'ssment and dt'er'nonstratlon of Governance Framework compliance for Qualified vLEI Issuer An External GAR and the QAR MUST establish a real-time OOBI session in which the External GAR and the QAR are present. An X; requirement in Credential X as'sessment and'd'emonstratlon of . . . . . . compliance for Qualified vLEI Issuer a

nd example is a continuous web meeting attended by all parties on both audio and video. Governance Framework GLEIF [ . . . X; assessment and demonstration of . . . . . . X; requirement in Credential A o The following steps MUST be performed in this order and completed during this OOBI session. Governance Framework compliance for Qualified vLEI Issuer and GLEIF The External GAR MUST perform manual verification of the QAR’s legal identity for which the External GAR has already i . . . . . . . . . . X; requirement in Credential X; assessment and demonstration of performed Identity Assurance. An example is the QAR visually presenting one or more legal identity credentials and the External i . . . . Governance Framework compliance for GLEIF GAR compares the credentials verified during Identity Assurance to the QAR Person. The External GAR MUST use an OOBI protocol (such as a QR code or live chat) to share the GLEIF External Delegated AID (GEDA) X; requirement in Credential X; assessment and demonstration of with the QAR. Governance Framework compliance for GLEIF . . X; requirement in Credential X; assessment and demonstration of An QAR MUST use an OOBI protocol (such as a QR code or live chat) to share the QVI AID with the External GAR. A . Governance Framework compliance for Qualified vLEI Issuer The External GAR MUST send a Challenge Message from the GEDA to the QVI AID as defined in the Technical Requirements Part . . . . . A . ) X; requirement in Credential X; assessment and demonstration of X; covered as part of the Credential 1 KERI Infrastructure for the purposes of cryptographic authentication of the QVI AID. The Challenge Message MUST be unique to R . . . the 0OBI . Governance Framework compliance for GLEIF issuance process with KERI iv. e session.

The QAR MUST use its Private Key Store to sign and return the response to the Challenge Message, after which the QAR MUST X; requirement in Credential X; assessment and demonstration of X; covered as part of the Credential V. acknowledge that this action has been completed. Governance Framework compliance for Qualified vLEI Issuer issuance process with KERI The External GAR must verify in real time that the response to the Challenge Message was received from the QAR. X; requirement in Credential X; assessment' and demonstration of X; cc'>vered as part of th? Credential Vi. Governance Framework compliance for GLEIF issuance process with KERI When the response to the Challenge Message has been received, the External GAR must verify the signature of the QAR. X; requirement in Credential X; assessmen"c and demonstration of vii. Governance Framework compliance for GLEIF 6.4 Creation X; assessment and demonstration of of the QVI The creation of the QVI Delegated AIDs follows the successful completion of Identity Verification by the External GAR Lead of X; requirement in Credential s o compliance for Qualified vLEI Issuer and Delegated each QAR. Governance Framework GLEIF AlIDs 1. The following steps MUST be performed in the order listed and completed during an OOBI session for a given QVI Delegated AID. X; requirement in Credential X; asse'ssment and d'er"nonstratlon of 2. Governance Framework compliance for Qualified vLEI Issuer Each Delegated AID QVI Authorized Representative (QAR) that is a participating member in the group of AIDs MUST generate its X; requirement in Credential X; assessment and demonstration of own individual single signature AID that will be used to create the QVI Delegated AID. Governance Framework compliance for Qualified vLEI Issuer Each QAR MUST use an OOBI protocol (such as a QR code or live chat) to share its own AID with the other QAR s. For each QAR, X; requirement in Credential X; assessment and demonstration of this provides the participating AID and the service endpoint whereby the other QARs may obtain the KEL of its participating AID. Governance Framework compliance for Qualified vLEI Issuer Each QAR MUST send a Challenge Message tc'> every oth'er QAR as de'f|r'1ed'|r'1 the T'echnlc'al Requirements Part 1 KERI X; requirement in Credential X; assessment and demonstration of Infrastructure for the purposes of cryptographic authentication of their individual single signature AID. The Challenge Message R o A N Governance Framework

compliance for Qualified vLEI Issuer C. MUST be unique to the OOBI session. Each QAR must verify in real time that a response to the Challenge Message was received from every other QAR. X; requirement in Credential X; asse'ssment and d'er"nonstratlon of Governance Framework compliance for Qualified vLEI Issuer Each QAR must verify the signature of every other QAR. X; requirement in Credential X; asse'ssment and d'er"nonstratlon of Governance Framework compliance for Qualified vLEI Issuer One of the QARs must be designated as the Delegated AID QVI Authorized Representative (QAR Lead). X; requirement in Credential X; asse'ssment and d'er"nonstratlon of f. Governance Framework compliance for Qualified vLEI Issuer . . . . . X; requirement in Credential X; assessment and demonstration of The QAR Lead MUST either configure or select the AIDs and Service Endpoints for the QVI Delegated AID Witness Pool. i o Governance Framework compliance for Qualified vLEI Issuer The QAR Lead MUST select the AIDs from the set of QARs for the ordered set of authorized participant members in the multi-sig i . . . ) . . X; requirement in Credential X; assessment and demonstration of group and configure and approve the weight threshold and ordered set of participants for both the current and next set and R o . Governance Framework compliance for Qualified vLEI Issuer h. threshold of participants. Us.'lng the current public key and the next public key digest from each of the participating {-\ID Inception Even"cs, the' Delegated X; requirement in Credential X; assessment and demonstration of Witness AIDs, and the GEDA, the QAR Lead MUST generate the QVI Delegated AID Inception Event and publish this to the other R . ) N A Governance Framework compliance for Qualified vLEI Issuer QARs and to the Delegated AID Witnesses designated by that Inception Event. Each QAR MUST verify the set of public keys, the next public key digest, the Witness identifiers, the threshold, the next threshold, X; requirement in Credential X; assessment and demonstration of and the GEDA in the Delegated AID Inception Event. Governance Framework compliance for Qualified vLEI Issuer Each QAR MUST verify the set of Witness endpoints for the QVI Delegated AID. X; requirement in Credential X asse'ssment and d'er"nonstratlon of k. Governance Framework compliance for Qualified vLEI Issuer Each QAR MUST sign and publish to the Delegated AID Witnesses their signature on the Delegated AID Inception Event. X; requirement i

n Credential X asse'ssment and d'er"nonstratlon of Governance Framework compliance for Qualified vLEI Issuer Each QAR MUST verify that the Delegated AID Inception Event is fully witnessed by every Witness. X; requirement in Credential X asse'ssment and d'er"nonstratlon of m. Governance Framework compliance for Qualified vLEI Issuer GLEIF MUST designate one of the External Delegated AID GLEIF Authorized Representative (External GARs) as the External X; requirement in Credential X aisessr:en;an(li'gedmolls.ltlratlon Ofd Delegated AID GLEIF Authorized Representative (External GAR Lead). Governance Framework compliance tor ;T_IL_IIFe v ssueran 6.5 Delegation of Unless otherwise pre-approved by the GLEIF Root GARs, GLEIF External AID MUST use an Interaction Event to approve the X; requirement in Credential X; as.'sessment and'd'emonstratlon of the QVI . compliance for Qualified vLEl Issuer and delegation of the QVI Delegated AlDs. Governance Framework Delegated GLEIF AlIDs 1. The following steps MUST be performed in the order listed and completed during this OOBI session for the GLEIF External X; requirement in Credential X; as.'sessment and'd'emonstratlon of compliance for Qualified vLEI Issuer and Delegated AID (GEDA). Governance Framework 2. GLEIF The QAR Lead initiates a set of QARs to create a multi-sig group and the QARs mutually are authenticated. X; requirement in Credential X asse'ssment and d'er"nonstratlon of Governance Framework compliance for Qualified vLEI Issuer

GLEIF MUST publish the vLEI Ecosystem Governance Framework on gleif.org and follow the policies in the Revisions section for all X; gleif.org section for vLEI 5 revisions of the VvLEI Ecosystem Governance Framework. Ecosystem Governance Framework VLEIs MUST be revocable following the policies specified in vLEI Ecosystem Governance Framework. X; GLEIF revocatlon of 'Crefientlals X; Qualified VI,'EI Issue'r revocation of X; KERI revocation functionality service level monitoring Credentials service levels QVIs MUST ensure that third-parties comply with the vLEI Ecosystem Governance Frameworks when providing vLE| services to a X; documentation provided by Qualified ; QVl. VLEI Issuers At a minimum, the vLEl Ecosystem Governance Framework MUST be reviewed annually. | XGlEFprocessmonitoring | 00000000000 All revisions to the Primary Document MUST be identified with a revision number that is a sequential integer. X; compliant to Documented 3.a. Information Procedure X; Document approvals follow the All revisions to Controlled Documents MUST be identified with a revision number that is a sequential integer. defined Documented Information Procedure . I X; Document approvals follow the All revisions to the VvLEI Ecosystem Governance Framework MUST be approved by GLEIF using its Change Management Process. i i defined Documented Information 5. Procedure Business There MUST be availability targets defined for all vLEI services included in the Appendix 5 of the vLE| Issuer Qualification X; GLEIF availability targets X; Qualified vLEI Issuer availability Requirements |3. Agreement (SLA). documented in SLA targets documented in SLA The QVI MUST be solely responsible for managing the revenue that is produced and costs that are incurred in the running of its , ),(; O"u?llfled VLElIssuer p'roof of . business' management during Annual VLEI operations. L 5. VLEI Issuer Qualification X; Qualified VvLEI Issuer proof of The QVI MUST ensure that its operations regarding vLEls are sustainably financed. 'business' management during Annual VLEI Issuer Qualification GLEIF MUST not contribute funds of any form whatsoever for QVI operations. X; no e'vidence of receipt of funds by 7. Qualified vLEI Issuers from GLEIF Inclusion, Equitability . . . . L . X; Services are defined and and GLEIF MUST design the vLEI Ecosystem to be able to make vLEls available to any Legal Entity issued a LEIl in the Global LEI System. . . . . - integrated in existing Service Accessibility ¥ ¢ Syst Requirements

|N/A anagement system

The QAR Lead initiates the creation of the Inception Event using the published GLEIF External AID as the Delegator. X; requirement in Credential X asse'ssment and d'er"nonstratlon of Governance Framework compliance for Qualified vLEI Issuer The External GAR Lead verifies that the set of QARs in the multi-sig group in this Inception Event to delegate the QVI External AID X; requirement in Credential X as.'sessment and'd'emonstratlon of e . . compliance for Qualified vLEI Issuer and match those that the External GAR Lead verified according to section 6.3 above. Governance Framework GLEIF c. The External GAR Lead submits request to the External GAR multi-sig group to anchor the Interaction event. All members of the X: requirement in Credential X; assessment and demonstration of External GAR multi-sig group trust External GAR Lead to anchor because the External GARs already have trusted the External GAR ! ch/ernance Framework compliance for Qualified vLEl Issuer and Lead to perform Identity Assurance on the QARs. GLEIF The External GAR Lead then submits a request to issue the Qualified VLEI Issuer VLEI Credential to QVI vLEI to the External GAR X; requirement in Credential X; as.'sessment and'd'emonstratlon of N . compliance for Qualified vLEI Issuer and multi-sig group as an Interaction Event. Governance Framework GLEIE 6.6 QVI vLEI The External GAR MUST approve issuance of a QVI vLEI Credential after the completion of QVI Identity Verification in section 6.3 X; requirement in Credential X; as.'sessment and'd'emonstratlon of Credential compliance for Qualified vLEI Issuer and above. Governance Framework Issuance 1. GLEIF 6.7 QVI VLEI Credential 1. Voluntary Revocation Revocation An External GAR MUST revoke a Legal Entity vLEI Credential upon receipt of a Fully Signed revocation request by the QAR(s ) of X; requirement in Credential X; as.'sessment and'd'emonstratlon of X; covered as part of the Credential . . . . . . compliance for Qualified vLEI Issuer and . . the Legal Entity, e.g., if the Legal Entity chooses to no longer be the Holder of this Credential using the vLEI software. Governance Framework GLEIF revocation process with KERI . . . X; assessment and demonstration of . L . o . . X; requirement in Credential A o An External GAR MUST perform the revocation within the timeframe specified in Appendix 5, Service Level Agreement (SLA). compliance for Qualified vLEI Issuer and Governance Framework GLEIF . . . X; assessment and demonstration of X; requireme

nt in Credential A o 2. Involuntary compliance for Qualified vLEl Issuer and Governance Framework Revocation GLEIF Involuntary revocation of vLEI Credentials MUST follow the process specified in Appendix 5, Service Level Agreement (SLA). X; requirement in Credential X; assessmen"c and demonstration of Governance Framework compliance for GLEIF 7 QVI Self- . . . X; assessment and demonstration of . L X; requirement in Credential A " issuance of GLEIF MUST oversee the assignment of these vLEI Credentials issued by QVIs to themselves. compliance for Qualified vLEI Issuer and Governance Framework VLEIs 2. GLEIF 9 Verifier When part of a chain, each chained vLEI MUST include a reference to one or more preceding VLEls in its provenance chain. X; requirement in Credential Policies 2. Governance Framework If any preceding vLEls in the provenance chain or a given VLEI is revoked, then that given vLEI MUST not verify. X; requirement in Credential 3. Governance Framework The schema for each type of vLEI defines what type or types of vLEIs MUST or MAY be referenced in its provenance section. X; requirement in Credential Governance Framework 10 Credential Definition The OOR VLEI Credential MUST be an Authentic Chained Data Container (ACDC) that MUST use for its schema at the time of . . . A A X; requirement in Credential issuance, the JSON Schema found in: Governance Framework 10.1 Schema |1. https://github.com/WebOfTrust/vLEl/blob/dev/schema/acdc/qualified-vLEI-issuer-vLEI-credential .json The field values in the credential MUST be as follows: X; requirement in Credential 2. Governance Framework R X; requirement in Credential The "LEI" field value MUST be the LEI of the QVI. Governance Framework The "gracePeriod" field value MUST be at least 90 (ninety) Days. X; requirement in Credential Governance Framework

GLEIF verifiable LEI (VLEI) Ecosystem Governance Framework 1.0 Trust Assurance Framework Document Version 1.1 Final 2023-04-03 Version Date: 2023-04-03 Status: Final 6 Issuer Policies | [ [ThelssuermMusT: e e e 6.1 be a Qualified vLEl Issuer (QVI) in the vLEl Ecosystem with qualification up to date. X; requirement in Credential X assetss'ment and demonstre'ltlon of Qualifications |1. Governance Framework Qualified vLEI Issuer compliance follow all of the requirements specified in the vLEl Issuer Qualification Agreement. X; requirement in Credential X assetss'ment and demonstre'ltlon of 2. Governance Framework Qualified vLEI Issuer compliance use the vLE| software for hosting Witnesses, Watchers and for Key Management. X; requirement in Credential X assetss'ment and demonstre'ltlon of 3. Governance Framework Qualified vLEI Issuer compliance | [ [The IssuerMuST: - r - ] use the Legal Entity vLEI Credential schema defined in section 8.1. X; requirement in Credential X assetss'ment and demonstre'ltlon of X; Credential format in KERI code 6.2 Credential |1. Governance Framework Qualified vLEI Issuer compliance include the Claims marked as Required in section 8.1. X; requirement in Credential X assetss'ment and demonstre'ltlon of X; Credential format in KERI code 2. Governance Framework Qualified vLEI Issuer compliance 6.3 Legal Entity Identity 1. Identity Verification Assurance A QVI Authorized Representative (QAR) MUST verify that the LEI supplied for the Credential is the LEI of the Legal Entity for which X; requirement in Credential X; assessment and demonstration of the issuance request for the Credential has been made. Governance Framework Qualified vLEI Issuer compliance A QAR MUST verify the Legal Entity Identifier (LEI) of the Legal Entity has an entity status of Active and an LEI registration status X; requirement in Credential X; assessment and demonstration of other than Lapsed, Retired, Duplicate, Annulled or Merged (will be deprecated in March 2022) in the Global LEI System. Governance Framework Qualified vLEI Issuer compliance A QAR MUST perform identity assurance of a person serving in the role of a Legal Entity Authorized Representative (LAR) to at least Identity Assurance Level 2 (IAL2) as defined in NIST 800-63A (https://pages.nist.gov/800-63-3/sp800-63a.html). Even when X; requirement in Credential X; assessment and demonstration of IAL2 is used for Identity Assurance, a real-time OOBI session is required as specified 2.b. below (essentially

including the IAL3 Governance Framework Qualified vLEI Issuer compliance c requirement for a Supervised Remote In-person session). 2. Identity Authentication . . X; requirement in Credential A credential wallet MUST be set up for the Legal Entity and for each LAR. Governance Framework The Legal Entity MUST designate a set of one or more LARs to act on its behalf. X; requirement in Credential Governance Framework A QAR and the LARs MUST establish a real-time OOBI session in which the QAR and all LARs are present. An example is a X; requirement in Credential X; assessment and demonstration of [ continuous web meeting attended by all parties on both audio and video. Governance Framework Qualified vLEI Issuer compliance The following steps MUST be performed in this order and completed during this OOBI session. X; requirement in Credential X; assetss'ment and demonstre'ltlon of Governance Framework Qualified vLEI Issuer compliance The QAR MUST perform' manual vernflcatlon of each LAR’s legal identity ft')r wh'lch the QA'R has already performed Identity X; requirement in Credential X; assessment and demonstration of Assurance. An example is each LAR visually presenting one or more legal identity credentials and the QAR compares the - . B o i , Governance Framework Qualified vLEI Issuer compliance credentials verified during Identity Assurance to the LAR Person. The QAR MUST use an OOBI protocol (such as a QR code or live chat) to share the QVI Autonomic Identifier (AID) with the LARs. X; requirement in Credential X; assetss'ment and demonstre'ltlon of Governance Framework Qualified vLEI Issuer compliance A LAR MUST use an OOBI protocol (such as a QR code or live chat) to share the Legal Entity AID with the QAR. X; requirement in Credential Governance Framework

The QAR MUST send a Challenge Message to the Legal Entity AID as defined in the Technical Requirements Part 1 for the X; requirement in Credential X; assessment and demonstration of X; covered as part of the Credential . purposes of cryptographic authentication of the Legal Entity AID. The Challenge Message MUST be unique to the OOBI session. Governance Framework Qualified vLEI Issuer compliance issuance process with KERI iv. Each LAR MUST use its Private Key Store to sign and return a response to the Challenge Message, after which the LAR MUST X; requirement in Credential X; assessment and demonstration of X; covered as part of the Credential V. acknowledge that this action has been completed. Governance Framework Qualified vLEI Issuer compliance issuance process with KERI The QAR MUST verify in real time that a response to the Challenge Message was received from each LAR. X; requirement in Credential X; asse:ssjment and demonstrz'ltlon of Vi. Governance Framework Qualified vLEI Issuer compliance When all responses to Challenge Messages sufficient to satisfy the multi-sig threshold have been received, the QAR MUST verify X; requirement in Credential X; assessment and demonstration of X; covered as part of the Credential Vii. the complete set of signatures. Governance Framework Qualified vLEI Issuer compliance issuance process with KERI The Legal Entity Identity Verification process outlined in section 6.3 MUST be completed before Legal Entity vLEI Credential X; requirement in Credential 6.4 Issuance 1. issuance can begin. Governance Framework In a'ddltlon, a work'flow MUST be |mplemer'1ted in the c'>perat|ons of the QYI which ret'qulr'es, prior to issuing and :<.|gn'|ng an Legal X; requirement in Credential X; assessment and demonstration of Entity vLEI Credential, that the above-mentioned Identity Assurance, Identity Authentication and out-of-band validations are e R A A 3 i Governance Framework Qualified vLEI Issuer compliance 2. performed by a QAR. Another QAR then approves the issuance and signs the Legal Entity vLEI Credential. QVIs MUST call the vLEI Reporting APl with each issuance event of Legal Entity vLEI Credentials. X; requirement in Credential X; asse:ssjment and demonstrz'ltlon of 3. Governance Framework Qualified vLEI Issuer compliance GLEIF MUST update the list of vLEI Credentials on the LEI page of the Legal Entity to reflect Legal Entity vLE| credential issuances X; requirement in Credential X; assessment and demonstration of that have b

een reported by QVIs. Governance Framework GLEIF compliance 1. Voluntary 6.5 Revocation |Revocation A QAR MUST revoke a Legal Entity vLEI Credential upon receipt of a Fully Signed revocation request by the LAR(s) of the Legal X; requirement in Credential X; assessment and demonstration of X; covered as part of the Credential Entity, e.g., if the Legal Entity chooses to no longer be the Holder of this Credential. Governance Framework Qualified vLEI Issuer compliance revocation process with KERI A QAR MUST perform the revocation within the timeframe specified in Appendix 5, Service Level Agreement (SLA). X; requirement in Credential X; asse:ssjment and demonstrz'ltlon of Governance Framework Qualified vLEI Issuer compliance . . o . . X; requirement in Credential X; assessment and demonstration of Involuntary revocation of vLEI Credentials MUST follow the process specified in Appendix 5, Service Level Agreement (SLA). - . ) Governance Framework Qualified vLEI Issuer compliance A QAR MUST call the vLEI Reporting APl with each revocation event of Legal Entity vLEI Credentials. X; requirement in Credential X; asse:ssjment and demonstrz'ltlon of Governance Framework Qualified vLEI Issuer compliance 3. GLEIF MUST update the list of vLEI Credentials on the LEI page of the Legal Entity to reflect vLEI credential revocations that have X; requirement in Credential X; assessment and demonstration of been reported by QVIs. Governance Framework GLEIF compliance The QAR SHOULD remove the LEI of the Legal Entity from the process to monitor the status of LEls used within vLEls. X; requirement in Credential X; asse:ssjment and demonstrz'ltlon of 5. Governance Framework Qualified vLEI Issuer compliance 9 Credential Definition The Legal Entity vLEI Credential MUST be an Authentic Chained Data Container (ACDC) that MUST use for its schema at the time . . . , N X; requirement in Credential . . of issuance, the JSON Schema found in: X; Credential format in KERI code ) . L Governance Framework 9.1 Schema 1. https://github.com/WebOfTrust/vLEl/blob/dev/schema/acdc/legal-entity-vLEIl-credential.json The field values in the credential MUST be as follows: X; requirement in Credential X; Credential format in KERI code 2. Governance Framework "LEI" field value MUST be the LEI of Legal Entity Holder. X; requirement in Credential X; Credential format in KERI code Governance Framework The Sources section MUST contain a source reference to the Qualified vLEl Issuer vLEI Credential of the QVI

that issued this Legal X; requirement in Credential . . 3 N X; Credential format in KERI code 3. Entity vLEI Credential. Governance Framework

GLEIF verifiable LEI (vLEI) Ecosystem Governance Framework 1.0 Trust Assurance Framework Document Version 1.1 Final 2023-04-03 Version Date: 2023-04-03 Status: Final e 1 I e e O 6.1 The Issuer MUST be a LAR of a Legal Entity that holds a valid Legal Entity vLEI Credential that was issued by the QVI with which X; requirement in Credential Qualifications 1. the Legal Entity has contracted to issue vLEI Role Credentials. Governance Framework 6.2 Credential The Issuer MUST: - v 0 000000 use the QVI AUTH VLEI Credential schema defined in sections 9.1 and 9.2 for authorizing the associated OOR vLEIl or ECR VLE| X; requirement in Credential 1. AUTH credentials respectively. Governance Framework include the Claims marked as Required in the schema indicated in 9.1 and 9.2. X; requirement in Credential 2. Governance Framework 6.3 Identity 1. Identity Verification Assurance A LAR MUST perform identity assurance of an OOR Person or ECR Person designated by the Legal Entity to receive vLEl Role Credentials to at least Identity Assurance Level 2 (IAL2) as defined in NIST 800-63A (https://pages.nist.gov/800-63-3/sp800- X; requirement in Credential 63a.html). Even when IAL2 is used for Identity Assurance, a real-time OOBI session is required as specified in 2.b. below Governance Framework (essentially including the IAL3 requirement for a Supervised Remote In-person session). 2. Identity Authentication . X; requirement in Credential A credential wallet MUST be set up for the OOR Person or ECR Person. Governance Framework A LAR and the OOR Person or ECR Person MUST establish a real-time OOBI session in which the LAR and the OOR Person or ECR X; requirement in Credential Person are present. An example is a continuous web meeting attended by all parties on both audio and video. Governance Framework The following steps MUST be performed in this order and completed during this OOBI session. X; requirement in Credential C. Governance Framework The LAR MUST perform manual verification of the OOR Person’s or ECR Person’s legal identity for which the LAR has already . . .

B i A A ) X; requirement in Credential performed Identity Assurance. An example, the OOR Person or ECR Person visually presenting one or more legal identity Governance Framework credentials and the LAR compares the credentials verified during Identity Assurance to the OOR Person or ECR Person.

The LAR MUST use an OOBI protocol (such as a QR code or live chat) to share its Autonomic Identifier (AID) with the OOR

Person X; requirement in Credential or ECR Person. Governance Framework The OOR Person or ECR Person MUST use an OOBI protocol (such as a QR code or live chat) to share its AID with the LAR. X; requirement in Credential Governance Framework The LAR MUST send a Challenge Message to the OOR Person’s or ECR Person’s AID as defined in the Technical Requirements Part . . . A o B B X; requirement in Credential 1 for the purposes of cryptographic authentication of the OOR Person’s or ECR Person’s AID. The Challenge Message MUST be . N Governance Framework iv. unique to the OOBI session. The OOR Person or ECR Person MUST use its Private Key Store to sign and return the response to the Challenge Message, after X; requirement in Credential V. which the OOR Person or ECR Person MUST acknowledge that this action has been completed. Governance Framework The LAR MUST verify in real time that the response to the Challenge Message was received from the OOR Person or ECR Person. X; requirement in Credential Vi. Governance Framework When the response to the Challenge Message has been received by the LAR, the LAR MUST verify the OOR Person’s or ECR X; requirement in Credential vii. Person’s signature. Governance Framework The LAR MUST include the OOR Person’s or ECR Person’s AID obtained during Identify Verification of the OOR Person or ECR . . . o A X; requirement in Credential Person, as well as the name and role of the OOR Person and ECR Person, as elements within the appropriate QVI AUTH vLEI h A . N Governance Framework 6.4 Issuance 1. Credential for the issuance of the associated vLEI Role Credential. A LAR MUST issue QVI AUTH vLEI Credential explicitly authorizing the QARs of a QVI to issue each vLEI Role Credential. The QVI X; requirement in Credential 3. AUTH VLEI Credential will become part of the chain of the vLEI Role Credentials. Governance Framework

To revoke a previously issued vLEI Role Credential, the LAR(s) MUST revoke the QVI AUTH vLEI Credential related to a specific X; requirement in Credential X; covered as part of the Credential 6.5 Revocation |[1. issuance of a vLEI Role Credential Governance Framework revocation process with KERI The QAR then MUST revoke the VLEI Role Credential. X; requirement in Credential X; asse:ssjment and demonstrz'ltlon of X; covered 'as part of the'CredentlaI 2. Governance Framework Qualified vLEI Issuer compliance revocation process with KERI GLEIF MUST monitor the QVI Transaction Event Logs (TELs) to detect revocations of QVI AUTH vLEI Credentials by LARs. This will . . . . A A , A N X; requirement in Credential X; assessment and demonstration of advise GLEIF in the case of a terminated QVI or QVI leaving the VLEI Ecosystem to follow up on revocation of any OOR vLEI . i Governance Framework GLEIF compliance 6.7 Monitoring [1. Credentials. 10 Credential Definition 10.1 Schema The QVI OOR AUTH vLEI Credential MUST be an Authentic Chained Data Container (ACDC) that MUST use for its schema at the . . . A . , X; requirement in Credential . . QVI OOR AUTH time of issuance, the JSON Schema found in: X; Credential format in KERI code ) o . L Governance Framework VLEI Credential |1. https://github.com/WebOfTrust/vLEIl/blob/dev/schema/acdc/ecr-authorization-vlei-credential.json The field values in the credential MUST be as follows: X; requirement in Credential 2. Governance Framework The "AID" field value MUST be the AID of OOR Person. X; requirement in Credential X; Credential format in KERI code Governance Framework The "LEI" field value MUST be the LEI of Legal Entity Holder. X; requirement in Credential X; Credential format in KERI code Governance Framework The "personLegalName" field value MUST be the Legal Name of the Person in the Official Organizational Role at the Legal Entity. X; requirement in Credential X; Credential format in KERI code Governance Framework The "officialRole" field value MUST be the Official Role to be assigned in the vLEI OOR Credential. X; requirement in Credential X; Credential format in KERI code Governance Framework 10.2 Schema The QVI ECR AUTH VLEI Credential MUST be an Authentic Chained Data Container (ACDC) that MUST use for its schema at the . . . A . A X; requirement in Credential . . QVI ECR AUTH time of issuance, the JSON Schema found in: X; Credential format in KERI code f L . - Governance Framework VLEI Credential |1. https://gith

ub.com/WebOfTrust/vLEIl/blob/dev/schema/acdc/ecr-authorization-vlei-credential.json The field values in the credential MUST be as follows: X; requirement in Credential X; Credential format in KERI code 2. Governance Framework The "AID" field value MUST be the AID of ECR Person. X; requirement in Credential X; Credential format in KERI code Governance Framework The "LEI" field value MUST be the LEI of Legal Entity Holder. X; requirement in Credential X; Credential format in KERI code Governance Framework The "personLegalName" field value MUST be the Legal Name of the Person in the Engagement Context Role at the Legal Entity. X; requirement in Credential X; Credential format in KERI code Governance Framework The "engagementContextRole" field value MUST be the Engagement Context Role to be assigned in the vLEI ECR Credential. X; requirement in Credential X; Credential format in KERI code Governance Framework The Sources section MUST contain a source reference to the Legal Entity vLEI Credential (via SAID) held by the Legal Entity issuer X: requirement in Credential of this credential. The Issuer of the referenced Legal Entity vLEI Credential MUST be the target holder of this QVI ECR AUTH vLEI i red X; Credential format in KERI code 3 Credential Governance Framework . redential.

GLEIF verifiable LEI (VLEI) Ecosystem Governance Framework 1.0 Trust Assurance Framework Document Version 1.1 Final 2023-04-03 Version Date: 2023-04-03 Status: Final 6 Issuer Policies 6.1 The Issuer MUST be a Qualified vLEI Issuer (QVI) that has been contracted by a Legal Entity holding a valid Legal Entity vLEI Credential X; requirement in Credential X; assessment and demonstration of Qualifications |1. to issue OOR VLE| credentials. Governance Framework Qualified vLEI Issuer compliance The Issuer MUST: 6.2 Credential use the OOR VLEI Credential schema defined in section 8.1. Additional schema elements may be added depending on the requirement| X; requirement in Credential X; assessment and demonstration of . . e N X; Credential format in KERI code 1. of a use case. Governance Framework Qualified vLEI Issuer compliance . . . . X; assessment and demonstration of . . include the Claims marked as Required in section 8.1. e N X; Credential format in KERI code 2. Qualified vLEI Issuer compliance 6.3 Legal Entity Identity |1. Identity Verification |Assurance A QVI Authorized Representative (QAR) MUST verify that the LEI supplied for the Credential is the LE| of the Legal Entity for which the X; requirement in Credential X; assessment and demonstration of issuance request for the Credential has been made. Governance Framework Qualified vLEI Issuer compliance A QAR MUST verify the Legal Entity Identifier (LEI) of the Legal Entity has a LEI Entity Status of Active and a LEI Registration Status of X; requirement in Credential X; assessment and demonstration of Issued, Pending Transfer or Pending Archival in the Global LEI System. Governance Framework Qualified VLEI Issuer compliance 6.5 OOR Person Identity 1. Identity Verification |Assurance Identity Assurance of a person serving in an Official Organizational Role (OOR Person) MAY be performed either by a QAR, directly or X; requirement in Credential X; assessment and demonstration of through the use of Third-Party Services, or by a LAR. Governance Framework Qualified VLEI Issuer compliance When the Identity Assurance is performed by a QAR, the Identity Assurance MUST be in the same Supervised Remote In-person X; requirement in Credential X; assessment and demonstration of session as the Identity Authentication by the QAR. Governance Framework Qualified VLEI Issuer compliance A QAR MUST perform identity assurance of an OOR Person at least Identity Assurance Level 2 (IAL2) as defined in NIST 800- . . . : R N i N L

X; requirement in Credential X; assessment and demonstration of 63A (https://pages.nist.gov/800-63-3/sp800-63a.htm!). Even when IAL2 is used for Identity Assurance, a real-time OOBI session is . " N ™ N N " ~ ~ = Governance Framework Qualified vLEI Issuer compliance ¢ required as specified 6.d. below (essentially including the IAL3 requirement for a Supervised Remote In-person session). If Identity Assurance and Identity Authentication to generate the AID of the OOR Person is performed by the LAR, then Identity X; requirement in Credential X; assessment and demonstration of Assurance and Identity Authentication can be performed by a separate Supervised Remote In-person session. Governance Framework Qualified VLEI Issuer compliance 2. Ildentity Authentication by a QAR X; i it in Credential A credential wallet MUST be set up for the OOR Person. requirement in tredentia Governance Framework . . L . L . X; requirement in Credential X; assessment and demonstration of A QAR MUST validate the name and the Official Organizational Role of an OOR Person using one or more official public sources. . . Governance Framework Qualified VLEI Issuer compliance If the name and the Official Organizational Role of the OOR Person cannot be validated using one or more official public sources, the . . . : . A R R X; requirement in Credential X; assessment and demonstration of QAR MUST request from the LAR(s) copies of documents of the Legal Entity, such as Board minutes or resolutions, statutes or . " N . . Governance Framework Qualified vLEI Issuer compliance articles, which would validate the name and the role of the OOR Person. . c. The QAR MUST call the GLEIF API to look up the OOR code for the OOR Person role provided by the Legal Entity to be used in the OOR X: requirement in Credential X; assessment and demonstration of VLEI Credential (when the lists of OOR codes and reference data are accessible using the API). In the interim, a text string will be 4 G q r K GLEIF and Qualified vLEI Issuer used for the OOR in the OOR VLEI Credential. overnance Framewor! compliance In all cases, a QAR and the OOR Person MUST establish a real-time OOBI session in which the QAR and the OOR Person are present. X; requirement in Credential X; assessment and demonstration of An example is a continuous web meeting attended by all parties on both audio and video. Governance Framework Qualified VLEI Issuer compliance X; requirement in Credential X; assessment and demonstration of The following s

teps MUST be performed in this order and completed during this OOBI session. N . . £, Governance Framework Qualified VLEI Issuer compliance

The QAR MUST send a Challenge Message to the OOR Person’s AID as defined in the Technical Requirements Part 1 for the purposes X; requirement in Credential X; assessment and demonstration of X; covered as part of the Credential of cryptographic authentication of the OOR Person’s AID. The Challenge Message MUST be unique to the OOBI session. Governance Framework Qualified VLEI Issuer compliance issuance process with KERI| The OOR Person MUST use its Private Key Store to sign and return the response to the Challenge Message, after which the OOR X; requirement in Credential X; covered as part of the Credential Person MUST acknowledge that this action has been completed. Governance Framework issuance process with KERI| X; i it in Credential X; t and di tration of The QAR MUST verify in real time that the response to the Challenge Message was received from the OOR Person. requirement In trecentia asss{s‘smen anddemons r‘a lono Governance Framework Qualified VLEI Issuer compliance X; i it in Credential X; t and di tration of X; d rt of the Credential When the response to the Challenge Message has been received by the QAR, the QAR MUST verify the OOR Person’s signature. requirement In trecentia asss{s‘smen anddemons r‘a lono C[.Nere as part o ? recentia iv. Governance Framework Qualified VLEI Issuer compliance issuance process with KERI The Legal Entity and OOR Person Identity Verification process outlined in sections 6.3 and 6.5 MUST be completed before OOR VLEI X; requirement in Credential X; assessment and demonstration of 6.6 Issuance |1 Credential issuance can begin. Governance Framework Qualified vLEI Issuer compliance The LAR(s) MUST issue a QVI AUTH OOR vLEI Credential and present this VLEI credential to the QVI to request issuance of a OOR VLEI X; requirement in Credential X; assessment and demonstration of X; covered as part of the Credential 2 Credential. Governance Framework Qualified VLEI Issuer compliance issuance process with KERI A workflow MUST be implemented in the operations of the QVI which requires two QARs to be involved in the issuance and signing X A t in Credential X: tand d rati § an OOR vLEI Credential. The first QAR will perform the required above-mentioned Identity Authentication and out-of-band validations 4 é?::::g:]i: FI:a rr::wi:r:'l!a 'Cij:f!i:iser;]ir:;l:sueerr:grr: Ir;”']i: o 3 and then signs the credential. Another QAR then approves the issuance and signs the OOR vLEI Credential. P X: requirement in Credential X; assessment an

d demonstration of A QAR MUST call the vLEI Reporting APl with each issuance event of OOR vLEI Credentials. red GLEIF and Qualified vLEl Issuer Governance Framework . 4 compliance GLEIF MUST update the list of vLEI Credentials on the LEI page of the Legal Entity to reflect OOR VLEI credential issuances that have X; requirement in Credential X; assessment and demonstration of 5 been reported by QVIs. Governance Framework Qualified vLEI Issuer compliance 67 To revoke an OOR VLEI Credential: Revocation 1. The Legal Entity MUST notify the QU t k OOR VLEI Credential X; requirement in Credential X; assessment and demonstration of e Legal Entity notity the O revoke an v redential. Governance Framework Qualified vLEI Issuer compliance To revoke a previously issued OOR VLEI Credential, the LAR(s) MUST revoke the QVI AUTH OOR VLEI Credential related to a specific X; requirement in Credential X; covered as part of the Credential issuance of an OOR VLEI Credential. Governance Framework revocation process with KERI X; i it in Credential X; t and di tration of The QAR then MUST revoke the OOR VLEI Credential. requirement in bredentia assessment and demonstration o . Governance Framework Qualified vLEI Issuer compliance X; i it in Credential X; t and di tration of A QAR MUST perform the revocation within the timeframe specified in Appendix 5, Service Level Agreement (SLA). requirement In trecentia asse‘ss‘men and demons m. lon o Governance Framework Qualified vLEI Issuer compliance . 5 . 3 - - . X; requirement in Credential X; assessment and demonstration of A QAR MUST call the OOR Reporting API with each revocation event of Legal Entity Official Organizational Role vLEI Credentials. e . 2. Governance Framework Qualified vLEI Issuer compliance -- e QVI has been terminatect: —— 3. At the end of the Grace Period for the Qualified vLEI Issuer vLE| Credential that has been revoked by GLEIF, the QVI MUST revoke all of X; requirement in Credential X; assessment and demonstration of the OOR VLEI Credentials that the QVI has issued. Governance Framework Qualified vLEI Issuer compliance X; i it in Credential X; t and di tration of Then, the terminated QVI MUST transfer a copy of its revocation log to GLEIF. requirement in tredentia asse‘ss‘men and demons ra‘ ‘on o Governance Framework Qualified vLEI Issuer compliance GLEIF MUST update the list of OOR VLEI Credentials on the LEI page of the Legal Entity to reflect vLEI credential revocations that have X; requirement in Credenti

al X; assessment and demonstration of 4. been reported by QVIs. Governance Framework GLEIF compliance GLEIF MUST monitor the QVI Transaction Event Logs (TELs) to detect the issuance or revocation of OOR VLEI Credentials which were X; requirement in Credential X; assessment and demonstration of 6.9 Monitoring|1. not reported using the vLE| Reporting API. Governance Framework GLEIF compliance 9 Credential Definition The OOR VLEI Credential MUST be an Authentic Chained Data Container (ACDC) that MUST use for its schema at the time of issuance, . . . . X; requirement in Credential . . the JSON Schema found in: X; Credential format in KERI code . . . - . Governance Framework 9.1 Schema 1 https://github.com/WebOfTrust/vLE|/blob/dev/schema/acdc/legal-entity-official-organizational-role-vLEI-credential json N N X; requirement in Credential . . The field values in the credential MUST be as follows: X; Credential format in KERI code Governance Framework 2. X; requirement in Credential The "LEI" field value MUST be the LEI of Legal Entity Holder. 9 X; Credential format in KERI code Governance Framework . . . ) X; requirement in Credential . . The "personLegalName" field value MUST be the Legal Name of the Person in the Official Role at the Legal Entity. X; Credential format in KERI code Governance Framework The "officialRole" field value MUST be the Official Organizational Role itself. X; requirement in Credential X; Credential format in KERI code Governance Framework The Sources section of the OOR vLE| Credential MUST contain a source reference to the QVI AUTH vLE| Credential (via SAID) that the issuing QVI received authorizing the issuance of this OOR vLEI Credential. The Sources section of that QVI AUTH vLE| Credential X; requirement in Credential X: Credential f ¢ in KERI cod MUST contain a source reference to the Legal Entity vLE| Credential that was issued by the QVI to the Legal Entity and contain the Governance Framework » Credential format in code 3. same value for the “LEI” field as the Legal Entity vLEI Credential.

GLEIF verifiable LEI (VLEI) Ecosystem Governance Framework 1.0 Trust Assurance Framework Document Version 1.1 Final 2023-04-03 Version Date: 2023-04-03 Status: Final 6 Issuer Policies . . . X; assessment and demonstration of L X; requirement in Credential A o 6.1 The Issuer MUST ensure that the Issuer of the QVI vLEI Credential is GLEIF. Governance Framework compliance for Qualified vLEI Issuer and Qualifications |1. GLEIF 62Credential | [The lssuer MUST: e e . . . X; assessment and demonstration of . . . . X; requirement in Credential " . . . use the QVI vLEI Credential schema defined in section 10.1. Governance Framework compliance for Qualified vLEI Issuer and X; Credential format in KERI code 1. GLEIF . . . X; assessment and demonstration of . . . . . X; requirement in Credential A " . . include the Claims marked as Required in section 10.1. compliance for Qualified vLEI Issuer and X; Credential format in KERI code Governance Framework 2. GLEIF 6.3 QVl Identity 1. Identity Verification |Assurance An Externa I' GLEIF Authorlzeq Representative (Externa I' GAR) MUST perform identity asst'Jranc'e of a person serving in the role of X; requirement in Credential X; assessment and demonstration of QVI Authorized Representative (QAR) to at least Identity Assurance Level 2 (IAL2) as defined in NIST 800-63A R i Governance Framework compliance for GLEIF (https://pages.nist.gov/800-63-3/sp800-63a.html). A minimum of two QARs MUST form the QVI multi-sig group. X; requirement in Credential X; asse'ssment and dt'er'nonstratlon of X; co'vered as part of tht'e Credential Governance Framework compliance for Qualified vLEI Issuer issuance process with KERI An External GAR MUST lead for the anchoring action for the QVI External Delegated AID described below. X; requirement in Credential X; assessment' and demonstration of C. Governance Framework compliance for GLEIF 2. |dentity Authentication A credential wallet MUST be set up for the QVI. X; requirement in Credential X; asse'ssment and dt'er'nonstratlon of Governance Framework compliance for Qualified vLEI Issuer The QVI MUST designate a QAR to act on its behalf. X; requirement in Credential X; asse'ssment and dt'er'nonstratlon of Governance Framework compliance for Qualified vLEI Issuer An External GAR and the QAR MUST establish a real-time OOBI session in which the External GAR and the QAR are present. An X; requirement in Credential X as'sessment and'd'emonstratlon of . . . . . . compliance for Qualified vLEI Issuer a

nd example is a continuous web meeting attended by all parties on both audio and video. Governance Framework GLEIF [ . . . X; assessment and demonstration of . . . . . . X; requirement in Credential A o The following steps MUST be performed in this order and completed during this OOBI session. Governance Framework compliance for Qualified vLEI Issuer and GLEIF The External GAR MUST perform manual verification of the QAR’s legal identity for which the External GAR has already i . . . . . . . . . . X; requirement in Credential X; assessment and demonstration of performed Identity Assurance. An example is the QAR visually presenting one or more legal identity credentials and the External i . . . . Governance Framework compliance for GLEIF GAR compares the credentials verified during Identity Assurance to the QAR Person. The External GAR MUST use an OOBI protocol (such as a QR code or live chat) to share the GLEIF External Delegated AID (GEDA) X; requirement in Credential X; assessment and demonstration of with the QAR. Governance Framework compliance for GLEIF . . X; requirement in Credential X; assessment and demonstration of An QAR MUST use an OOBI protocol (such as a QR code or live chat) to share the QVI AID with the External GAR. A . Governance Framework compliance for Qualified vLEI Issuer The External GAR MUST send a Challenge Message from the GEDA to the QVI AID as defined in the Technical Requirements Part . . . . . A . ) X; requirement in Credential X; assessment and demonstration of X; covered as part of the Credential 1 KERI Infrastructure for the purposes of cryptographic authentication of the QVI AID. The Challenge Message MUST be unique to R . . . the 0OBI . Governance Framework compliance for GLEIF issuance process with KERI iv. e session.

The QAR MUST use its Private Key Store to sign and return the response to the Challenge Message, after which the QAR MUST X; requirement in Credential X; assessment and demonstration of X; covered as part of the Credential V. acknowledge that this action has been completed. Governance Framework compliance for Qualified vLEI Issuer issuance process with KERI The External GAR must verify in real time that the response to the Challenge Message was received from the QAR. X; requirement in Credential X; assessment' and demonstration of X; cc'>vered as part of th? Credential Vi. Governance Framework compliance for GLEIF issuance process with KERI When the response to the Challenge Message has been received, the External GAR must verify the signature of the QAR. X; requirement in Credential X; assessmen"c and demonstration of vii. Governance Framework compliance for GLEIF 6.4 Creation X; assessment and demonstration of of the QVI The creation of the QVI Delegated AIDs follows the successful completion of Identity Verification by the External GAR Lead of X; requirement in Credential s o compliance for Qualified vLEI Issuer and Delegated each QAR. Governance Framework GLEIF AlIDs 1. The following steps MUST be performed in the order listed and completed during an OOBI session for a given QVI Delegated AID. X; requirement in Credential X; asse'ssment and d'er"nonstratlon of 2. Governance Framework compliance for Qualified vLEI Issuer Each Delegated AID QVI Authorized Representative (QAR) that is a participating member in the group of AIDs MUST generate its X; requirement in Credential X; assessment and demonstration of own individual single signature AID that will be used to create the QVI Delegated AID. Governance Framework compliance for Qualified vLEI Issuer Each QAR MUST use an OOBI protocol (such as a QR code or live chat) to share its own AID with the other QAR s. For each QAR, X; requirement in Credential X; assessment and demonstration of this provides the participating AID and the service endpoint whereby the other QARs may obtain the KEL of its participating AID. Governance Framework compliance for Qualified vLEI Issuer Each QAR MUST send a Challenge Message tc'> every oth'er QAR as de'f|r'1ed'|r'1 the T'echnlc'al Requirements Part 1 KERI X; requirement in Credential X; assessment and demonstration of Infrastructure for the purposes of cryptographic authentication of their individual single signature AID. The Challenge Message R o A N Governance Framework

compliance for Qualified vLEI Issuer C. MUST be unique to the OOBI session. Each QAR must verify in real time that a response to the Challenge Message was received from every other QAR. X; requirement in Credential X; asse'ssment and d'er"nonstratlon of Governance Framework compliance for Qualified vLEI Issuer Each QAR must verify the signature of every other QAR. X; requirement in Credential X; asse'ssment and d'er"nonstratlon of Governance Framework compliance for Qualified vLEI Issuer One of the QARs must be designated as the Delegated AID QVI Authorized Representative (QAR Lead). X; requirement in Credential X; asse'ssment and d'er"nonstratlon of f. Governance Framework compliance for Qualified vLEI Issuer . . . . . X; requirement in Credential X; assessment and demonstration of The QAR Lead MUST either configure or select the AIDs and Service Endpoints for the QVI Delegated AID Witness Pool. i o Governance Framework compliance for Qualified vLEI Issuer The QAR Lead MUST select the AIDs from the set of QARs for the ordered set of authorized participant members in the multi-sig i . . . ) . . X; requirement in Credential X; assessment and demonstration of group and configure and approve the weight threshold and ordered set of participants for both the current and next set and R o . Governance Framework compliance for Qualified vLEI Issuer h. threshold of participants. Us.'lng the current public key and the next public key digest from each of the participating {-\ID Inception Even"cs, the' Delegated X; requirement in Credential X; assessment and demonstration of Witness AIDs, and the GEDA, the QAR Lead MUST generate the QVI Delegated AID Inception Event and publish this to the other R . ) N A Governance Framework compliance for Qualified vLEI Issuer QARs and to the Delegated AID Witnesses designated by that Inception Event. Each QAR MUST verify the set of public keys, the next public key digest, the Witness identifiers, the threshold, the next threshold, X; requirement in Credential X; assessment and demonstration of and the GEDA in the Delegated AID Inception Event. Governance Framework compliance for Qualified vLEI Issuer Each QAR MUST verify the set of Witness endpoints for the QVI Delegated AID. X; requirement in Credential X asse'ssment and d'er"nonstratlon of k. Governance Framework compliance for Qualified vLEI Issuer Each QAR MUST sign and publish to the Delegated AID Witnesses their signature on the Delegated AID Inception Event. X; requirement i

n Credential X asse'ssment and d'er"nonstratlon of Governance Framework compliance for Qualified vLEI Issuer Each QAR MUST verify that the Delegated AID Inception Event is fully witnessed by every Witness. X; requirement in Credential X asse'ssment and d'er"nonstratlon of m. Governance Framework compliance for Qualified vLEI Issuer GLEIF MUST designate one of the External Delegated AID GLEIF Authorized Representative (External GARs) as the External X; requirement in Credential X aisessr:en;an(li'gedmolls.ltlratlon Ofd Delegated AID GLEIF Authorized Representative (External GAR Lead). Governance Framework compliance tor ;T_IL_IIFe v ssueran 6.5 Delegation of Unless otherwise pre-approved by the GLEIF Root GARs, GLEIF External AID MUST use an Interaction Event to approve the X; requirement in Credential X; as.'sessment and'd'emonstratlon of the QVI . compliance for Qualified vLEl Issuer and delegation of the QVI Delegated AlDs. Governance Framework Delegated GLEIF AlIDs 1. The following steps MUST be performed in the order listed and completed during this OOBI session for the GLEIF External X; requirement in Credential X; as.'sessment and'd'emonstratlon of compliance for Qualified vLEI Issuer and Delegated AID (GEDA). Governance Framework 2. GLEIF The QAR Lead initiates a set of QARs to create a multi-sig group and the QARs mutually are authenticated. X; requirement in Credential X asse'ssment and d'er"nonstratlon of Governance Framework compliance for Qualified vLEI Issuer

The QAR Lead initiates the creation of the Inception Event using the published GLEIF External AID as the Delegator. X; requirement in Credential X asse'ssment and d'er"nonstratlon of Governance Framework compliance for Qualified vLEI Issuer The External GAR Lead verifies that the set of QARs in the multi-sig group in this Inception Event to delegate the QVI External AID X; requirement in Credential X as.'sessment and'd'emonstratlon of e . . compliance for Qualified vLEI Issuer and match those that the External GAR Lead verified according to section 6.3 above. Governance Framework GLEIF c. The External GAR Lead submits request to the External GAR multi-sig group to anchor the Interaction event. All members of the X: requirement in Credential X; assessment and demonstration of External GAR multi-sig group trust External GAR Lead to anchor because the External GARs already have trusted the External GAR ! ch/ernance Framework compliance for Qualified vLEl Issuer and Lead to perform Identity Assurance on the QARs. GLEIF The External GAR Lead then submits a request to issue the Qualified VLEI Issuer VLEI Credential to QVI vLEI to the External GAR X; requirement in Credential X; as.'sessment and'd'emonstratlon of N . compliance for Qualified vLEI Issuer and multi-sig group as an Interaction Event. Governance Framework GLEIE 6.6 QVI vLEI The External GAR MUST approve issuance of a QVI vLEI Credential after the completion of QVI Identity Verification in section 6.3 X; requirement in Credential X; as.'sessment and'd'emonstratlon of Credential compliance for Qualified vLEI Issuer and above. Governance Framework Issuance 1. GLEIF 6.7 QVI VLEI Credential 1. Voluntary Revocation Revocation An External GAR MUST revoke a Legal Entity vLEI Credential upon receipt of a Fully Signed revocation request by the QAR(s ) of X; requirement in Credential X; as.'sessment and'd'emonstratlon of X; covered as part of the Credential . . . . . . compliance for Qualified vLEI Issuer and . . the Legal Entity, e.g., if the Legal Entity chooses to no longer be the Holder of this Credential using the vLEI software. Governance Framework GLEIF revocation process with KERI . . . X; assessment and demonstration of . L . o . . X; requirement in Credential A o An External GAR MUST perform the revocation within the timeframe specified in Appendix 5, Service Level Agreement (SLA). compliance for Qualified vLEI Issuer and Governance Framework GLEIF . . . X; assessment and demonstration of X; requireme

nt in Credential A o 2. Involuntary compliance for Qualified vLEl Issuer and Governance Framework Revocation GLEIF Involuntary revocation of vLEI Credentials MUST follow the process specified in Appendix 5, Service Level Agreement (SLA). X; requirement in Credential X; assessmen"c and demonstration of Governance Framework compliance for GLEIF 7 QVI Self- . . . X; assessment and demonstration of . L X; requirement in Credential A " issuance of GLEIF MUST oversee the assignment of these vLEI Credentials issued by QVIs to themselves. compliance for Qualified vLEI Issuer and Governance Framework VLEIs 2. GLEIF 9 Verifier When part of a chain, each chained vLEI MUST include a reference to one or more preceding VLEls in its provenance chain. X; requirement in Credential Policies 2. Governance Framework If any preceding vLEls in the provenance chain or a given VLEI is revoked, then that given vLEI MUST not verify. X; requirement in Credential 3. Governance Framework The schema for each type of vLEI defines what type or types of vLEIs MUST or MAY be referenced in its provenance section. X; requirement in Credential Governance Framework 10 Credential Definition The OOR VLEI Credential MUST be an Authentic Chained Data Container (ACDC) that MUST use for its schema at the time of . . . A A X; requirement in Credential issuance, the JSON Schema found in: Governance Framework 10.1 Schema |1. https://github.com/WebOfTrust/vLEl/blob/dev/schema/acdc/qualified-vLEI-issuer-vLEI-credential .json The field values in the credential MUST be as follows: X; requirement in Credential 2. Governance Framework R X; requirement in Credential The "LEI" field value MUST be the LEI of the QVI. Governance Framework The "gracePeriod" field value MUST be at least 90 (ninety) Days. X; requirement in Credential Governance Framework

GLEIF verifiable LEI (VLEI) Ecosystem Governance Framework 1.0 Trust Assurance Framework Document Version 1.1 Final 2023-04-03 Version Date: 2023-04-03 Status: Final X; although GLEIF will not be able 2. VLEI Ecosystem stakeholders MUST comply with any governmental regulations for information security to which their activities to determine compliance by within the vLEI Ecosystem will be subject. This includes International or trans-national governance authorities (e.g., ISO/IEC Ecosystem stakeholders other 3 Regulatory 27001 — Information Security Management, EU General Data Protection Regulation (GDPR)). than itself and Qualified vLEI Compliance Issuers X; although GLEIF will. not be able 4 Vel The VLEI Ecosystem Credential Governance Frameworks MUST specify the information to be protected by the applicable privacy to determine compliance by Ecosystem olicy in the jurisdiction of the Legal Entity Ecosystem stakeholders other Stakeholder policy J g : than itself and Qualified vLEI Privacy Policies |2. Issuers 5 VLEI X; although GLEIF will. not be able Ecosystem VLE| Ecosystem stakeholders MUST confirm that they respect and comply with data protection legislation as applicable and in to determine compliance by X; confirmation during Annual vLEI Issuer Stakeholder force. Ecosystem stakeholders other Qualification Data Protection than itself and Qualified vLEI Policies 1. Issuers X; although GLEIF will. not be able W here no such legislation is in force, and as a material minimum standard, vLEI Ecosystem stakeholders MUST comply with the to determine compliance by X; confirmation during Annual vLEI Issuer L . . e i . . Ecosystem stakeholders other P provisions of the Swiss Federal Data Protection Act specified in the Appendix to this policy document. i o Qualification than itself and Qualified vLEI 2. Issuers Qualified vLEI Issuers MUST annually review and document that the provisions are implemented and enforced. X; confirmation dur'lr'1g l-\'nnual VLELIssuer Qualification X; although GLEIF will. not be able When a privacy breach is suspected, the involved VvLEI Ecosystem stakeholders MUST inform each other about actual or potential to determine compliance by . . . . A ) ) o N X; confirmation during Annual vLEI Issuer disclosure(s) of Personal Data and promptly take appropriate measures to address the situation and to limit the risk of such Ecosystem stakeholders other Qualification disclosure(s) from reoccurrence. than itself and Qualified vLEI 5. Issuers Q

ualified vLEI Issuers MUST document privacy breaches in an Incident Report . X; Incident reports flléd by Qualified vLE| Issuers for all privacy breaches VLE| Ecosystem stakeholders MUST publish, review annually, maintain, and comply with IT security policies and practices X; atlth(;)utgh G,LEIF W|II.|'not bebable 6 VLEI sufficient to protect all services that a vLEI Ecosystem stakeholder provides in conformance with this Ecosystem Governance 0 determine compliance by i . X; confirmation during Annual vLEI Issuer Ecosystem . R — Ecosystem stakeholders other X; audit of GLEIF compliance P Framework and meets the minimum elements of the following recommendations: than itself and Qualified vLEI Qualification Stakeholder https://resources.infosecinstitute.com/topic/key-elements-information-security-policy/#gref an ltsell and Luafitied v Security Policies [1. Issuers These policies MUST be mandatory for all employees of the VvLEI Ecosystem stakeholder involved with vLEI Transactions or vLEI X; although G,LEIF will. 'not beable| X; adherer'\c'e to' VLEI Inft')rmatlon X; adherence to vLEI Information Trust . . . . . . . to determine compliance by Trust Policies into services and L . Data. The VLEI Ecosystem stakeholder MUST designate its Information Security Manager or another officer to provide executive . Policies into services and processes for . I . L . . Ecosystem stakeholders other processes for which GLEIF . o . oversight for such policies, including formal governance and revision management, employee education, and compliance 3 o A 5 ) . which Qualified vLEI Issuer Information than itself and Qualified vLEI Information Security Officer is . ) . A enforcement. . Security Officer is responsible 2. Issuers responsible

X; although GLEIF will. not be able |, . . . . . . to det . i b X; inclusion of required employment X; inclusion of required employment VLE| Ecosystem stakeholder employment verification policies and procedures MUST include, but may not be limited to, criminal 0 determine compliance by verification policies and procedures | verification policies and procedures into . . s Ecosystem stakeholders other . L o background check and proof of identity validation . i o into GLEIF Human Resources hiring | Qualified vLEI Issuer Human Resources than itself and Qualified vLEI L process hiring process 3. Issuers Qualified vLEI Issuers MUST recertify annually that they maintain a law abiding and ethical status in the business community as X; confirmation during Annual vLEI Issuer evidenced in the Annual vLEI Issuer Qualification. Qualification If a Qualified VLEI Issuer performs handling of vLEI Data in its own data center, the Qualified vLEIl Issuer’s security policies MUST X; confirmation during Annual vLEI Issuer 5. also adequately address physical security and entry control according to industry best practices. Qualification If a Qualified VLEI Issuer uses third-party providers in functions that involve the handling of vLEI Data, the Qualified vLEI Issuer X: i tion during A | VLEl 1 MUST ensure that the security, privacy, and data protection policies of the third-party providers meet the requirements in this s contirma |o(nl ulr'lfr'\g t'nnua Vil lIssuer document. ualification Qualified vLEI Issuers MUST make available evidence of stated compliance with these policies and any relevant accreditations held by the Qualified vLEI Issuer during Annual vLEI Issuer Qualification, including certificates, attestations, or reports resulting X; confirmation during Annual vLEI Issuer from accredited third-party audits, such as ISO 27001, Statement on Standards for Attestation Engagements Service Organization Qualification 7. Controls 2 (SSAE SOC 2), or other industry standards. Qualified vLEI Issuers MUST maintain and follow documented incident response procedures and guidelines for computer security 7 Security incident handling and will comply with data breach notification terms of the vLEl Issuer Qualification Agreement. ITIL (Information X; confirmation during Annual vLEI Issuer Incidents Technology Infrastructure Library) Incident Management is followed by GLEIF and is certified as part of GLEIF’s ISO 20000 Qualification Policies 1. certification. X; appropriate response pla

n provided to . . . . . . GLEIF during vLEl Issuer Qualification and Qualified vLEI Issuers MUST define and execute an appropriate response plan to investigate suspected unauthorized access to VLE| confirmed during Annual VLEI lssuer data. This plan MUST include procedures and forms that GLEIF and the Qualified vLEI Issuers use responsively to communicate e g . . o . Qualification; existence of forms security events and their disposition. - . . communicating security events and their 2. disposition 8 Availability GLEIF and Qualified vLEI Issuers MUST maintain defined availability targets as part of the vLEI Ecosystem Governance Framework. X; defined GLEI,F availability targets | X; confirmation dur'lr'1g A'nnual VLELIssuer Policies 1. in SLA Qualification . S . - . A . . X; confirmation during Annual vLEl Issuer GLEIF and Qualified vLEI Issuers MUST maintain records to evidence the availability of their services. X; audit of GLEIF compliance e 2. Qualification 9 Developer . . . . . . . GLEIF MUST provide technical changes/upgrades to the VLEl software to Qualified vLEl Issuers. X; audit of GLEIF compliance Security Policies 1 - Qualified vLEI Issuers MUST successfully install, test and implement the GLEIF-supplied vLEI software within stated timeframes. _— X; softwatr'e w]?rklng by stated _ . imeframes

GLEIF verifiable LEI (VLEl) Ecosystem Governance Framework 1.0 Trust Assurance Framework Document Version 1.1 Final 2023-04-03

Version Date: 2023-04-03

Status: Final

• v ] e e e I e e e e I I e e I e e e e I e e e e I I e e I e e e e I e e e e I I e e I e e e e I e e e e I I e e I e e e e I e e e e I I e e I e e e e I e e e e I I e e I e e e e I e e e e I I e e I e e e e I e e e e I I e e I e e e e e

GLEIF verifiable LEI (VLEI) Ecosystem Governance Framework 1.0 Trust Assurance Framework Document Version 1.1 Final 2023-04-03 Version Date: 2023-04-03 Status: Final 1 Business There MUST be availability targets defined for all vLEI services included in Appendix 5 of the vLEI Issuer Qualification Agreement, X X X Requi Qualified VLEI Issuer Service Level Agreement (SLA). equirements |3. The QVI MUST be solely responsible for managing the revenue that is produced and costs that are incurred in the running of its X X 5. VLEI operations.

e [The VI MUST cnsure that s operations regarding VIEis are sustaimably financed. S S 17 [GLEIF MUST not contribute funds of any form whatsoever for QUi operations. S S

GLEIF verifiable LEI (VLEI) Ecosystem Governance Framework 1.0 Trust Assurance Framework Document Version 1.1 Final 2023-04-03 Version Date: 2023-04-03 Status: Final 1. KERI Specifications 1.2 \S/pec!flcatlon Previous versions explicitly cited by policies in this document MUST be supported for a period 18 months . X ersion Upgrades 1. New versions MUST be implemented within a period 12 months after final approval of the new version, unless otherwise superseded by revised policies X in a new version of the vLEI Ecosystem Governance Framework. 2. After upgrading to a new version, implementers MUST NOT begin using any breaking changes until the end of the time period required to adopt new X; assessment and demonstration of versions. For example, v2.0 must be compatible with v1.0 until the end of the v2.0 adoption period. So v2.0 must be used in a v1.0 compatible mode. compliance 3. 2. Endorser (Backer) Management 2.1 Witness MUST use KERI Agreement Algorithm for Control Establishment (KAACE) sufficient majority threshold on a minimum pool of 5 Witnesses. X; assessment and 'demonstratlon of X; covered by KEBI Key Management Pool: 1. compliance Architecture MUST publish Witnesses to at least one ecosystem discovery mechanism: X; assessment and 'demonstratlon of X; covered by KEBI Key Management 3. compliance Architecture Well-Known URI IETF RFC-8615 on a web site(s)associated with entity. The value of the /well-known/oobi resource is a OOBI (out-of-band-introduction) X; assessment and demonstration of to witness or witnesses compliance | |b. [publish OOBIs for witnesses on web site(s) discoverable by search engines. -] KERI Distributed Hash Table (DHT) X; assessment and 'demonstratlon of X; covered by KEBI Key Management C. compliance Architecture DID method resolvers X; assessment and 'demonstratlon of X; covered by KEBI Key Management compliance Architecture X; assessment and demonstration of Ledgers A compliance 2.2 Registrar MUST use a GLEIF Approved DID Method (one for each authorized ledger): X; assessment and demonstration of X; covered by KERI Key Management (Ledger): 1. compliance Architecture Security guarantees are based on the particular ledger X; assessment and 'demonstratlon of X; covered by KEBI Key Management compliance Architecture A DID method MUST be approved down to the ledger-specific level X; assessment and 'demonstratlon of X; covered by KEBI Key Management compliance Architecture 2.3 Hybrid (Witness Pool MUST | tvoe f KEL X; covered by K

ERI Key Management and Ledger use only one type for any L. Architecture Registrar): 1. 4 Key Management 4.1 Key-pair creation and All key-pairs MUST be generated using a cryptographic algorithm with at least 128 bits of cryptographic strength. This includes using a source of entropy X; covered by KERI Key Management storage of at least 128 bits of cryptographic strength for the salt or seed used to generate the private key of the key pair. Architecture infrastructure [4.1.1 Strength 4.1.2 i X; covered by KERI Key Management Autohqmlc Both Authentic Chained Data Container (ACDC) Issuer and Issuee AIDs MUST be transferable. v N v 8 Identifiers Architecture (AIDs)

4.1.3 Key Pre- Rotation for The next or pre-rotated set of keys MUST be protected with the highest level of protection. This level of protection should be commensurate with the X; confirmation during Annual vLEI Issuer Transferable |value of the assets these keys are protecting. Qualification AIDs 1. Non-delegated pre-rotated keys are at the root level of a delegation hierarchy and MUST have the very highest level of protection. There is no recovery mechanism within KERI to regain control over a non-delegated AID once its pre-rotated keys have been captured. The only recourse is to abandon the AID X; confirmation during Annual vLEI Issuer X; covered by KERI Key Management and stand up a new AID and reestablish the reputation and associations of the new AID. This re-establishment process is ecosystem dependent and is Qualification Architecture 2. not part of KERI. 4.3 Signature Best practices for code delivery and library usage MUST be observed for signature verification infrastructure. Because the signature verification X; confirmation during Annual vLEI Issuer Verification infrastructure need never be publicly disclosed an attacker must first discover what computing devices are being used to verify signatures. Qualification Infrastructure |1. 5 GLEIF KERI Profile 5.1 GLEIF Root X; assessment and demonstration of AID Inception GLEIF compliance Event 1. 1. GLEIF MUST hold a recorded GLEIF Root AID Genesis Event with at least a minimum of three Notaries as witnesses. | Ja [The OOBIfor the KEL for the GLEIF Root AID Genesis Event: - 0 000000O] MUST be stored on the following GLEIF servers protected by extended validation HTTPS certificates: X; assessment and demonstratlon of GLEIF compliance . [Furimizo1e521253.010 rod 1 el - | i [NA-CAOVH-0151.79.54.121Prod 1 Canada e e [ i [AF7AAZR0110237159.99 Prod 1 South Africa -] v [sABRAWS 0154233109129 Prod 1Braai I S A v |rscvAuOis210213.18 ProddChina - [ [0CAUOVA0I5116113060 Prog 2 Sydney - i [NAUSHIZ0151614939 Prod 2 Ashium I S A i [AsIr-AzR01207861.227 Prod 2 Japan - [ lx. [AF7AAWS 0113204115106 Prod 2 South Afic - [ x |FU-UKAU01520827.153 Prod 2 United Kingdom I S A MUST be stored at HTTPS URLs of the following affiliated organizations: X; assessment and demonstratlon of GLEIF compliance Qualified vLEI Issuers X; confirmation duntlr?g Annual VLEI Issuer Qualification MUST be stored as a file on a public GLEIF GitHub repository. X; assessment and demonstratlon of C. GLEIF compliance MUST be shared on the followin

g social media: X; assessment and dernonstranon of GLEIF compliance i [ukednonatwier I S A 5.2 GLEIF Root AID 1. Non-delegated pre-rotated keys are at the root level of the delegation hierarchy and MUST have the very highest level of protection X; covered by KERI Key Management MUST be a threshold multi-sig with weighting requirements that have been determined by GLEIF. X v N v g 5 Architecture Key Pair Creation and Storage Infrastructure MUST be within a TEE. X; covered by KEBI Key Management Architecture 3. X; d by KERI Key M: it Each key-pair in a thresholded multi-sig MUST use a non-co-located TEE. s covered by . €y Managemen Architecture X; covered by KERI Key Management 5.3 GLEIF Root The Witness Pool configuration MUST include a minimum of 5 with the sufficient threshold as per KAACE. Z«rchitectl:/re g Witness Pool |1. The number of Witnesses on any single web host provider MUST be less than the sufficient threshold as per KAACE (NOTE: this prevents a single web X; covered by KERI Key Management 2. host provider from hosting a majority of Witnesses.) Architecture

The number of Witnesses in any single political jurisdiction MUST be less than the sufficient threshold as per KAACE. X; covered by KEBI Key Management Architecture GLEIF Root Witness Signing Key Pair key store MAY reside on the Witness Service host but MUST use dedicated user only permissions on the key store X; covered by KERI Key Management directory and its contents. The secrets in the key store MUST be encrypted with the key loaded dynamically whenever the Witness service is started. The Architecture 5. key store MUST reside on a different device or host from that of the Witness service. ést GLE:F GLEIF MUST set the Do Not Delegate configuration property on Qualified vLE| Issuer AIDs. NOTE: This may change in the future to enable horizontal X; covered by KERI Key Management xterna scalability. Architecture Delegate AID 1. 5.7 GLEIF X; d by KERI Key M: it Watcher Larger pool sizes MUST use KAACE sufficient majority thresholds. s covered by N ey Managemen Architecture Network 2. The GLEIF Watcher Signing Key Pair key store MAY reside on the Watcher Service host but MUST use dedicated user only permissions on the key store X; covered by KERI Key Management 3. directory and its contents. Architecture When used, the encryption key store MUST reside on a different device or host from that of the Watcher service. X; covered by KEBI Key Management 5. Architecture 5.8 GLEIF Ke ; i Ma nagemen\t/ The specifc holders of cryptographic keys MUST be kept confidential and shall be determined by GLEIF internal policy. _— é’;;:i?r:]?::;d demonstration of _ Signing keys MUST be rotated whenever there is a likelihood of key compromise. X; covered by KEBI Key Management 3. Architecture The time and place of key rotation MUST be kept confidential among the key holders until after the rotation has been completed. %; assessmerfit and demonstration of GLEIF compliance GLEIF policies for approving rotation of the issuing keys for the GLEIF-Delegated issuing identifier: X; covered by KEBI Key Management Architecture MUST use an OOB (out-of-band) MFA (multi-factor authorization) mechanism to approve Delegated AID rotation. X assessmerfit and demonstration of GLEIF compliance 6. Qualified VLEI Issuer KERI Profile 6.2 Delegated For added security, Qualified VLEI Issuers: AlIDs 1. MUST use Delegated AIDs from GLEIF for issuing VLEs or all types. X; confirmation duntlr?g Annual VLEI Issuer X; covered by KEBI Key Management Qualification Architecture MUST use at least multi-sig scheme

of at least 3 signers with a threshold of 2. X; confirmation duntlr?g Annual VLEI Issuer X; covered by KEBI Key Management Qualification Architecture Each key-pair in a thresholded multi-sig MUST use a non-co-located key store. X; confirmation duntlr?g Annual VLE Issuer X; covered by KEBI Key Management 3 Qualification Architecture 6.3 Qualified VLEI Issuer ncorser An Endorser MUST use either a Witness Pool or a Ledger Registrar for Endorsement X; confirmation during Annual VLEl lssuer X; covered by KERI Key Management Su}pport. 8 8 Qualification Architecture Witness Pool or Ledger Registrar 1. 6.3.1 Witness The Witness Pool configuration MUST include a minimum of 5 with the sufficient threshold as per KAACE. X; confirmation duntlr?g Annual VLEI Issuer X; covered by KEBI Key Management Pool 1. Qualification Architecture The Witness Signing Key Pair key store MAY reside on the Witness Service host but MUST use dedicated user only permissions on the key store directory X; confirmation during Annual vLEI Issuer X; covered by KERI Key Management 2. and its contents. Qualification Architecture The encryption key store MUST reside on a different device or host from that of the Witness service. X; confirmation duntlr?g Annual VLEI Issuer X; covered by KEBI Key Management Qualification Architecture 6.3.2 Ledger Registrar Signing Key Pair key store MAY reside on the Registrar Service host but MUST use dedicated user only permissions on the key store directory X; confirmation during Annual vLEI Issuer X; covered by KERI Key Management Registrar 1. and its contents. Qualification Architecture The encryption key store MUST reside on a different device or host from that of the Registrar service. X; confirmation duntlr?g Annual VLEI Issuer X; covered by KEBI Key Management 3. Qualification Architecture Larger pool sizes MUST use KAACE sufficient majority thresholds. X; confirmation duntlr?g Annual VLEI Issuer X; covered by KEBI Key Management 6.4 Watchers |2. Qualification Architecture Watcher Signing Key Pair key store MAY reside on the Watcher Service host but MUST use dedicated user only permissions on the key store directory X; confirmation during Annual vLEI Issuer X; covered by KERI Key Management 3. and its contents. Qualification Architecture When used, the encryption key store MUST reside on a different device or host from that of the Witness service. X; confirmation duntlr?g Annual VLEI Issuer X; covered by KEBI Key Management 5. Qualification Architecture