OGLEIF’ protecting digital rust verifiable LEI (vLEI)
Ecosystem Governance Framework v1.0 VLEI Issuer Qualification Agreement Appendix 2 VLEI Issuer Qualification Program \ERIE]
Public Document Version 1.1 2023-04-03
v S e | 60 w7/ B s - i {1 < .
p— %y . - 5 . - 8 e AR ".,..,.' 4 o ‘ 1 - s 0 . © .
4 - | .
Table of Contents 1 vLEl Issuer Qualification Program Requirements ........ccccceereencerencreennenn. 4 1.1 Qualification Program Eligibility .......ccccooevvieriiiiiiiiiiie e 4 1.2 FUNDAMENTAIS cciiiiiie ittt ae s srae e s ssnaeessnssnnnesnsnens B G I = o o | Tor= 1 o [ ] [ O R T PPRRUPPPRRRPY” 1.4 Organizational Reputation ......cccccceieiiiiiiiiniiiiiece et srie e sseneeessseveee e snns & 1.5 CoNflicts Of INTEIEST .cciiiiiiie it sabeae e e see D 1.6 VLEI Issuer ReqQUIrEMENTS ....ccouiiiiiiiiiiiiiiiieieieietitieieiere e re e e e resenereee D 1.7 Qualification Program Processing Order......occuveeviiviieeeiiiieeeisseie s siiieeesssiieeesssens D 1.8 Confidentiality .oceeueeeee i e ae e D 1.9 Continuous Improvement of Qualification .........cccceeeveeiiiiiiiniciiviciec e 6 1.10 Use of Third-Party Assessment Reports In Qualification ...........cccccevvivviieiiiieeenn. 6 1.11 Use of Third-Party Service Providers as a Qualified VLEI Issuer..........ccccceevvvvveeenn. 6 1.12 Letters Of ASSUMANCE....ccuuiii ittt siae e s sr e e s sraeeesnssseaesnsans © 2 Roles and Responsibilities...ccccccceereieeeiienierencienceennrennceenceenneeneeeeceesseencees 7 3 The vLEl Issuer Qualfication Program Process.......ccccceeveuerrenncrennnceenncreanes 7 0 R O 1Y =T VAT P OPUPPRRRRRSPUPPPRY 3.2 Qualification Program SUPPOIt ......ccovuiiiiriiiiiiee e cssieee e ee s snaeee e & 4 Overview of the VLEl Issuer Qualification Program Checklist................... 9 5 Annual vLEl Issuer Qualification .........ccceeeiriineiirinnniiirnennicnneenienneennnenne. 12 verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 2 of 13 vLEI Issuer Qualification Agreement Appendix 2 vLEI Issuer Qualification Program Manual Public Document Version 1.1 @ 2023-04-03_appendix-2-vlei-issuer-qualification-program-manual 2023-04-03 _v1.1_Final
Section E Pricing Model This section requests information from the Candidate VLEl Issuer regarding the fees that the Candidate vLEl Issuer would intend to charge for certain vLEI Issuer services. Section F VLEIl Issuer Services This section consists of questions regarding the operation of the services detailed in Appendix 5 to the vLEl Issuer Qualification Agreement, the vLEl Issuer Service Level Agreement (SLA). Section G Records Management The purpose of this section is to outline the Candidate vLEI Issuer’s obligations regarding historical vLEl information so that the Candidate vLEI Issuer understand the requirements in this area. Records retention and management is critical to the effectiveness of vLEI Operations Section H Website Requirements This section confirms the requirements for display of the Qualified vLEI Issuer TrustMark on the website of the Qualified vLEl Issuer if the Candidate vLEI Issuer successfully completes the Quialification Program. Section | Software, Section J Networks and Key Event Receipt Infrastructure (KERI) The purpose of these sections is to provide GLEIF with an understanding of certain IT operational practices and technical environment that the Candidate vLEI Issuer maintains on its own or outsources to third parties. To satisfy the technical requirements for Qualification, a Candidate vLEI Issuer must demonstrate the ability to receive a Qualified vLEI Issuer vLEI credential and issue the Legal Entity, Official Organization Role and Engagement Context Role VLEI credentials, as well the revocation of these credentials, in dry-run sessions with members of GLEIF’s vLEI technical team. In addition, a Candidate vLEl issuer must conduct a test key rotation of the Autonomic Identifier (AID) holding the Qualified vLEI Issuer vLEI credential. Prior to participating in these sessions, the Candidate vLEl Issuer should have integrated the vLEl software into their infrastructure, launched two (2) separate witness networks (one for testing purposes and one for production deployment) and instantiated two (2) Qualified vLEI Issuer wallets (one for testing and one for production). The Candidate vLEI Issuer will use their test witnesses and wallets to complete the required tasks listed above. verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 11 of 13 VLEI Issuer Qualification Agreement Appendix 2 VvLEI Issuer Qualification Program Manual Public Document Version 1.1 GLEIF 2023-04-03_appendix-2-vlei-issuer-qualification-program
-manual 2023-04-03 _v1.1_Final
This qualification will be scheduled by GLEIF with the Candidate VvLEI Issuer with timing to be agreed by GLEIF and the Candidate vLEIl Issuer. GLEIF will confirm successful completion of the technical requirements. Section K Information Security If a Candidate vLEI Issuer has current third-party controls assessment report (e.g., SAS70, SSAE16 SOC2), this report can be submitted in place of responding to the questions in the section. Section L Compliance This section contains questions regarding Legal Compliance and General Compliance with the terms of the vLEI Issuer Qualification Agreement and more broadly, the vLEI Ecosystem Governance Framework requirements. 5 Annual vLEl Issuer Qualification Annual vLEI Issuer Qualification will be initiated by GLEIF on or after the anniversary date of the vLEI Issuer’s date of Qualification. Using the template provided by GLEIF, the Qualified vLEI Issuer verifies the status of each processing area as mentioned in the Qualification Program Checklist. For areas where significant changes have occurred, the Qualified vLEI Issuer documents the nature and extent of the changes and how it/they affected Qualified vLEI Issuer processing. Supporting documentation must be provided as additional information regarding the change(s). GLEIF reviews this information and assesses the overall impact of any changes noted in the internal controls. GLEIF determines if the changed internal controls still meet the required control standard and advises the Qualified VvLEI Issuer as to whether any remediation action is required. GLEIF Essential Tasks: = Provides qualified vLEI Issuer annual qualification questionnaire and other review materials; = Reviews qualified vLEI Issuer submission within 45 calendar days of receipt of a complete set of materials; = Confirms adequate levels of compliance with expected controls exist and/or document required remediation activities; = Ensures that any remediation activities are completed in a timely and complete manner * Maintains on GLEIF website the most up to date list of all qualified vLEI Issuers. verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 12 of 13 vLEI Issuer Qualification Agreement Appendix 2 vLEI Issuer Qualification Program Manual Public Document Version 1.1 GLEIF 2023-04-03_appendix-2-vlei-issuer-qualification-program-manual 2023-04-03 _v1.1 Final
Candidate vLEl Issuer Essential Tasks: = Downloads the designated annual qualification materials from the Communications portal; = Provides completed annual qualification questionnaire (self-assessment) noting all changes to its internal controls within its vLEI operations; = Provides supporting documentation for any process changes noted; = Provides all required materials within 45 calendar days of GLEIF request to initiate the annual qualification; = Reviews GLEIF evaluation results with GLEIF; = Completes any required remediation actions based upon a mutually agreed schedule. Global Legal Entity Identifier Foundation (GLEIF) St. Alban-Vorstadt 5, PO Box 4002 Basel Switzerland qualificationrequest@gleif.org www.gleif.org Chairman of the Board: Steven Joachim Chief Executive Officer: Stephan Wolf © 2022 All rights reserved verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 13 of 13 vLEI Issuer Qualification Agreement Appendix 2 vLEI Issuer Qualification Program Manual Public Document Version 1.1 @ 2023-04-03_appendix-2-vlei-issuer-qualification-program-manual 2023-04-03 v1.1 _Final
Appendix 2: vLEI Issuer Qualification Program Manual This vLEI Issuer Qualification Program Manual is provided to Candidate VLEI Issuers as supplemental user guide in support of the Qualification process. About this Manual The purpose of this document is to provide an overview of the Qualification Program, which is required for all Candidate VLEI Issuers seeking to become Qualified vLEI Issuers of the verifiable LEI (VLEI) Ecosystem. In order to support the integrity of the vLEI Ecosystem, Qualified VLEI Issuers must incorporate the vision and requirements of the verifiable LEI (vLEl) Ecosystem Governance Framework (VLEI Ecosystem Governance Framework) within their operations. Candidate VLEI Issuer are responsible for reviewing the Qualification Program materials posted by GLEIF on its website and determining if they wish to proceed and be evaluated for qualified status. Qualification Program Tools Candidate vLEl Issuers can start the Qualification Program by sending an e-mail to qualificationrequest@gleif.org attaching a signed NDA, Appendix 1 to the vLEI Issuer Qualification Agreement, which can be obtained at www.gleif.org. Prior to requesting to start the Qualification Program, Candidate vLEI Issuers and their relevant parents must have a LEI Entity Status of Active, and a LEI Registration Status of Issued, Pending Transfer or Pending Archival in the Global LEI System, to be able to provide on Appendix 3, the VLEI Issuer Qualification Program Checklist. The vLEI Issuer Qualification Program Checklist, contains questions that must be answered and documents and other information that must be submitted to GLEIF by the Candidate vLEl Issuer in order to be considered for Qualification. GLEIF will grant access to authorized representatives and other key contacts of the Candidate vLEI Issuers specified in the vLEI Issuer Qualification Program Checklist. Authorized users also are provided access to a communications portal for the uploading of all materials and documentation which must be submitted to the communications portal, as well as all written communications, to maintain a proper audit trail during Qualification. verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 3 of 13 VLEI Issuer Qualification Agreement Appendix 2 VvLEI Issuer Qualification Program Manual Public Document Version 1.1 GLEIF 2023-04-03_appendix-2-vlei-issuer-qualification-program-manual 2023-04-03 _v1.1_Final
1 vLEl Issuer Qualification Program Requirements 1.1 Qualification Program Eligibility Any organization in any geographic location may apply to become a Qualified vLEI Issuer with the exception of a sole proprietorship or “natural person”. An organization which does not successfully complete the Qualification Program due to timing deadlines or a decision of GLEIF may re-apply for Qualification at a future date of its choosing. 1.2 Fundamentals Every Candidate VLEl Issuer is required to complete successfully the Qualification Program in order to achieve Qualified vLEI Issuer status. The Qualification Program evaluates a Candidate VLEI Issuer’s financial, operational, and informational technology capabilities using the self-assessment guestionnaire provided by GLEIF which is referred to as the vLEl Issuer Qualification Program Checklist. The specific areas of review are documented in this Manual. GLEIF believes, as part of its founding principles, that every Candidate vLEl Issuer shall be treated in a fully transparent manner with consistent processes and evaluation criteria. 1.3 Certifications Organizations that hold any of the certificates specified in section B of the vLEI Issuer Qualification Program Checklist may be subject to a simplified Qualification Program, which would allow skipping certain sections of the vLEl Issuer Qualification Program Checklist document, where applicable. The decision to all Candidate vLEI Issuers to skip sections of the VLEI Issuer Qualification Program Checklist is at the sole discretion of GLEIF. 1.4 Organizational Reputation GLEIF expects all vLEI Issuers to maintain a law abiding and ethical status in the business community. Concerns or comments brought to GLEIF’s attention regarding Qualified vLEI Issuers will be addressed as well as will be considered during Annual vLEI Issuer Qualification. verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 4 of 13 VLEI Issuer Qualification Agreement Appendix 2 VvLEI Issuer Qualification Program Manual Public Document Version 1.1 GLEIF 2023-04-03_appendix-2-vlei-issuer-qualification-program-manual 2023-04-03 _v1.1_Final
1.5 Conflicts of Interest GLEIF defines a Conflict of Interest (COI) as: “A set of circumstances that creates a risk that professional judgement or actions regarding a primary interest will be unduly influences by secondary interest. Primary interest refers to the principal goals of the profession or activity, such as the protection of clients or duties of public office. Secondary interest includes not only financial gain but also such motives as the desire for professional advancement and the wish to do favours for family and friends.” Given the value and sensitivity of the services that Qualified vLEIl Issuers provide, GLEIF will not accept any degree of COIl given the irredeemable reputational harm it could cause. The Candidate VLEI Issuer is requested to report any potential COI situation to its GLEIF contact for the VvLEI Issuer Qualification Program of explain the circumstances, actions, and remediation implemented to address COI. 1.6 VLEl Issuer Requirements The vLEl Issuer requirements which Qualified vLEI Issuers must meet are defined in the vLEI Ecosystem Governance Framework and in the vLEI Issuer Qualification Agreement and its Appendices. Key topics GLEIF considers critical to be overall integrity of Qualified vLEI Issuer operations have been included. These are reflected in the questions in the vLEI Issuer Qualification Program Checklist. When developing the vLEI Issuer Qualification Program Checklist, GLEIF considered and incorporated generally accepted control standards referring to generally accepted from models such as ISO, COSO, and COBIT. 1.7 Qualification Program Processing Order Qualification Program processing order is based on a FIFO (First in First Out) principle depending on the timeliness and completeness of the Candidate VLEI Issuer submissions. Applications which are incomplete and/or require additional documentation may be impacted with significantly delayed processing times which can affect the precedence of the application. 1.8 Confidentiality Confidentiality is set out in the non-disclosure agreement.
verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 5 of 13
vLEI Issuer Qualification Agreement Appendix 2 vLEI Issuer
Qualification Program Manual
Public Document Version 1.1
@ 2023-04-03_appendix-2-vlei-issuer-qualification-program-manual 2023-04-03 v1.1 _Final
1.9 Continuous Improvement of Qualification GLEIF will evaluate Qualification Program criteria and process for best practices at least annually. Any material changes to this Manual or the vLEI Issuer Qualification Checklist will be managed per the terms of the vLEl Issuer Qualification Agreement, Section VIII, Agreement Change Process. 1.10 Use of Third-Party Assessment Reports in Qualification The Candidate vLEI Issuer may integrate the control assessment and reporting requirements for becoming a Qualified vLEI Issuer with independent auditing activity that is carried out with respect to its organization(s). If a Candidate vLEI Issuer has a current third-party opinion/report from independent, qualified internal auditors, external auditors or, regulatory auditors or independent consultants with respect to the subjects included in the Qualification Program Checklist, these reports may be submitted as evidence as the adequacy and effectiveness of internal controls. The Candidate vLEI Issuer must cross-reference such opinions/reports to the appropriate Qualification Program Checklist item and provide direct responses to questions about areas not included in these opinions/reports. 1.11 Use of Third-Party Service Providers as a Qualified vLEl Issuer The Qualified vLEI Issuer may utilize third-party service providers for certain functions such as running portions of or its IT, operational infrastructure, and administrative functions (e.g., finance, HR) unrelated to VLEI services. The terms and conditions for this are detailed in the vLEI Issuer Qualification Agreement Section IIl. B, Use of Third-Party Services. 1.12 Letters of Assurance It is critical that a Qualified vLEI Issuer maintain its financial viability both in practical terms as well as with respect to the reputation of the Global Legal Entity Identifier System (GLEIS) as a whole. When performing its financial assessment, GLEIF will evaluate both independent information, such as audit reports, as well as unverified information from these reports. This information may be considered as evidence as to the adequacy and effectiveness of internal controls of the Candidate vLEI Issuer, such as operating budgets. GLEIF, at its sole discretion, may require a Candidate vLEl Issuer to provide a letter of assurance, guarantee or confirmation of financial sources and/or support from the Candidate vLEI Issuer’s parent organization(s) indicating its ultimate responsibility for the Candidate vLEl Issuer’s financial
soundness. If such a document is not provided upon request, GLEIF, at its sole discretion may terminate the qualification program of the Candidate VLEl Issuer.
verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 6 of 13
vLEI Issuer Qualification Agreement Appendix 2 vLEI Issuer
Qualification Program Manual
Public Document Version 1.1
@ 2023-04-03_appendix-2-vlei-issuer-qualification-program-manual 2023-04-03 v1.1_Final
2 Roles and Responsibilities 1. Candidate VvLEIl Issuer ® |ssues a Qualification request = Signs a Non-Disclosure Agreement (NDA) = Prepares and submits a completed vLEI Issuer Qualification Program Checklist along with required information and documentation 2. GLEIF = Processes all Qualification requests = Reviews and evaluates vLEI Qualification Program Checklist, required information documentation * Communicates Qualification decisions = Publishes Qualified vLEI Issuers on GLEIF website * Monitors Qualified vLEI Issuers’ activities and performance 3 The vLEl Issuer Qualfication Program Process 3.1 Overview The Qualification Program is in place to ensure that all Candidate vLEIl Issuers meet the minimum financial, operational, and technical requirements of the GLEIF and that a Qualified vLEI Issuer’s control environment has reasonable risk mitigation to protect the integrity of the vLEI operations. Throughout the Qualification Program, the Candidate vLEl Issuer is obliged to inform GLEIF without undue delay about any events or developments which affect the accuracy of information provided to GLEIF such as changes in legal status e.g., form of incorporation, change of signatory power of its officers and the like. Such changes could impact the Qualification Program and/or any agreed time schedule. Candidate vLEl Issuers submit all Qualification Program materials via a communications portal provided by GLEIF. All documents received are date stamped and receipts sent to the representative of the submitting Candidate vLEI Issuer. Once information and documentation are designated as ‘FINAL’, the communications portal is restricted to read-only for users and any proposed changes will need to be discussed with and approved by GLEIF before taking any action. The Qualification Program is comprised of the steps. verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 7 of 13 VLEI Issuer Qualification Agreement Appendix 2 VvLEI Issuer Qualification Program Manual Public Document Version 1.1 GLEIF 2023-04-03_appendix-2-vlei-issuer-qualification-program-manual 2023-04-03 _v1.1 Final
The Candidate vLEl Issuer: * Issues a Qualification request; = Signs a Non-Disclosure Agreement (NDA); = Prepares and submits a completed vLEI Issuer Qualification Program Checklist along with required information and documentation within sixty calendar days of submitting the NDA,; = Completes a successful test run of vLEI Issuer operations and use of GLEIF-supplied vLElI software. GLEIF: = Receives a valid Qualification request; = Assigns dedicated GLEIF Qualification Program staff to the Candidate VLEI Issuer Qualification request; = Reviews the Candidate’s vLEI Issuer’s submission and has ten calendar days to provide feedback on the completeness of the documentation; ® Once the submission is considered complete, GLEIF has sixty calendar days to assess the submission and to provide the Candidate vLEI Issuer with the status of its application; = Communicates Qualification decisions; = Executes the vLEIl Issuer Qualification Agreement with all Qualified vLEl Issuers (Note: the vLEI Issuer Qualification Agreement will be the same for all Qualified vLEI Issuers); = Provides Qualified vLEI Issuers with the GLEIF-supplied vLEI software, the Qualified vLEI TrustMark, access to the communications portal and other requirements specified in the VLEI Issuer Qualification Agreement necessary to begin Qualified vLEI Issuer operations. 3.2 Qualification Program Support In order to provide for fairness to all Candidate vLEl Issuers, GLEIF does not provide consultative advice to Candidate VLEI Issuers regarding their response to the vLEl Issuer Qualification Program Checklist, information and/or documents. GLEIF expects that the definitions and information on its website serve this purpose. However, a Candidate VvLEl Issuer may, upon request, schedule up to two (2) review sessions with GLEIF during the Qualification Program process for the purpose of clarifying program issues and requirements. Each call will be planned for a maximum of one hour's duration. GLEIF reserves the right to request and schedule review meetings for clarification and will follow the same procedure of providing the Candidate VLEI Issuer with a list of questions in advance depending on the subject and circumstances and setting a mutually agreeable schedule. verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 8 of 13 vLEI Issuer Qualification Agreement Appendix 2 vLEI Issuer Qualification Program Manual Public Document Version 1.1 @ 2023-04-03_appendix-2-vlei-issuer-qualification-progra
m-manual 2023-04-03 v1.1 _Final
4 Overview of the vLEI Issuer Qualification Program Checklist The vLEl Issuer Qualification Program Checklist is comprised of the following sections: Section A Contact Details Section B Entity Structure Section C Organization Structure Section D Financial Data, Audits & General Governance Section E Pricing Model Section F VLEl Issuer Services Section G Records Management Section H Website Requirements Section| Software SectionJ Networks and Key Event Receipt Infrastructure (KERI) Section K Information Security Section L Compliance For initial Qualification and each Annual vLEI Issuer Qualification, the documentation sent by the Candidate or Qualified vLEI Issuer will be added as an annex to each Checklist. Section A Contact Details This section requires specific information regarding the Candidate vLEI Issuer’s authorized and key contacts for this process. This includes the preparer and approver of the documents and key reference resources (Operations and Finance) who may need to be contacted for additional information and clarification. It most importantly requests information about the Designated Authorized Representative of the Candidate vLEI Issuer who will be the sponsor of the Qualification Request. This person needs to be authorized by the Candidate vLEl Issuer’s organization to represent the organization as well as serve as the key senior management sponsor throughout the Qualification Program process. Section B Entity Structure This section requires specific information regarding the entity structure of the Candidate vLEl Issuer. The Candidate VLEI Issuer may be a stand-alone organization or part of a larger organization. GLEIF require basic organizational structure information about parent-child relationships, in general, if applicable background information however, the main focus will be on the Candidate vLEl Issuer organization. verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 9 of 13 VLEI Issuer Qualification Agreement Appendix 2 VvLEI Issuer Qualification Program Manual Public Document Version 1.1 GLEIF 2023-04-03_appendix-2-vlei-issuer-qualification-program-manual 2023-04-03 _v1.1_Final
For purposes of clarity, “Government” refers to a Candidate vLEl Issuer which is, or is part of, an administrative agency, nation state or state-owned company. “Private” is a privately controlled legal entity which is not listed on stock exchange. “Public-listed” is an entity which is listed on a stock exchange and has shareholders. “Public-Non-Listed” is an entity which is funded from public sources but does not have stockholders. “Account Framework” and “Internal Controls Framework” refer to commonly recognized business models in use globally. This is helpful but not essential information. The Candidate VLEI Issuer is asked to identify any beneficiary ownership associated with their organization. This section asks the Candidate vLEI Issuer to describe its current audit activities from a variety of sources. This may aid the Candidate VLEI Issuer in identifying any current report from a third-party that could be used to confirm the adequacy of internal controls independent of the organization. These reports may be accepted by GLEIF in lieu of other documentation if current and relating to vLEI Issuer services. Section C Organization Structure The purpose of this section is to inform the Candidate VLEl Issuer as to the types of information/reports which will either be required or may be helpful during the Qualification Process. A key point to note is that distinctions are made as to what reports would generally be expected to be in place for certain types of organization. See the “Applicability” columns. Section D Financial Data, Audits & General Governance The purpose of this section is to provide GLEIF with an overview of certain financial and operational aspects of the Candidate VLEI Issuer. A key point to note is that the Candidate vLEI Issuer must explain clearly how its intended vLEI Issuer operations will be structured within an organization. For example, it could be a stand-alone entity with no other affiliations. It could also be a department/function within another organization. This section applies to the Candidate vLEI Issuer in the context of its parent/owner/controlling entity, if applicable. All relevant entities need to be represented in the Candidate vLEI Issuer’s answers. verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 10 of 13 vLEI Issuer Qualification Agreement Appendix 2 vLEI Issuer Qualification Program Manual Public Document Version 1.1 GLEIF 2023-04-03_appendix-2-vlei-issuer-qualification-program-manual 2023-04-03 _v1.
1 Final