gleifpdf/68

OGLEIF’ Protecting digita trst. verifiable LEI (vLEI) Ecosystem Governance Framework v1.2 VLEI Issuer Qualification Agreement Appendix 3 VLEI Issuer Qualification Program Checklist Public Docur;(()ezn;_\éi(s)l;n 1.2 -~ | e et .60 " . ] . -~ -«r'\”. = (":. e :, . " . 2 f.. : .:?Azo‘/f’ . N " e S ik S oo L ot el R - d . -

Contents 2 A ContactDetdils........c.coiiiiiiiiiiiiiiiiiiiiieiiettereeneeacnnnnenees B B EntityStructure .........ccciiiiiiiiiiiiiiiiieeenneneennennennnannnanas i C OrganizationStructure...........coiiiiiiiiiiiiiiiiiiiiiiiieineneneene 7 D Financial Data, Audits & General Governance ............ccovveeieeee.... 8 E PricingModel........cciiuiuiiiiiiiiiiiiiiiiiiiiiiiinennnnnensesnenss.. 10 F VLEIISSUEIr SErviCesSs ....uuiuieiiiiiienneenenneneencencncnnnnnsnnssnanasssdl G GRecordsManagement.........cciiiiiiiiiiiiiiiiiiiiiiieineeneenn.. 12 H Website Requirements ..........cciiiiiiiiiiiiieiinneneennenneennannnas. 13 I S o o | = P [ J Networks & Key Event Receipt Infrastructure (KERI)..................... 16 K InformationSecurity .......coiiiiiiiiiiiiiiiiiiiiinreeennenennnnnnennas 17 L ComplianCe.....cciiiiiiiiiiiiiiiitineeeeeenneeeennsaassnnacassnnaannnes 18 GLEIF 2022/05

General Information for vLEI Issuer Qualification Program Submission 1

Required Documentation to be Submitted F vLEI Issuer Services Metrics Yes No Not Applicable

1. Will /do you have a process to monitor compliance with the Service

Levels as defined in the VLEI Service Level Agreement (Appendix 5)? Revocation Legal Entity VLEIs

Yes No Not Applicable

1. Will/do you have followed the policies for revocation of vLEI Credentials

specified in VLEI Ecosystem Governance Framework? 2. Will/ldo you have a process to check the status of the LEls for which vLEls

have beenissued for those LEIs with renewal dates of 30 days or less? 3. How will/do you inform the Legal Entity of potential revocation of their

VLEls if their LEI lapses? 4. Will/ldo you have a process to trigger the revocation of

a Legal Entity vLEI? 5. Will/do you check your public Witnesses for vLEI

credential issuance and revocation registry for erroneous or malicious

issuances and revocations (primary issuances) in order to inform your

management process that a key rotation/recovery may be required? 6. Will you notify GLEIF to revoke your Qualified vLEI Issuer vLEI Credential

if you choose to no longer operate as a Qualified vLEl Issuer?

GLEIF 2022|05

General Information for vLEI Issuer Qualification Program Submission 12

Required Documentation to be Submitted G Records Management Records Management Additional Documentation Requested Please provide a brief narrative and copies of all relevant policies.

1. Is a particular function responsible for all aspects of records

retention as per your established internal policies? What is your testing

process and periodicity? 2. Isaperiodic training provided to all relevant personnel (including

employees, contractors, and temporary staff) to make them aware of

your Records Management Procedures? 3. Will/do you ensure indexing, scanning, retrieval, storage, and

destruction processes are documented, communicated, and tested at

least annually? 4. Will/ldo you ensure access to relevant records is restricted to only those

employees who are appropriately authorized and need access to

perform their duties? 5. Will/do you ensure control procedures relating to the physical and

environmental protection of relevant records, including archived data is

in place and functioning properly? 6. Will/do you ensure relevant records are only destroyed in compliance

with your procedures and any local or legal requirements?

GLEIF 2022|05

General Information for vLEI Issuer Qualification Program Submission 13

Required Documentation to be Submitted H Website Requirements Website Requirements Yes No Not Applicable

1. Will/do you display your vLEl Issuer Qualification TrustMark on your

Qualified vLEl Issuer homepage? 2. Willldoes your VLEI Issuer website display applications, contracts and

required documents for Legal Entities to apply for vLEI Legal Entity

Credentials and Role Credentials?

GLEIF 2022|05

General Information for vLEI Issuer Qualification Program Submission 14

Required Documentation to be Submitted I Software - Part A Software Yes No Not Applicable 1. Will/do you have a standard IT service management process in place? (\ (_\ (\ 2. Will/do you have a document that describes the software development tools environment in place for vLEI operations? C C C 3. Will/do you have a formal process for installing, testing, and approving new software? (\ (\ (~ 4. Will/do you have any outsourced software arrangements relating to vLEI operations? 5. Will/do you have a process in place for identifying, tracking, and correcting software errors/bugs? GLEIF 2022|05

General Information for vLEI Issuer Qualification Program Submission 15

Required Documentation to be Submitted I Software - Part B Software Yes No Not Applicable 6. Will/do your developers follow the security recommendations in the vLEI Ecosystem Governance Framework when designing software or services for the use with vLEI Credentials and the vLEI Ecosystem? 7. Will/do you have a process in place to manage the security of your cryptographic keys? 8. WIll specific holders of cryptographic keys kept confidential and determined by your Qualified vLEI Issuer internal policy ? 9. WIll signing keys rotated whenever there is a likelihood of key compromise? 10. WIll the time and place of the key rotation kept confidential among the key holders until after the rotation has been completed? 11. In the case of the key compromise, will key compromise recovery operations be reported to GLEIF within 24 hours of gaining knowledge of the key compromise? 12. WIll all key compromise cases investigated as expeditiously as possible at your own expense to determine the source of the key compromise and a full report of the investigation will be made to GLEIF? 13. Will/do you use best practices for code delivery and observe library usage for signature verifiable infrastructure? 14. Foryour QVI Delegated AID, will you use at least 2 or 3 thresholded multi-signature scheme for added security, and for each key-pair in a thresholded multi-signature scheme, will you use a non-co-located key store for adding security? 15. For your QVI witness services will you provide a Witness Pool or a Ledger Registrar? 16. If your answer to question 15 is a Witness Pool, Will/do your KERI Witness Pool have a miniumum pool of five (5) Witnesses? 17. If your answer to question 15 is a Witness Pool, Will/do you publish your Witnesses to at least one ecosystem discovery mechanism: KERI Distributed Hash Table (DHT), DID method resolvers or Ledgers? 18. If your answer to question 15 is a Witness Pool, for your Witness Pool, will the encryption key store reside on a different device or host from that of the Witness service? 19. If your answer to question 15 is a Ledger Registrar, for your Ledger Registrar, if the Registrar Signing Key Pair Key store resides on the Registrar Service host, will dedicate user-only permissions be used on the key store directory and its contents? L4 20. If your answer to question 15 is Ledger Registrar, for your Ledger Registrar, will the encryption key store reside on a di

fferent device or host from that of the Registrar service? 21. Also, when used, will the encryption key store reside on a different device or host from that of the Witness service? (\ (« (« 22. Will/do you successfully install, test and implement the vLEI Issuer software within the stated time frames and will you use the vLEI software package for hosting Witnesses, (‘ (“ (‘ Discovery and Oracles for Key Management? GLEIF 2022|05

General Information for vLEI Issuer Qualification Program Submission 16

Required Documentation to be Submitted

J Networks & Key Event Receipt Infrastructure (KERI)

Networks & Key Event Receipt Infrastructure (KERI)

Yes No Not Additional Applicable Documentation Requested 1. Please describe the current service/hosting environment. Is it hosted, Relevant process documents in-house, via a third-party, etc.? Describe the use of any cloud-based and technical diagrams resources such as Amazon Web Services or Microsoft Azure.

1. Will/do you perform any monitoring over the vLEI Issuer-related Relevant process documents IT infrastructure?

2. Are there any redundancies built into the hosting platform and hardware? Copies of the related

agreements

1. Has there been any unscheduled downtime of your own network or Relevant process documents system in the past twelve (12) months?

2. Will you have a current disaster recovery and/or business continuity plan in place? Relevant process documents

How often is it tested? Has the continuity plan needed to be invoked during the past 3 operating years?

1. Will/do you have structured backup policies and practices? Relevant process documents

and technical diagrams

1. Will/are third party services (e.g., augmented staff, cloud services, Relevant process documents data centers) utilized in order to provide Qualified vLEI Issuer services? and technical diagrams

2. If your answer to question 7 is Yes, will you have a formal vetting process for Relevant process documents evaluating the reliability of third-party service providers?

3. If your answer to question 7 is Yes, will this process evaluate: Relevant process documents Financial stability, Market reputation, Ability to meet vLEI Ecosystem and technical diagrams Governance Framework requirements, Evaluating the potential risks of utilizing the services provided?

GLEIF 2022|05

General Information for vLEI Issuer Qualification Program Submission 17

Required Documentation to be Submitted

K Information Security

Information Security

1. Have any IT operational or security audits (i.e., SSAE 16, SOC2, SAS70, 1SO27001) been performed, and certification achieved for Qualified VLEI services, in the past?

2. Do you operate an information security policy or policies that meet the VLEI Ecosystem Stakeholder Security Policies requirements and which is/ are mandatory for all employees of the VLEI Ecosystem Stakeholder involved with vLEI transactions or vLEI data?

3. How do you ensure executive oversight and accountability for such policies, including formal governance and revision management?

4. How do you ensure vLEI Issuer systems personnel maintain an appropriate level of security awareness?

5. How do you protect physical access to critical company assets such

as servers and data?

1. What internal security processes will/do you have in place for VLEI Issuer Operations personnel — criminal background checks, proof of identity validation, others?

2. How do you prevent unauthorized access to, or modification of, critical

data assets?

1. How do you ensure unauthorized access to critical data assets can be

detected and investigated?

1. How do you prevent unauthorized network intrusion?

2. Have you performed or engaged a third party to test system vulnerability, intrusion prevention and/or detection or perform penetration testing?

3. How do you ensure that, once vulnerabilities are discovered, these are remediated within appropriate time frames?

4. Will you have procedures in place to identify, document in an

Incident Report and remediate any security breaches? GLEIF 2022|05

General Information for vLEI Issuer Qualification Program Submission 18

Required Documentation to be Submitted L Compliance Legal Compliance Yes No Not Applicable 1. Will you execute a vLEI Issuer Qualification Agreement with GLEIF? 2. Will you execute a formal contract either physically or electronically with a Legal Entity for prior to the Initial issuance of a Legal Entity vLEI? 3. Will/does your Legal Entity contract template include all required contract terms specified in Appendix 7 of the vLEI Issuer Qualification Agreement? General Compliance Yes No Not Applicable 1. Will you keep your vLEI Issuer Qualification up to date? 2. Will you confirm annually that you maintain a law abiding and ethical status in the business community as evidenced in the Annual vLEI Issuer Qualification? 3. Will/have you been accountable to other vLEI Ecosystem Stakeholders for conformance to the purpose, principles, and policies of the vLEI Ecosystem Governance Framework? Will/have you been responsible for and been able to demonstrate compliance with any other requirements of applicable law? 4. Wil/have you informed GLEIF of updates to the vLEI Issuer Contact Details List (Appendix 4)? 5. Will/have you informed GLEIF prior to or as soon as reasonably possible of any change of control at the Qualified vLEI Issuer, be it a change in ownership, voting power, or factual power of third party over the Qualified VLEI Issuer, is only one example of a change? 6. Will/have you used English as the primary language in your formal communications with GLEIF as a Qualified vLEI Issuer which includes all written, electronic, messaging, phone, conferences, communications? 7. Will/have you complied with the Intellectual Property and Confidentiality requirements in the Qualification Agreement? 8. Will/have you ensured that third parties comply with the vLEI Ecosystem Governance Framework when providing vLEI services to you as a Qualified vLEI Issuer? 9 . For third-party services, will’lhave you ensured that you remain fully and unrestrictedly responsible and liable to complying with, and acting in the spirit of, all the requirements for Qualification? 10. Do you ensure that the provisions of the vLEI Ecosystem Stakeholder Data Protection Policies are implemented and enforced? (Please explain) GLEIF 2022|05

G LE I F Enabling global identity Protecting digital trust Global Legal Entity Identifier Foundation (GLEIF) St. Alban-Vorstadt 5, PO Box 4002 Basel Switzerland accreditation@gleif.org gleif.org Chairman of the Board: Steven Joachim Chief Executive Officer: Stephan Wolf © 2022 All rights reserved GLEIF 202205

General Information for vLEI Issuer Qualification Program Submission 3

Required Documentation to be Submitted A Contact Details Legal Name of vLEI Issuer | Note: This name must match your LEI reference Data VAT No. if applicable URL of VLEI Issuer Organization Other Tax ID Number, If applicable LEI of VLEI Issuer Organization Submission Date (YYYY-MM-DD) Direct Parent/Grandparent/Owner/Governing Organization if applicable First Submission Revised Submission LEI of Direct Parent/Grandparent/Governing Organization if applicable Internal Project Manager Designated Authorized Representative Name Name Title Title Email Email Phone Phone Key Contact Operations Key Contact Finance Name Name Title Title Email Email Phone Phone The Checklist can be signed with the digital certificate of the Designated Authorized Representative or a Notarized Copy of the signature of the Designated Authorized Representative. In submitting this vLEI Issuer application, | confirm that, to the best of my knowledge, my organization is in compliance with or is able to become compliant with the requirements reflected in the VLEI Issuer Credential Qualification Agreement, its appendices and the VLEI Ecosystem Governance Framework, as of the date of this document unless otherwise noted. Designated Authorized Representative Signature Date (YYYY-MM-DD) E-Signature Name Title Email Phone This document summarizes the information required to apply to the vLEI Qualification Program which will be submitted through an online tool provided by GLEIF at the launch of the VLEI Issuer Qualification Program. GLEIF 2022|05

General Information for vLEI Issuer Qualification Program Submission 4

Required Documentation to be Submitted Organizations that hold any of the following certificates - eIDAS ETSI EN 319 401, ETSI X-Ref, WEB-TRUST, ISO 20001 OR ISO 27001 - may be subject to a simplified Qualification Program, which would allow skipping certain sections of the vLEI Issuer Qualifications Program Checklist document, where applicable. B Entity Structure Organization Structure For Parent and vLEI Issuer Applicant Government Private - For Profit Private - NonProfit Public-Listed Public-Non-Listed Not Applicable - there is no parent/owner Other Accounting Framework Check as many as applicable Internal Controls Framework Check as many as applicable US GAAP COSsO IFRS COBIT Other - Please specify* ISO* Unknown/Not Applicable Other - Please specify** *Comments (if any) Unknown/Not Applicable * Please note the applicable standard and provide the certificate if you have been certified **Comments (if any) FISCAL YEAR (Please provide your business calendar) Date (YYYY-MM) Date (YYYY-MM) GLEIF 2021|01

General Information for vLEI Issuer Qualification Program Submission 5

Required Documentation to be Submitted B Entity Structure External Audit Firm (if applicable) First Name Comments (if any) Yes No Not Applicable Are annual financial statements issued? Parent Level VLEl Issuer Level Governmental/Regulatory Auditors (if applicable) Organization Comments (if any) Yes No Not Applicable Are annual financial statements issued? Parent Level VLEl Issuer Level Are periodic management letters/reports issued which could relate to VLEI Issuer services? Parent Level VLEl Issuer Level if yes, are these reports public record? Internal Audit Group (if applicable) Department Comments (if any) Yes No Not Applicable Are financial/operational/IT scope audits performed? Parent Level VLEl Issuer Level Are periodic management letters/reports issued which could relate to VLEI Issuer services? Parent Level VLEl Issuer Level if yes, are these reports public record? GLEIF 2022|05

General Information for vLEI Issuer Qualification Program Submission 6

Required Documentation to be Submitted B Entity Structure External Consultants (if applicable) Yes No Not Applicable Have you engaged a third party to evaluate your business and/or IT Parent VLEI Issuer Level Both operations/controls? Are any of these reports SSAE16 SOC Type 1 or equivalent? Parent VLEI Issuer Level Both Are any of these reports SSAE16 SOC Type 2 or equivalent? Parent VLEI Issuer Level Both Are any of these reports ISAE3402 or equivalent? Parent VLEI Issuer Level Both Are any of these reports public record? Parent VLEI Issuer Level Both Please specify the provider of service(s): Comments (if any) Please indicate to which area business, IT operations, IT controls on any copies of reports submitted. GLEIF 2022|05

General Information for vLEI Issuer Qualification Program Submission 7

Required Documentation to be Submitted C Organization Structure Private Private Public- Public Organization Structure Government For Profit Non Profit Listed Non-Listed Type of Document Applicability 1. Prior Year Financial Statements (Parent/Owner) N Y Y Y Y 2. Auditor/Regulator Letter(s)/Rep?n(s) v N N v v (Parent/Owner and vLEI Operations) 3. Most Recent Annual Report — vLEI Issuer N Y Y Y Y 4. Current Organization Chart for all vLEI Operations and v v v v v complete list of all relevant third party service providers. Comments Please note: All documents should be provided as part of the vLEI Issuer Qualification Program Submission. GLEIF 2022|05

General Information for vLEI Issuer Qualification Program Submission 8

Required Documentation to be Submitted D Financial Data, Audits & General Governance Financial Data, Audits & General Governance Type of Document Xref to Docs Provided Yes No N/A Additional Documentation Requested Please cite document Please check one and page number

General Questions - Going Concern - VLEI Issuer

1. Has an independent audit of your financial Audited financial statements (income statements been performed for your last statement, balance sheet, cash flows completed fiscal year? statement) for prior year.

If your organization does not have audited statements, please provide your prior and current financials as maintained. Please explain how these statements are validated and reported.

1. Has an audit firm/government regulatory agency Final Management Letters with management issued any management letters relating to vLEI responses as applicable.

Issuer Operations over the past three years/ - This would include commentary relating to internal controls, accounting controls and methods of procedures.

1. Do you have an internal audit function?

2. Have you been subject to any regulatory Relevant comment letters, audit reports audits/reviews in your current year's (qualified and unqualified opinions) and man- operations? agement responses as applicable

3. Do you have a formal vLEI Issuer Operations Please provide budgets and explain financial Budget for this year and next year's assumptions, volume estimations, operating operations? budget, expenses etc. — soft copies should be

submitted wherever possible.

1. Are you currently involved with any litigation matters which could affect vLEI Issuer services?

2. Are you subject to regulatory compliance requirements which could affect vLEI Issuer operations?

3. Do you clearly understand the requirements of the Annual vLEI Issuer Qualification?

GLEIF 2022|05

General Information for vLEI Issuer Qualification Program Submission 9

Required Documentation to be Submitted E Pricing Model Pricing Model Yes No Not Applicable

1. Do you intend to/do you charge fees for vLEI issuance?
2. Do you intend to/do you charge fees for vLEI revocation?
3. Does your agreed business plan include transparent financial

information and assumptions regarding the vLEI Issuer Services

described in Section F? 4. Will/can you confirm that your organization will be/is solely

responsible for managing the revenue that is produced and costs that

are incurred in the running of your vLEI operations? 5. Can you ensure that your operations regarding vLEls will be/are

sustainably financed? 6. Based on your VLEI business model, plans and volume estimates for

target vLEI customers, please provide your estimates of LEI's (for target

customers that do not have LEIls) and vLEI volumes for this year and the next

two years’ operations (if you are answering the question in the 4th quarter of

this year, then please indicate for the estimate of the next three years’

operations) and a short description of the reason.

GLEIF 2022|05

General Information for vLEI Issuer Qualification Program Submission 10

Required Documentation to be Submitted F vLEI Issuer Services VLEI Issuer Services Additional Documentation Requested Please provide brief narrative. 1. If you will charge for vLEI Issuance and/or revocation will/do you have a standard process for receiving payments from a Legal Entity? 2. How will/do you ensure processing applications for issuance and revocation of vLEIls without delay? 3. Will/do you have a process in place to verify that the Legal Entity Identifier (LEI) of the Legal Entity has an entity status of = "Active" and Registration status = "ISSUED", "PENDING_TRANSFER" or "PENDING_ARCHIVAL" in the Global LEI System? 4. How will/do you inform the Legal Entity of needed amendments to their instructions or refusal to issue VLEIs? 5. In the case of VLEI Credential Issuance, will/lhave you implemented the necessary Identity Verification requirements? 6. Will/do you validate the name of the person and the Official Organizational Role of the Legal Entity Official Organizational Role vLEI Credential using one or more official public sources or by requesting from the LAR(s) copies of documents of the Legal Entity, such as Board minutes or resolutions, statutes or articles, which would validate the name and the role of the OOR Person? 7. Will/do you access, using the GLEIF API, the lists of Official Organizational Roles maintained by GLEIF to choose the correct OOR code to be embedded in OOR vLEI Credentials? 8. Will/do you have processes and procedures to manage, research and validate incoming challenges regarding the name of a person and/ or their Official Organizational Role in a Legal Entity OOR vLEI Credentials? 9. Will’/have you complied with the requirements defined for all vLEI services included in the Appendix 5 to the vLEI Issuer Qualification Agreement — Service Level Agreement (SLA)? 10. Will/do you call the vLEI Reporting API with each issuance of a Legal Entity vLEI Credential and for each Legal Entity Official Organizational Role vLEI for which the Legal Entity has confirmed the consent of the OOR person? GLEIF 2022|05