@> Protecting digital trust verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 VLEI Issuer Qualification Agreement Appendix 5 Qualified vLEI Issuer Service Level Agreement Public Document version 1.2 2022-12-06 . . — ’ A é | / e p- *\” « - . ~ fié\‘ B / Vi — - I g, S S ’ . . o TR TN S @ o. F. .. : =\ : _’ ¢ ' ‘u‘\ " {F({ ’d N | ey k . .i . p (. b " e - o.... ° . - : g » € i A » J ‘ y - * » Yo 3 -
Table of Contents 1 Service Level Agreement GlOSSary.....c.ccceeecerreirieenierenecrrencreenenranesennnees 3 2 GLEIF Services — Service DesCriptions ........cccceeeeeerreeencrenceecrencresencsnsenees 0 2.1 vLElIssuer QUalification ........ccoccoiiiiiieiieieee e e sseaaens O 2.2 Annual vLEI Issuer QUalification .......cccceeeeeeeiieiie e enenenn D 2.3 Termination of Qualified vLEI Issuer Qualification........ccccoocvvevreeeeeeieninniniiiiiiienn 11 2.4 VLEIREPOITING APl ..ot ee e e e ereee et s s e e eesesaseseseeeeess 13 2.5 Challenge Legal Entity Data.....ccccccovvviiiiiiiniiiieeiesciiieee e essvieeeessssiiineesesssiinneseesnnns 14 2.6 Communications Portal.........ccoccooiiiiiiieiiee e ee e eeseeenens 1D 3 VLEl Issuer Services — Service Descriptions.....ccccceeeuereeencrereecrencennrencenna 17 3.1 Issue Legal Entity VLEI Credentials .......cccccovuiiiiiiiiiiiiiiiie e essieeee e sieieeeen 18 3.2 Issue Legal Entity Official Organizational Role vLEI Credentials........................... 19 3.3 Manage Legal Entity vLEI Credentials and Legal Entity Official Organizational Role VLEI Credentials......cooo ettt ee e e eennnnsneeneenens 21 4 Monitoring and Service Level Breaches........ccceeeereeniiirenccreeiceennccreeneennn23 4.1 Maintenance windows at GLEIF.............cccooiiiiiieeiie e eeeecrcccrierreeeeee e 25 4.2 Service LeVel BreaChes ... uiiiiii ettt ee e e errrnrsnraesseeeseeeaeeeees 2D 4.3 Escalation Management.....ccceciviieiiiniiiiieee st eee s sineae e e snnaeeeesnnnneees 2D T N XY or- | =1 o o T =LY P SUPUUR DY 1o 4.3.2 ESCAlAtiON LEVEI 2 ..ottt ee e e e ssrtrrrae e e e s e e e s snnnnneaeens 2D T I Y or- | = o o =LY T I SR UPSPPUDY) o3 O =T o o 11 - L o] o (RPN PUUUPPPRRRRPPRR o 4.5 EScalation CoNtAcES .......uiiiiiiiiiiieiie et eee e e et resaeeeeeeeaeeeees 20 5 Incident Management......c.ccccoiieiieeiiinniieeiiieniinnineiinnesesssesnenssseneess 2 7 5.1 MaJor INCIAENT...ciiiiiiiiieeee e e e e s saaeeae e e s sinaaeeeees 28 6 complaints............................................................................................29 7 GLEIF Code of Conduct in case of a disaster......cccccceeeereenirrnnncreenncnenee... 30 8 SLA Reports...........................................................................................31 9 Change of Service LeVels .......ccueeeiiieiireeiiieniiieeirrencernnesenneesnnsesranseees 32 verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 2 of 32 Public Version 1.2 GLEIF 2022-12-06_appendix-5-Qualified-vle
i-issuer-service-level- 2022-12-06 agreement_v1.2_final.docx
2.3 Termination of Qualified vLEIl Issuer Qualification Termination of Qualified vLEIl Issuer Qualification Revoke the Qualified vLEI Issuer VLEI Credential and migrate impacted vLEI Credentials GLEIF will terminate the Qualification of any Qualified vLEI Issuer that does not successfully complete Annual vLEI Issuer Qualification, does not address of qualification issues documented as a result of Annual vLEI Issuer Qualification, does not remediate breach of requirements documented in the Qualified vLEl Issuer Agreement or its appendices, if the LEl of a Quialified vLEl Issuer does not meet the required entity and LEI registration requirements or if the Qualified vLEI Issuer chooses to cease VLEI Issuer operations. GLEIF will revoke the Qualified vLEI Issuer vLEI Credential of the terminated vLEl Issuer and will remove the terminated vLEI Issuer from the list of Qualified vLEI Issuers on GLEIF’s website which will result in a change in status of the TrustMark on gleif.org. The leaving Qualified vLEl Issuer notifies the Designated Authorized Representatives of each managed Legal Entity, informing them that all their vLEI certificates will be revoked and become invalid by the date provided and therefore they must find a new Qualified VLEI Issuer before that date. In case the leaving Qualified vLEl Issuer fails or refuses to notify the Designated Authorized Representatives of each managed Legal Entity, GLEIF will take the ownership of the notification and may additionally held the leaving Qualified vLEI Issuer liable for damages according to Qualification Agreement, Chapter X. Liability. o GLEIF o Terminated vLEl Issuers o Other Qualified VLEI Issuers o Revoke qualified vLEI Issuer vLEI Credential o If the termination notification has not been managed by the leaving Qualified vLEI Issuer, GLEIF notifies the Designated Authorized Representatives of Legal Entities o Cooperate in termination ¢ Notify all the Designated Authorized Representatives of the managed Legal Entities verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 11 of 32 Public Version 1.2 GLEIF 2022-12-06_appendix-5-Qualified-vlei-issuer-service-level- 2022-12-06 agreement_v1.2_final.docx
60 calendar days 2 concurrent Terminated vLEl Issuers In case the Continuity process is invoked (ref. chapter 7) verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 12 of 32 Public Version 1.2 GLEIF 2022-12-06_appendix-5-Qualified-vlei-issuer-service-level- 2022-12-06 agreement_v1.2_final.docx
2.4 vLEI Reporting API VLEI Reporting API Legal Entity vLEI credentials and Legal Entity Official Organizational Role VLEI credentials must be reported by the Quialified vLEl Issuer to GLEIF in order to be published by GLEIF on the reference data page of the respective LEI GLEIF provides the vLEI Reporting API for Qualified vLEI Issuers to notify GLEIF of the issuance of Legal Entity vLEI Credentials and/or Legal Entity Official Organizational Role vLEI Credentials. These Legal Entity vLEI Credentials and Legal Entity Official Organizational Role vLEI Credentials, issued by the Qualified vLElI Issuer, are published by GLEIF on the LEI page of the Legal Entity. The vLEI Reporting API also will be used by the Qualified VLElI Issuers to inform GLEIF of updates for these vLEI Credentials that have been revoked. Quialified vLEl Issuers must call the vLEI Reporting APl with each issuance event of Legal Entity vLEI Credentials and Legal Entity Official Organizational Role vLEI Credentials and for every revocation event of these vLEI Credentials. o GLEIF ¢ Qualified vLEl Issuers o Provide vLEI Reporting API o Report all Legal Entity vLEI credentials and Legal Entity Official Organizational Role VLEI credentials to GLEIF (Issuance, Revocation) 99,9 % (Monday — Sunday 00:00 — 24:00) 60 requests / minute In case the Continuity process is invoked (ref. chapter 7) verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 13 of 32 Public Version 1.2 GLEIF 2022-12-06_appendix-5-Qualified-vlei-issuer-service-level- 2022-12-06 agreement_v1.2_final.docx
2.5 Challenge Legal Entity Data Challenge Legal Entity Data Facility to challenge Legal Entity related data This service provides the Qualified vLEI Issuers with the challenges triggered by the public or even directly by GLEIF to assess Legal Entity related data. The Qualified vLEI Issuers shall review, and respond to the submitted challenges. The Qualified vLEI Issuers shall ensure the pertaining data is adjusted given the challenge is justified, to provide the adjusted record to GLEIF. ¢ Provide a mechanism for any third party to challenge Legal Entity related data ¢ Provide the technical means to the Qualified vLEl Issuers to respond accordingly to the challenger * Review and respond to all challenges transmitted by GLEIF ¢ Research the content of the challenge and verify the challenge is valid and justified o Update the vLEl data (if justified) and provide the updated information to GLEIF via the vLEl Reporting API ¢ Inform the challenger about the result of the research and justify possible actions or the lack of these ¢ Inform the Legal Entity, associated with the challenged vLEI data, about verified challenges and of challenges which have failed Verification ¢ The Qualified vLEl Issuer shall provide GLEIF with their contact person(s) assigned to manage the vLEI Challenges 97,7 % (Monday — Sunday 00:00 — 24:00) for Customer Portal 10 challenges/day In case the Continuity process is invoked (ref. chapter 7) verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 14 of 32 Public Version 1.2 GLEIF 2022-12-06_appendix-5-Qualified-vlei-issuer-service-level- 2022-12-06 agreement_v1.2_final.docx
2.6 Communications Portal Communications Portal A central web-based communication portal for all communications between GLEIF and business partners A centralized communication platform to support the exchange of information between GLEIF and business partners, supporting GLEIF’s Relationship Management function. This communications platform facilitates: o Regular messaging among GLEIF and business partners o Master Data of business partners (e.g., contact management) o Other necessary exchanges o GLEIF ¢ Candidate and Qualified vLEI Issuers * Enable vLEl Issuer to register an account o Provide Calendar & Events o Provide a repository for vLEl Issuer related information like: e Sharing information for Qualification and Annual vLEI Issuer Qualification o Collecting vLEI Issuer information in the portal e Sharing GLEIF contact information with vLEI Issuers ¢ Exchanging certain information among vLEl Issuers * Enable to other operational portals as necessary ¢ Enter valid registration information o Periodically review list of Authenticated users for the Qualified vLEl Issuer and confirm Authenticated users’ access and access roles. o Deliver upcoming events to GLEIF o Subscribe to the vLEI calendar updates and numbered messages o Unsubscribe as necessary verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 15 of 32 Public Version 1.2 GLEIF 2022-12-06_appendix-5-Qualified-vlei-issuer-service-level- 2022-12-06 agreement_v1.2_final.docx
o Conduct activities related to service level reporting as necessary ¢ Provide other data requests or information filings as applicable 97,7 % (Monday — Sunday 00:00 — 24:00) To register an account within one GLEIF business day 20 requests per GLEIF business day In case the Continuity process is invoked (ref. chapter 7) verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 16 of 32 Public Version 1.2 GLEIF 2022-12-06_appendix-5-Qualified-vlei-issuer-service-level- 2022-12-06 agreement_v1.2_final.docx
3 VLEl Issuer Services — Service Descriptions The VLEI Issuer services set out in this Service Level Agreement all are related to the management of the Legal Entity vLEI Credential and the Legal Entity Official Organizational Role vLEI Credential by the VLEI Issuer, and also to the transmission of all related information to GLEIF. The credibility and trust of the public in the vLEls is deeply anchored to the credibility and trust in the information the vLEl Issuer provides to GLEIF and to the effective management of the listed services by the Qualified vLEI Issuer. To ensure compliance with its Core Duties, the Qualified vLEl Issuer shall also provide means and processes for improving operational quality and performance. The vLEl Issuer is responsible that any third party involved in these services is aware of this document, of the related obligations and that has in place the requested processes for improving operational quality and performance as well. The following table shows the service levels and related targets that are applicable for all the vLElI Issuer services. Challenge vLEI Data 15 calendar days Processing time verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 17 of 32 Public Version 1.2 GLEIF 2022-12-06_appendix-5-Qualified-vlei-issuer-service-level- 2022-12-06 agreement_v1.2_final.docx
3.1 Issue Legal Entity vLEI Credentials Issue Legal Entity vLEI Credentials Qualified vLEl Issuer issues a Legal Entity vLEI Credential to a Legal Entity Qualified vLEl Issuers provide the means for Legal Entities to request vLEI Credentials at the entity level, Legal Entity vLElI Credentials. Qualified vLEl Issuers verify that a Legal Entity’s LEl has an EntityStatus = “ACTIVE” and a RegistrationStatus = “ISSUED”, “PENDING_TRANSFER” or “PENDING_ARCHIVAL”, as well as certain ldentity Verification requirements, such as the representative of the Legal Entity applying for the vLEl is authorized to act on behalf of the Legal Entity and that the credential wallet is controlled by this representative of the Legal Entity. The Qualified vLEl Issuer then can issue a Legal Entity vLEl Credential to the Legal Entity’s credential wallet. Lists of Legal Entity vLEI Credentials are published on gleif.org so that the existence of Legal Entity vLEI Credentials issued for Legal Entities will be discoverable. o Legal Entities via the contract with Qualified vLEl Issuers ¢ By using the GLEIF API, Qualified vLEI Issuers must verify that each new Legal Entity Credential is related to a Legal Entity having an LEI with EntityStatus = “ACTIVE” and RegistrationStatus = “ISSUED”, “PENDING_TRANSFER” or “PENDING_ARCHIVAL” e Qualified vLEI Issuers must follow the Identity Verification requirements specified in the Legal Entity vLEI Credential Framework document which is part of the verifiable LEI (vLEIl) Ecosystem Governance Framework o Qualified vLEI Issuer shall maintain the list of all the Designated Authorized Representatives and Legal Entity Authorized Representatives’ email addresses, that shall be shared with GLEIF and managed as for GLEIF requirements All Legal Entity Credentials are issued to Legal Entities having an LEI with EntityStatus = “ACTIVE” and RegistrationStatus = “ISSUED”, “PENDING_TRANSFER” or “PENDING_ARCHIVAL” verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 18 of 32 Public Version 1.2 GLEIF 2022-12-06_appendix-5-Qualified-vlei-issuer-service-level- 2022-12-06 agreement_v1.2_final.docx
3.2 Issue Legal Entity Official Organizational Role vLEI Credentials Qualified vLEl Issuer issues Legal Entity Official Organizational Role vLEI Credentials to an Official Organizational Role Person of the Legal Entity Qualified vLEl Issuers can issue Legal Entity Official Organizational Role VLEI Credentials (OOR Credentials) at the request of the Legal Entity Authorized Representatives (LAR) holding valid Legal Entity vLEI Credential. A LAR MUST issue Qualified vLEl Issuer Authorization vLEI Credential explicitly authorizing the Qualified VLEI Issuer Authorized Representatives (QARs) to issue each VLEI Role Credential. The Qualified vLEI Issuer Authorization vLEl Credential will become part of the chain of the vLEI Role Credentials. Quialified vLEl Issuers ensure that the LEI embedded in the OOR Credential is the LEI of the Legal Entity requesting the OOR Credential, verify that a Legal Entity’s LEIl has an EntityStatus = “ACTIVE” and a RegistrationStatus = “ISSUED”, “PENDING_TRANSFER” or “PENDING_ARCHIVAL”, and conduct certain ldentity Verification requirements, such as verifying that the representative of the Legal Entity applying for the OOR Credential is authorized to act on behalf of the Legal Entity, validating the name and the Official Organizational Role of the OOR Person using one or more official public sources or in official documents of the Legal Entity requested from the Legal Entity Authorized Representative, and verifying that the OOR Person is in control of its credential wallet. As an added governance and security measure, Qualified vLEI Issuers are required to implement a workflow that separates the functions of performing the above verifications and validations and the checking/approval that these verifications and validations have been done prior to issuing an OOR Credential. Once approval has been given, the Qualified vLEI Issuer can issue the Legal Entity Official Organizational Role vLEI Credential to the OOR Person’s credential wallet. Lists of OOR Credentials will be published on gleif.org (LEl, person’s name and OOR) so that the existence of OOR Credentials issued for Legal Entities will be discoverable (the Legal Entity is required to confirm to the Qualified vLEIl Issuer that the OOR Person has given consent for field values to be published) verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 19 of 32 Public Version 1.2 @ 2022-12-06_appendix-5-Qualified-vlei-issuer-service-level- 2022-12-06 agreement_v1.2_final.docx
¢ By using the GLEIF API, Qualified vLEI Issuers must verify that each new Legal Entity Official Organizational Role VLElI Credentials is related to a Legal Entity having an LEI with EntityStatus = “ACTIVE” and RegistrationStatus = “ISSUED”, “PENDING_TRANSFER” or “PENDING_ARCHIVAL” o Qualified vLEl Issuers must follow the Identity Verification requirements specified in the Legal Entity Official Organizational Role vLEIl Credential Framework document which is part of the verifiable LEI (vLEI) Ecosystem Governance Framework issued to Legal Entities having an LEIl with an EntityStatus = “ACTIVE” and a RegistrationStatus = “ISSUED”, “PENDING_TRANSFER” or “PENDING_ARCHIVAL” verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 20 of 32 Public Version 1.2 @ 2022-12-06_appendix-5-Qualified-vlei-issuer-service-level- 2022-12-06 agreement_v1.2_final.docx
1 Service Level Agreement Glossary Note: All definitions of terms in the vLEI Issuer Qualification Agreement also apply to this Service Level agreement and prevail in case of inconsistency.
Allowed customers of the service.
Attended Service Operating | Time of reachability of GLEIF support on business days.
Time
Availability Property of being accessible and usable on demand by an authorized entity.
Breach When the measure of a Service Level (i.e. the Service Level Result) has exceeded the respective Service Level Target.
Calendar days Calendar days means every day on the calendar, including weekends and public holidays.
Complaint A written, formal expression of dissatisfaction from an vLEl Issuer’s Relations Manager/Authorized Signatory related to GLEIF services and relevant requirements.
Customer Portal Portal for Qualified vLEI Issuers to perform defined processes.
Description Detailed description that also identifies the service interface and its outcomes.
Disaster Extraordinary situation where widespread human, material, economic or environmental losses have occurred which exceeded GLEIF’s ability to respond and recover using its own resources.
Essential Tasks Essential Tasks that are required to be performed by the Service Provider to deliver the agreed service.
Essential tasks excluded Essential tasks that must not be delegated to a Third-Party Service
from Third Party Services provider, unless otherwise agreed in any specific agreement.
Exception Extraordinary situations, that will not be considered for the calculation of a service level.
Failure Each event that has not been performed as committed, that contribute to the evaluation of a Service Level.
GLEIF Business Day Business day in Frankfurt am Main, Germany (Monday — Friday
verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 3 of 32 Public Version 1.2
GLEIF 2022-12-06_appendix-5-Qualified-vlei-issuer-service-level- 2022-12-06 agreement_v1.2_final.docx
3.3 Manage Legal Entity vLEI Credentials and Legal Entity Official Organizational Role vLEI Credentials
Manage Legal Entity vLEI Credentials and Legal Entity Official
Organizational Role vLEI Credentials
Quialified vLEl Issuers management of Legal Entity VLEI
Credentials and Legal Entity Official Organizational Role VLElI
Credentials
Qualified vLEl Issuers are required on a regular basis to check the
status of LEls for which Legal Entity vLEI Credentials have been
issued. These LEIs must maintain an EntityStatus = “ACTIVE” and
a RegistrationStatus = “ISSUED”, “PENDING_TRANSFER” or
“PENDING_ARCHIVAL”.
A process to notify a Legal Entity that the Legal Entity’s Legal
Entity vLEI Credential would be in danger of being revoked if its
LEl is not renewed as required annually also must be put in place.
Qualified vLEl Issuers revoke a Legal Entity vLEI Credential if the
LEI check shows that the Legal Entity’s LEl is not in compliance
with the above entity and LEI registration status requirements.
Revocation of the vLEI Legal Entity Credential causes verification
to fail for all the Legal Entity Official Organizational Role VLElI
Credentials issued by a Qualified VLEI Issuer and the Legal Entity
Engagement Context Role VLEI Credentials that the Legal Entity,
or the Qualified VLEl Issuer, have issued. For the avoidance of
doubt, digital signatures previous to the revocation of the Legal
Entity vLEI Credential will retain their validity.
Qualified vLEl Issuers maintain Legal Entity Official Organizational
Role VvLEI Credentials until notified by the Legal Entity that OOR
Credentials need to be revoked due to a change in role or status
of OOR Persons. The Legal Entity Authorized Representatives
must use the Qualified VvLEI Issuer Authorization vLEI Credential that authorized the issuance of the OOR vLEI Credential as authorization to the Qualified vLEl Issuer to revoke the OOR vLEI
Credential.
Quialified vLEl Issuers manage their public and private keys
according to Key Event Receipt Infrastructure (KERI) technical
requirements for key management and for credential management according to KERI technical requirements.
o Qualified vLEI Issuers are required on a regular basis to check the status of LEls for which Legal Entity vLEI Credentials have been issued. All Legal Entity Credentials shall be always
verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 21 of 32 Public Version 1.2
@ 2022-12-06_appendix-5-Qualified-vlei-issue
r-service-level- 2022-12-06 agreement_v1.2_final.docx
related to Legal Entities having an LEI with EntityStatus = “ACTIVE” and RegistrationStatus = “ISSUED”, “PENDING_TRANSFER” or “PENDING_ARCHIVAL” o Qualified vLEI Issuers are required to put in place a process to notify a Legal Entity that the Legal Entity’s Legal Entity vLEI Credential would be in danger of being revoked if its LEl is not renewed as required annually. Qualified vLEI Issuers revoke a Legal Entity vLEI Credential if the LEI check shows that the Legal Entity’s LEl is not in compliance with the above entity and LEI registration status requirements ¢ Qualified vLEIl Issuers must revoke vLEI Credentials to Legal Entities having an LEI with EntityStatus other than “ACTIVE” or RegistrationStatus other than “ISSUED”, “PENDING_TRANSFER” or “PENDING_ARCHIVAL” o Qualified vLEIl Issuer shall maintain the list of all the Designated Authorized Representatives and Legal Entity Authorized Representatives’ email addresses, that shall be shared with GLEIF and managed as for GLEIF requirements Legal Entity Credentials are revoked within 24 hours after the relevant change of LEI status is available on the GLEIF API (that gets updated 3 times per calendar day) verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 22 of 32 Public Version 1.2 @ 2022-12-06_appendix-5-Qualified-vlei-issuer-service-level- 2022-12-06 agreement_v1.2_final.docx
4 Monitoring and Service Level Breaches The Service Levels and the established Service Level targets ensure the required high quality of the service GLEIF and the vLEI Issuer shall provide to customers and the public. It is therefore essential to closely monitor the achievement of the agreed Service Levels; GLEIF and the VLEI Issuer are therefore responsible to monitor closely their own services and to put in place any needed remediation to provide “state of art” experience to customers and the public. GLEIF Service Level Result Calculations Availability Tmonth - T non availability® GLEIF’s systems —— )x100 Tmonth® (1) Minutes in the month (2) Minutes in the month when the service was not available (excluding planned maintenances) The difference is calculated considering calendar days ProceSSing Time Z(EndResponse(l) - Sta‘rtRequest(z)) GLEIF’'s Customer Z(Requests)m) Portal (1) Time stamp when the task has been accomplished (2) Time stamp when the task has been submitted (3) Number of tasks accomplished in the month Processing Time for (Z(EndResponse(l) - Sta‘rtRequest(z))> GLEIF’s Customer Inci d ents Z Closed incidents priority Porta I (1) Time stamp when incident has been remediated or a workaround has been put in place (2) Time stamp when the incident has been classified (3) Number of requests received in the month PI‘OCGSSing Time for Z(EndResponseBD(l) - Sta‘rtRequestBD(z)) GLE”:'S “Communications Z(R ® Communications equests) Portal”, Register an Portal (1) Time stamp when the request has been accomplished Account (2) Time stamp when the request has been submitted (3) Number of closed requests in the month ProceSSing Time for (Z(EndResponseBD(l) - Sta‘rtRequestBD(z))> GLEIF’s vLEI u. . - - . VLEI Reporting Z(Requests)(s) Reporting API API” Facility (1) Time stamp when the request has been accomplished (2) Time stamp when request has been submitted (3) Number of requests received in the month verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 23 of 32 Public Version 1.2 GLEIF 2022-12-06_appendix-5-Qualified-vlei-issuer-service-level- 2022-12-06 agreement_v1.2_final.docx
Update Frequency (Z (StartDate® — QuulificationDute(z))> GLEIF’s Customer " - - for “Annual vLEI Z Anmual Qualifications ® Portal Issuer e . ” (1) Time stamp when the Annual Qualification started Quallflcatlon (2) vLEI Issuer Qualification Agreement execution date (3) Number of Annual Qualifications started in the month VLEI Issuers Service Level Result calculations Cha”enge VLEI Z(EndResponse(l) - Sta‘rtRequest(z() GLEIF —_— S ] £15 Data: Z(Requests)(3) Customer Portal Processing T|me (1) Time stamp when the task has been accomplished (2) Time stamp when the task has been submitted (3) Number of tasks accomplished in the month Issue LeQaI Entlty Z (L.E.vLEI Credentials with LEI in incorrect EntityStatus or RegistrationStatus™® VLEI SyStem vLEl Credentials: (1) Newly issued Legal Entity Credentials related to Legal Entities having an LEI with EntityStatus other than “ACTIVE” or RegistrationStatus other than “ISSUED”, “PENDING_TRANSFER” or Issuance “PENDING_ARCHIVAL” Compliance Issue LeQaI Entlty Z (L.E.OOR vLEI Credentials with LEI in incorrect EntityStatus or RegistrationStatus® VLEI SyStem Official . . (1) Newly issued Legal Entity Official Organizational Role Credentials related to Legal Entities having Organlzatlonal ROIe an LEI with EntityStatus other than “ACTIVE” or RegistrationStatus other than “ISSUED”, . “PENDING_TRANSFER” or “PENDING_ARCHIVAL” VLEI Credentials: Issuance Compliance Manage LeQaI Z [ (Current Time(® - Time the LEI Changed status @) > 24 hours | VLEI SyStem Entity vLEl . (1) Time when the Legal Entity Credential revocation is detected Credentlals and (2) Time when, on GLEIF API the information the LEI has been updated with EntityStatus other than i P~ “ACTIVE” or RegistrationStatus other than “ISSUED”, “PENDING_TRANSFER” or Legal Entity Official “PENDING_ARCHIVAL” Organizational Role vLEl Credentials: Revocation Processing Time verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 24 of 32 Public Version 1.2 GLEIF 2022-12-06_appendix-5-Qualified-vlei-issuer-service-level- 2022-12-06 agreement_v1.2_final.docx
4.1 Maintenance windows at GLEIF
GLEIF’s website and Global LEI Repository operate 24/7/365 without regular maintenance windows. In
case of exceptional maintenance windows GLEIF will announce them, whenever possible and on a best
effort’s basis, two weeks ahead via email and/or via Communications Portal.
4.2 Service Level Breaches
In case of Service Level breaches, finding timely a sustainable remediation is of predominant
importance for GLEIF and the Qualified vLEl Issuers.
Based on the monthly achievement the Qualified vLEI Issuer can gather on-line from the SLA
Dashboard, if a breach on any Service Level Target is detected then the steps below listed should be
initiated.
4.3 Escalation Management
4.3.1 Escalation Level 1
In case a breach is detected, i.e., a Service Level Target is not achieved, then an Escalation Level 1 is
triggered for the Qualified vLEI Issuer to implement the needed countermeasures.
The SLA Dashboard shall show the remediation occurred latest on the second month after the
escalation notification.
GLEIF can exceptionally extend the remediation time in its sole but reasonable discretion.
If the SLA Dashboard does not show any more breaches on the target month as well as on the following
one, the Escalation Level 1 is closed.
Escalation Level 2 will be triggered:
- If the Escalation Level 1 has not been remediated as required.
- Whena breach, that has been already managed via an Escalation Level 2 or higher, occurs again within the following 2 months after the escalation closure.
4.3.2 Escalation Level 2
Whenever an Escalation Level 2 is triggered, GLEIF’s Escalation Level 2 contact (or deputy) notifies the
Escalation Level 2 counterpart.
The SLA Dashboard shall show the remediation occurred by the next available month after the
escalation notification.
GLEIF can exceptionally extend the remediation time in its sole but reasonable discretion.
If the SLA Dashboard does not show any more breaches on the target month as well as on the following
one, the Escalation Level 2 is closed. verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 25 of 32 Public Version 1.2
GLEIF 2022-12-06_appendix-5-Qualified-vlei-issuer-service-level- 2022-12-06 agreement_v1.2_final.docx
Escalation Level 3 will be triggered in case Escalation Level 2 is not remediated as required. 4.3.3 Escalation Level 3 Whenever an Escalation Level 3 is triggered, GLEIF’s Escalation Level 3 contact notifies the Escalation Level 3 counterpart requesting the breach root cause is understood and a final effective remediation plan. The counterpart implements a sustainable remediation and GLEIF’'s Escalation Level 3 contact (or deputy) closes the Escalation when the SLA Dashboard shows the remediation occurred on the agreed month as well as on the following one. If the remediation has not occurred within the expected timeframe and stability, GLEIF may trigger section 4.4 “Termination”. 4.4 Termination If neither GLEIF nor the vLEI Issuer can reach the definited Service Levels as liste din this document within an adequate period of time to implement any related recommendations, the parties may terminate the Agreement according to section XXII B. of the vLEI Issuer Qualification Agreement. During the Termination process, the Qualified vLEI Issuer is not allowed to issue any new Legal Entity VLEI Credentials. 4.5 Escalation Contacts The escalation contacts are listed in the relevant section of the Communications Portal. It is expected the Escalation Level 2 contacts to be at managerial level, and the Escalation Level 3 contacts at “C” level or equivalent (e.g., President, General Director). Each escalation contact shall mention an assigned deputy. The Qualified vLEI Issuer has the responsibility to keep their escalation contacts up to date. verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 26 of 32 Public Version 1.2 GLEIF 2022-12-06_appendix-5-Qualified-vlei-issuer-service-level- 2022-12-06 agreement_v1.2_final.docx
5 Incident Management GLEIF has implemented the incident management process based on ISO 20000 standard to be able to restore disrupted services back to normal operations to meet service levels. The disrupted service is required to be back to normal operation as quickly as possible with minimal impact on business operations. In the event that an incident on any GLEIF service occurs, the incidents are processed by GLEIF’s service desk, and specialists are assigned to restore agreed services. When the service is fully recovered, the incident is closed. Incidents are to be reported via an email to servicedesk@gleif.org . Incidents are prioritized based on the Impact-Urgency Matrix_depending on the service affected. Processing time is targeted as service level for the following priorities: e Priority 1: 24 hours (during GLEIF business days) o Priority 2: 2 GLEIF business days o Priority 3: 3 GLEIF business days Attended service operating time is Mo-Fr: 09.00 — 17.00 CET/CEST on GLEIF business days. Impact-Urgency Matrix The Impact-Urgency Matrix shows which services are treated with which Priority. Impact — measures the effect of an incident based on the functionality of the service. Urgency - measures the criticality, which indicates the speed of resolving an incident. Priority - is derived from Impact and Urgency. 3 - Low 2 — Medium 1 - High Supporting Services Enhancing Services Core Services 3 Specific ] functionality on unavailable Partial Service unavailable & | Full Service " unavailable [ verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 27 of 32 Public Version 1.2 GLEIF 2022-12-06_appendix-5-Qualified-vlei-issuer-service-level- 2022-12-06 agreement_v1.2_final.docx
Urgency classification VLEI Issuer Qualification Annual VLEI Issuer Application: Customer Portal Qualification VLEI Reporting API Communications Portal _ Challenge vLEI Data Termination of Qualified vLEI _ Issuer Qualification Priority Level Definition The following table shows the priority level definition for an incident. A resolution target is set for each Priority. 1 High Core Services are inaccessible, interrupted, or 24 hours (during GLEIF unusable. business days) 2 Medium Enhancing Services are unusable or hard to use. | 2 GLEIF business days 3 Low Support Services are unusable or hard to use. 3 GLEIF business days 5.1 Major Incident A “Major Incident” is a type of incident, that occurs when all or major parts of the core services are affected by disruption. The resolution time in case of a major incident is 1 hour during GLEIF business days. verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 28 of 32 Public Version 1.2 GLEIF 2022-12-06_appendix-5-Qualified-vlei-issuer-service-level- 2022-12-06 agreement_v1.2_final.docx
6 Complaints
Complaints are handled via the defined process “Feedback”.
The vLEl Issuer can submit their complaints by communicating with their Business Relations
Manager. verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 29 of 32 Public Version 1.2
GLEIF 2022-12-06_appendix-5-Qualified-vlei-issuer-service-level- 2022-12-06 agreement_v1.2_final.docx
7 GLEIF Code of Conduct in case of a disaster In the extraordinary circumstances GLEIF is affected by a disaster:
-
GLEIF informs the vLEl Issuer in the shortest possible time via Communication Portal (if available, or by using any other possible means e.g., email or telephone) and invokes the Service Continuity Process
-
Insuch asituation and until full recovery occurred, the following RTOs and targets are effective
vLEI Issuer Qualification < 1 calendar Availability: 95 % (Customer Portal) month Availability: 97.5 % (GLEIF Website) Processing Time Documentation Completeness: 20 days Processing Time Documentation Review: 90 days Annual vLEl Issuer < 1 calendar Availability: 95 % (Customer Portal) Qualification month Update Frequency: Yearly, on or within 4 months Termination of Qualified <2 GLEIF Processing time: 90 calendar days VLEI Issuer Qualification business days VLEI Reporting API <2 GLEIF Availability: 97.5 % business days Processing Time: < 5 sec Communications Portal <2 GLEIF Availability: 95 % business days Processing time: 4 GLEIF business days Challenge vLEIl Data <1 calendar Availability: 95 % (Customer Portal) month Same workload limits as during business as usual apply. verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 30 of 32 Public Version 1.2 GLEIF 2022-12-06_appendix-5-Qualified-vlei-issuer-service-level- 2022-12-06 agreement_v1.2_final.docx
_ excluding public Germany/Hessen holidays). GLEIF supplied vLEI Open source developed software sponsored by GLEIF with the software capabilities for vLEI Credential Issuance, vLEI Credential Presentation, Identifier and Key Management and vLEI Credential Revocation and supporting functions. Legal Entity VvLEI Credential | The entity level credential issued by a Qualified vLEI Issuer to a Legal Entity which contains the LEI of the Legal Entity. Legal Entity Official A person that represents the Legal Entity in an official Organizational Role Person | organizational role and has a Legal Entity Official Organizational (OOR Person) Role VLEI Credential. Legal Entity Official VLEI Role Credentials issued to persons acting officially on behalf of Organizational Role VLEI a Legal Entity. These persons and their roles can be validated by the Credential (OOR Legal Entity as well as by one or more external official sources. Credentials) Processing Time Time of all involved parties (if not stated otherwise) to fulfill a service request. Qualified vLEl Issuer A VLEI credential that enables simple, safe, secure instruction and Authorization VLEI authorization by a Legal Entity Authorized Representative (LAR) Credential sent to a QVI for the issuance and revocation of vLEI Role Credentials. Recovery Time Objective The maximum amount of time allowed to resume an activity, (RTO) recover resources, or provide products and services after a disaster has occurred. Defines the maximum time to respond to a service request. Service Level Commitment based on Service Level requirements. Ensures that the service is able to meet the GLEIS objectives. Service Level Result Measure of the characteristic of a service committed to by the parties. Service Level Target (SLT, Specific measurable characteristic of a service that an organization also Service Target) commits to Service Continuity Process | The process responsible for recovery of GLEIF vital business functions in the event of a disaster. verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 4 of 32 Public Version 1.2 GLEIF 2022-12-06_appendix-5-Qualified-vlei-issuer-service-level- 2022-12-06 agreement_v1.2_final.docx
8 SLA Reports GLEIF provides monthly SLA Reports to the Qualified vLEI Issuer by the 10" GLEIF business day of the following month. Service Reports Definition Contents Report parameters according to SLA Reporting period Monthly Reporting Reports are made available through the Communications Portal Obligation According to SLA Language English Filing 10 years verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 31 of 32 Public Version 1.2 GLEIF 2022-12-06_appendix-5-Qualified-vlei-issuer-service-level- 2022-12-06 agreement_v1.2_final.docx
9 Change of Service Levels
Chapter XlIl “Agreement Change Process” of the Qualification Agreement applies. verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 32 of 32 Public Version 1.2
GLEIF 2022-12-06_appendix-5-Qualified-vlei-issuer-service-level- 2022-12-06 agreement_v1.2_final.docx
Service Provider An organization which could provide, operate and/or supports Services to one or more customers. Service Transfer Point The definition of the system where the service is delivered to measure the accordant Service Level. A short description that summarizes the service. Technical Note A note, describing GLEIF processes already identified in this Agreement which have an impact on the Qualified vLEIl Issuers. Update Frequency How often a request for service will occur in a given period of time. Workload Limit A measure of the volume of work the parties are committed to assure each service shall achieve the respective Service Level Target. verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 5 of 32 Public Version 1.2 GLEIF 2022-12-06_appendix-5-Qualified-vlei-issuer-service-level- 2022-12-06 agreement_v1.2_final.docx
2 GLEIF Services — Service Descriptions The following services are performed by GLEIF. For all of them, the attended service operating time will be during GLEIF’s Business Days between 09.00 — 17.00 Germany/Hessen local time. 2.1 vLEl Issuer Qualification VLEI Issuer Qualification Entities desiring to become Qualified vLEI Issuers must seek Quialification by GLEIF In order to support the integrity of the vLEI Ecosystem, a vLEl Issuer Qualification Program is required for all Candidate vLEI Issuers seeking to become Qualified vLEI Issuers of the vLEI Ecosystem. Every Candidate VLEI Issuer is required to complete the Qualification Program successfully in order to achieve Qualified VLEI Issuer status. The Qualification Program evaluates a Candidate vLEl Issuer’s financial, operational, and informational technology capabilities using the self-assessment questionnaire provided by GLEIF which is referred to as the VLEI Issuer Quialification Program Checklist. The vLEI Issuer requirements which Qualified vLEI Issuers must meet are defined in the vLEI Ecosystem Governance Framework and in the vLEI Issuer Qualification Agreement and its Appendices, which can be downloaded from GLEIF's website. Upon successful completion of the Qualification Program, GLEIF issues Qualified vLEI Issuer vLEI Credentials to Qualified vLEI Issuers as well as TrustMarks and publishes and maintains a list of Qualified vLEl Issuers on the GLEIF website. It is expected that, on average, the qualification process takes roughly 3 months to be completed. o Candidate vLEl Issuers o Provide vLEl Issuer Qualification Program Manual and Checklist as well as other supporting materials and forms » Set up of Non-Disclosure Agreement / vLEIl Issuer Qualification Agreement o Provide support calls to Candidate vLEIl Issuer as required o After the requested set of Candidate vLEI Issuer qualification materials is provided, GLEIF has 10 calendar days to assess verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 6 of 32 Public Version 1.2 GLEIF 2022-12-06_appendix-5-Qualified-vlei-issuer-service-level- 2022-12-06 agreement_v1.2_final.docx
the documentation completeness and to revert back to the candidate with feedback o After the candidate VLEl Issuer qualification documentation is considered complete, GLEIF has up to 60 calendar days to provide the candidate with the status of their application ¢ Provide GLEIF supplied vLEI software o Evaluate and confirm readiness of Candidate vLEI Issuer based on Qualification Documentation provided and test run of VLEI Issuer operations performed by the Candidate e Issue Qualified vLEl Issuer vLEI Credential o Issue TrustMark e Provide and maintain on GLEIF website a list of all Qualified VLEI Issuers o Read vLEl Issuer Qualification Program Manual and other supporting materials o Sign Non-Disclosure Agreement and submit the same to qualificationrequest@gleif.org to initiate the vLElI Qualification Program o Fillin vLEI Issuer Qualification Program Checklist and develop supporting documentation as required o Participate in support calls with GLEIF o Deliver all necessary Qualification Documentation e Provide all Candidate materials no later than 60 calendar days from the date the request to begin qualification has been submitted o Install vLEI software and perform testing of vLEIl Issuer operations o Remediate areas of non-compliance as required e Sign vLEl Issuer Qualification Agreement o Publish Qualified vLEI Issuer vLEI Credential and TrustMark on own website 99.9 % (Monday — Sunday 00:00 — 24:00) for GLEIF Website 97,7 % (Monday — Sunday 00:00 — 24:00) for Customer Portal verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 7 of 32 Public Version 1.2 GLEIF 2022-12-06_appendix-5-Qualified-vlei-issuer-service-level- 2022-12-06 agreement_v1.2_final.docx
10 calendar days 60 calendar days In case the Continuity process is invoked (ref. chapter 7) verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 8 of 32 Public Version 1.2 GLEIF 2022-12-06_appendix-5-Qualified-vlei-issuer-service-level- 2022-12-06 agreement_v1.2_final.docx
2.2 Annual vLEI Issuer Qualification
Annual vLEl Issuer Qualification
GLEIF’s process of re-verification of the qualified vLEI Issuer’s
compliance with expected internal controls and standards within
its vLEI operations
Annual vLEl Issuer Qualification is GLEIF’s process of regular
verification of the Qualified vLEI Issuer’s compliance with its
expected requirements within its vLEl operations.
GLEIF reviews information submitted by the Qualified vLEl Issuer,
considers the performances scored during the last operational
period, assesses the information against vLEl Ecosystem
Governance Framework and the Qualified vLEI Issuer
Qualification Agreement requirements and determines whether
any remedial action is required in order to maintain status as a
Qualified vLEl Issuer.
The Annual vLEl Issuer Qualification is performed on or after the
anniversary date of the qualified vLEI Issuer’s date of
qualification, based on the vLEI Issuer Qualification Agreement execution date.
GLEIF maintains the Qualified vLEl Issuer vLEI Credentials as well
as renews the TrustMarks of Qualified vLEI Issuers successfully
completing Annual vLEI Issuer Qualification.
e Qualified vLEI Issuers
e Provide qualified vLEI Issuer annual qualification guestionnaire and other review materials
¢ Review qualified vLEI Issuer submission within 45 calendar days of receipt of a complete set of materials.
o Confirm adequate levels of compliance with expected controls exist and/or document required remediation activities
o Ensure that any remediation activities are completed in a timely and complete manner
¢ Maintain on GLEIF website the most up to date list of all qualified vLEI Issuers
¢ Download the designated annual qualification materials from the Communications portal
verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 9 of 32 Public Version 1.2
GLEIF 2022-12-06_appendix-5-Qualified-vlei-issuer-service-level- 2022-12-06 agreement_v1.2_final.docx
¢ Provide completed annual qualification questionnaire (self- assessment) noting all changes to its internal controls within its vLEI operations ¢ Provide supporting documentation for any process changes noted ¢ Provide all required materials within 45 calendar days of GLEIF request to initiate the annual qualification o Review GLEIF evaluation results with GLEIF o Complete any required remediation actions based upon a mutually agreed schedule 97,7 % (Monday — Sunday 00:00 — 24:00) for Customer Portal Yearly On or within 3 months from the anniversary date of the qualified VLEI Issuer’s date of qualification, based on the vLEl Issuer Qualification Agreement execution date. The scope of the Annual VLEI Issuer Qualification will always be the last 12 months form the anniversary date In case the Continuity process is invoked (ref. chapter 7) verifiable LEI (vLEI) Ecosystem Governance Framework v1.0 Page 10 of 32 Public Version 1.2 GLEIF 2022-12-06_appendix-5-Qualified-vlei-issuer-service-level- 2022-12-06 agreement_v1.2_final.docx