A Qualified vLEI Issuer (QVI) is an organization that has been formally qualified by GLEIF through the vLEI Issuer Qualification Agreement to issue, verify, and revoke Legal Entity vLEI Credentials, Legal Entity Official Organizational Role (OOR) vLEI Credentials, and Legal Entity Engagement Context Role (ECR) vLEI Credentials within the vLEI ecosystem.
This hierarchical structure implements a delegated trust model where GLEIF maintains ultimate authority while distributing operational credential issuance to qualified organizations. The QVI serves as the essential bridge between GLEIF's root authority and the broader ecosystem of legal entities requiring verifiable digital identities.
Qualification requirements through the vLEI Issuer Qualification Program
Operational policies via the vLEI Issuer Qualification Agreement
Technical standards through KERI Infrastructure Technical Requirements
Service level agreements defining availability and performance targets
Annual re-qualification procedures to maintain QVI status
The governance framework ensures that QVIs maintain consistent standards globally while operating under their own business models and fee structures.
Related Governance Entities
GLEIF Authorized Representatives (GARs): Representatives of GLEIF authorized to perform identity verification requirements needed to issue QVI vLEI Credentials. GARs conduct the qualification process and ongoing oversight of QVIs.
QVI Authorized Representatives (QARs): Designated representatives of a QVI authorized to conduct QVI operations with GLEIF and interface with Legal Entities. QARs are the operational personnel who execute credential issuance workflows.
Legal Entity Authorized Representatives (LARs): Representatives of Legal Entities who interact with QVIs to request credential issuance and manage their organization's vLEI credentials.
Roles & Responsibilities
Primary Responsibilities
1. Credential Issuance Authority
QVIs are authorized to issue three distinct types of vLEI credentials:
Legal Entity vLEI Credentials: Core organizational identity credentials that bind a Legal Entity's LEI (Legal Entity Identifier) to a KERIAID (Autonomic Identifier). These credentials establish the foundational digital identity for organizations in the vLEI ecosystem.
Legal Entity Official Organizational Role (OOR) vLEI Credentials: Credentials issued to individuals holding formal positions within legal entities (e.g., CEO, CFO, Board Directors). These credentials verify that a person holds an official organizational role and is authorized to act on behalf of the legal entity in that capacity.
Legal Entity Engagement Context Role (ECR) vLEI Credentials: Credentials issued to individuals representing legal entities in functional or engagement-specific contexts rather than official organizational positions (e.g., project managers, consultants, engagement-specific representatives).
2. Identity Verification and Assurance
QVIs must perform rigorous identity verification procedures before issuing credentials:
Legal Entity Identity Verification: QARs must verify that the supplied LEI corresponds to the requesting legal entity and that the LEI has:
Registration Status of Issued, Pending Transfer, or Pending Archival
Individual Identity Assurance: For OOR and ECR credentials, QVIs must perform identity assurance to at least Identity Assurance Level 2 (IAL2) as defined in NIST 800-63A. This includes:
Manual verification of legal identity credentials during live video sessions
OOBI (Out-Of-Band Introduction) sessions with real-time audio/video presence
Verification of control over AIDs through signed messages
Alternative Identity Verification Pathways: The governance framework permits acceptance of digital identity credentials from approved schemes including:
European eIDAS schemes (High/Substantial Level of Assurance)
Asian schemes: Australia myGov, India Aadhaar, Singapore SingPass
Latin American schemes: Brazil e-CPF
3. Credential Verification Services
QVIs provide verification services to validate the authenticity and current status of vLEI credentials. This includes:
Cryptographic verification of ACDC (Authentic Chained Data Container) signatures
Chain of trust validation through KERI infrastructure
The individual holding an OOR or ECR credential no longer holds that role
Contractual obligations with the Legal Entity are terminated
The QVI fails annual re-qualification or has its qualification terminated by GLEIF
Revocation is implemented through Transaction Event Logs anchored to the QVI's KEL (Key Event Log), providing cryptographically verifiable revocation status.
Authority and Permissions
Delegated Authority from GLEIF
QVIs receive their authority through a cooperative delegation mechanism in KERI:
QVI Delegated AID Creation: The QVI creates a delegated AID with GLEIF's GEDA (GLEIF External Delegated AID) as the delegator
GLEIF Approval: GLEIF must cryptographically approve the delegation through an interaction event containing a seal of the QVI's inception event
Credential Issuance: GLEIF issues a QVI vLEI Credential to the QVI, authorizing credential issuance operations
This delegation structure ensures that:
QVIs cannot unilaterally assert authority
GLEIF maintains ultimate control through delegation approval
The delegation relationship is cryptographically verifiable
GLEIF can revoke QVI authority by revoking the QVI vLEI Credential
Multi-Signature Requirements
The governance framework mandates that QVI AIDs use multi-signature control with:
Minimum 3 QARs (QVI Authorized Representatives) recommended when possible
2-of-N signature threshold required for credential issuance operations
Separate key management for each QAR to prevent single points of failure
Witness pool configuration with minimum 5 witnesses using KAACE (KERI Agreement Algorithm for Control Establishment)
This multi-signature architecture provides:
Distributed control preventing unilateral actions
Compromise resilience through threshold signatures
Operational continuity if individual QARs become unavailable
Commercial Autonomy
QVIs retain significant commercial autonomy:
Fee Structure Discretion: QVIs may charge fees for:
Ancillary Services: QVIs may offer additional services to Legal Entities regarding vLEIs, expanding their service offerings beyond core credential management.
Financial Independence: QVIs must be solely responsible for managing both revenue generation and operational costs. GLEIF does not contribute funds to QVI operations, ensuring QVIs operate as independent business entities.
Annual Fee Review: QVIs retain the right to review and unilaterally determine new fees annually, providing pricing flexibility.
Limitations
Qualification Requirements
QVIs face strict qualification constraints:
Organizational Structure: Sole proprietorships and natural persons cannot become QVIs. Only legal entities with appropriate organizational structure and accountability mechanisms qualify.
LEI Requirements: Both the candidate QVI and relevant parent organizations must maintain:
Active LEI Entity Status
LEI Registration Status of Issued, Pending Transfer, or Pending Archival
Qualification Timeline: Candidates must complete the vLEI Issuer Qualification Program Checklist and submit required documentation within 60 calendar days of NDA submission.
Operational Constraints
Software Requirements: QVIs must use the vLEI software for hosting Witnesses, Watchers, Discovery, and Oracles, and for key management. This ensures consistent technical implementation across the ecosystem.
Service Level Obligations: QVIs must meet defined availability targets documented in the Qualified vLEI Issuer Service Level Agreement (Appendix 5 to the vLEI Issuer Qualification Agreement).
Requirement to manage existing credential lifecycle (revocations)
Scope Limitations
Geographic Neutrality: While QVIs can operate globally, they must comply with applicable data protection legislation in their jurisdiction (or Swiss Federal Data Protection Act as minimum standard).
Credential Type Restrictions: QVIs can only issue the three authorized credential types (Legal Entity, OOR, ECR). They cannot create custom credential types without governance framework amendments.
No Unilateral Delegation: QVIs cannot delegate their authority to sub-issuers. The delegation chain stops at the QVI level for credential issuance authority.
Credential Lifecycle
QVI vLEI Credential Issuance Process
Phase 1: Qualification Application
Initial Contact: Candidate QVI sends email to [email protected] with signed Non-Disclosure Agreement
Portal Access: GLEIF grants access to communications portal for document submission
Checklist Completion: Candidate completes vLEI Issuer Qualification Program Checklist within 60 days
Documentation Submission: Candidate provides evidence of compliance with qualification requirements
Phase 2: GLEIF Review and Approval
Qualification Review: GLEIF reviews submitted documentation against qualification criteria
Remediation: If deficiencies exist, candidate must remediate within specified timeframes
Qualification Decision: GLEIF approves or denies qualification
Agreement Execution: Approved candidates execute the vLEI Issuer Qualification Agreement
Phase 3: Technical Setup
Multi-Sig AID Creation: QVI creates multi-signature AID with minimum 2 QARs
Delegation Request: QVI requests delegation from GLEIF GEDA
Identity Verification: GARs perform NIST IAL2 identity verification of QARs
Compliance matrix mapping requirements to implementations
Audit procedures and evidence requirements
Certification and attestation requirements
Continuous monitoring frameworks
Supporting Documents
Non-Disclosure Agreement (Appendix 1): Protects confidential information exchanged during qualification process
vLEI Ecosystem Governance Framework Glossary: Provides canonical definitions for all First Letter Capitalized terms used throughout governance documents
vLEI Q&A Document: Addresses common questions about vLEI ecosystem, QVI role, and operational procedures
These governance documents collectively establish a comprehensive framework ensuring QVIs operate consistently, securely, and in alignment with GLEIF's vision for a global, interoperable organizational digital identity ecosystem.
IPEX Delivery: Transmit credential using Issuance and Presentation Exchange protocol
Authorization-Based Role Credentials
For OOR/ECR credentials, implement two-phase workflow:
Phase 1 - Authorization:
Legal Entity (via LARs) creates QVI OOR AUTH or QVI ECR AUTH credential
Authorization specifies QVI AID, individual AID, legal name, and role
LARs sign with Legal Entity multi-sig threshold
Authorization transmitted to QVI
Phase 2 - Issuance:
QVI verifies authorization credential validity and chain to Legal Entity credential
QVI performs IAL2 identity verification of individual
QVI creates role credential with SAID reference to authorization credential
Role credential delivered to individual via IPEX
Revocation Management
Implement revocation procedures:
TEL Updates: Record revocation events in QVI's TEL anchored to KEL
Grace Period: Allow 90-day grace period for contractual terminations
Cascade Revocation: When QVI credential is revoked, all downstream credentials must be revoked
Status Queries: Provide TEL query endpoints for verifiers to check credential status
Annual Re-Qualification
QVIs must complete annual re-qualification:
Documentation Review: Submit updated evidence of continued compliance
Audit Procedures: Participate in GLEIF audit processes
Remediation: Address any identified deficiencies within specified timeframes
Credential Renewal: Receive renewed QVI vLEI Credential upon successful re-qualification