Comprehensive Explanation
vlei-credential
Official Definition
A vLEI credential (verifiable Legal Entity Identifier credential) is formally defined as a credential that:
- Concerns a verifiable Legal Entity Identifier
- Resides in the GLEIS (Global Legal Entity Identifier System)
- Must be compliant with one or more GLEIF governance frameworks
The vLEI represents the cryptographically secure digital counterpart of the traditional Legal Entity Identifier, providing organizations and their representatives with verifiable digital identities. According to GLEIF's official documentation, vLEI credentials are based on the Trust over IP Authentic Chained Data Container (ACDC) specification and utilize the KERI protocol as the underlying infrastructure.
Official Abbreviations:
- vLEI: verifiable Legal Entity Identifier
- LEI: Legal Entity Identifier
- GLEIF: Global Legal Entity Identifier Foundation
- GLEIS: Global Legal Entity Identifier System
- QVI: Qualified vLEI Issuer
- OOR: Official Organizational Role
- ECR: Engagement Context Role
Governance Context
vLEI Ecosystem Role
The vLEI credential system operates within a hierarchical trust architecture governed by GLEIF, the supra-national non-profit established by the G20 and Financial Stability Board. The ecosystem implements a four-tier structure:
Tier 1: GLEIF Root Authority
- GLEIF serves as the global root of trust
- Issues QVI credentials to qualified organizations
- Maintains the GLEIF Root AID and delegated AIDs (GEDA and GIDA)
- Oversees the entire vLEI ecosystem governance
Tier 2: Qualified vLEI Issuers (QVIs)
- Organizations qualified by GLEIF through formal qualification processes
- Authorized to issue Legal Entity vLEI credentials
- Operate under contractual obligations defined in the vLEI Issuer Qualification Agreement
- Must maintain compliance with GLEIF's governance framework policies
Tier 3: Legal Entities
- Organizations holding valid LEIs from the Global LEI System
- Receive Legal Entity vLEI credentials from QVIs
- Can issue authorization credentials to QVIs for role credential issuance
- Serve as the root credential for organizational role credentials
Tier 4: Role Holders
- Individuals holding Official Organizational Role (OOR) credentials
- Individuals holding Engagement Context Role (ECR) credentials
- Authorized representatives acting on behalf of Legal Entities
GLEIF Context
GLEIF operates as the Governing and Administering Authority for the vLEI ecosystem, consolidating governance control while maintaining the public-private partnership model that has characterized the Global LEI System since its inception following the 2008 financial crisis. The vLEI system extends GLEIF's traditional LEI infrastructure into the digital realm by combining:
- GLEIF's established governance: Leveraging the globally recognized LEI system with rigorous identity verification standards
- KERI's cryptographic security: Providing self-certifying, decentralized identifiers (AIDs) that don't require centralized registries
- ACDC's verifiable credentials: Enabling machine-verifiable identity attestations with automatic validation
The vLEI Ecosystem Governance Framework operates as a Layer Four Ecosystem Governance Framework within the Trust over IP Foundation (ToIP) architecture, establishing comprehensive policies for security, privacy, availability, confidentiality, and processing integrity across all vLEI ecosystem stakeholders.
The vLEI ecosystem involves several key governance entities:
GLEIF Authorized Representatives (GARs): Representatives of GLEIF authorized to perform identity verification requirements for issuing QVI credentials.
Designated Authorized Representatives (DARs): Representatives of Legal Entities authorized to:
- Authorize vLEI Issuer Qualification Program Checklists
- Execute vLEI Issuer Qualification Agreements
- Designate/replace Authorized vLEI Representatives (AVRs)
Legal Entity Authorized Representatives (LARs): Representatives authorized by Legal Entities to provide secure instructions to QVIs for credential issuance and revocation.
QVI Authorized Representatives (QARs): Representatives of QVIs authorized to conduct QVI operations with GLEIF and interface with Legal Entities.
Authorized vLEI Representatives (AVRs): Representatives authorized by DARs to request issuance and revocation of various vLEI credential types.
Roles & Responsibilities
Primary Responsibilities
vLEI credentials serve multiple critical functions within the organizational identity ecosystem:
1. Legal Entity Identity Verification
- Provide cryptographically verifiable proof of legal entity status
- Bind LEI identifiers to KERI AIDs
- Enable automated verification without human intervention
- Establish verifiable chains of authority for business transactions
2. Organizational Role Authentication
- Verify official roles within organizations (OOR credentials)
- Establish engagement context permissions (ECR credentials)
- Create verifiable chains of authority from legal entities to individuals
- Enable role-based access control with verifiable credentials
3. Authorization Delegation
- Enable Legal Entities to authorize QVIs for role credential issuance
- Implement cooperative delegation patterns
- Maintain cryptographic accountability throughout delegation chains
- Support hierarchical trust structures
4. Credential Lifecycle Management
- Track issuance and revocation states through Transaction Event Logs (TELs)
- Provide real-time verification of credential validity
- Enable grace periods for credential transitions
- Support credential renewal and replacement workflows
Authority and Permissions
The authority structure for vLEI credentials follows strict hierarchical patterns:
GLEIF Authority:
- Exclusive authority to issue QVI credentials
- Must delegate QVI AIDs as part of issuance process
- Maintains root of trust for entire ecosystem
- Oversees QVI qualification and annual re-qualification
QVI Authority:
- Authorized to issue Legal Entity vLEI credentials
- Can issue OOR and ECR credentials when authorized by Legal Entities
- Must maintain valid QVI credentials and LEI status
- Operates under contractual obligations to GLEIF
Legal Entity Authority:
- Can issue OOR Authorization and ECR Authorization credentials to QVIs
- Controls which individuals receive role credentials
- Maintains authority over organizational credential policies
- Can revoke authorization credentials
Individual Authority:
- OOR and ECR credential holders can present credentials to verifiers
- Cannot delegate or transfer credentials
- Must maintain control over their AIDs
- Subject to credential revocation by issuing entities
Limitations
vLEI credentials operate under several important constraints:
1. Governance Compliance
- All credentials must comply with applicable GLEIF governance frameworks
- Issuers must follow prescribed identity verification procedures
- Credential schemas are strictly defined and immutable
- Revocation procedures must follow governance requirements
2. Technical Constraints
- Credentials must be ACDCs conforming to specified JSON schemas
- All AIDs must be KERI Autonomic Identifiers
- Cryptographic operations must use approved algorithms (Ed25519, Blake3-256)
- Witness pools must meet minimum configuration requirements
3. Operational Limitations
- QVI credentials require active LEI status
- Role credentials require valid Legal Entity credentials in the chain
- Authorization credentials must precede role credential issuance
- Grace periods apply to credential transitions (default 90 days)
4. Privacy Considerations
- ECR credentials may contain personally identifiable information (PII)
- Graduated disclosure mechanisms must be supported
- Chain-link confidentiality applies to credential presentations
- Correlation risks must be managed through privacy-preserving mechanisms
Credential Lifecycle
Issuance Process
The vLEI credential issuance process varies by credential type but follows general patterns:
QVI Credential Issuance (by GLEIF):
- Organization applies for QVI qualification
- GLEIF performs qualification assessment
- GLEIF creates QVI Delegated AID through delegation ceremony
- GLEIF issues QVI credential with LEI and grace period
- QVI credential anchored to GLEIF's KEL
- Credential registered in Transaction Event Log (TEL)
Legal Entity Credential Issuance (by QVI):
- Legal Entity contracts with QVI for vLEI services
- QVI verifies LEI validity and entity status
- Legal Entity creates AID (typically multi-sig with LARs)
- QVI issues Legal Entity credential
- Credential chains to QVI credential via ACDC edges
- Credential registered in QVI's TEL
OOR/ECR Credential Issuance (by QVI with Legal Entity Authorization):
- Legal Entity issues OOR/ECR Authorization credential to QVI
- Authorization credential specifies individual and role
- Identity verification performed (IAL2 minimum, with OOBI session)
- Individual creates AID for credential receipt
- QVI issues OOR/ECR credential to individual
- Credential chains to authorization credential
- Credential registered in QVI's TEL
Key Issuance Requirements:
- Identity Assurance: Minimum NIST 800-63A IAL2 compliance
- Identity Authentication: OOBI protocol with real-time audio/video session
- AID Verification: Cryptographic challenge-response authentication
- Multi-signature: Recommended minimum 3 signers with 2-of-N threshold
- Schema Compliance: All credentials must conform to published JSON schemas
Verification Procedures
Verification of vLEI credentials involves multiple validation steps:
1. Cryptographic Verification
- Verify ACDC SAID (Self-Addressing Identifier) integrity
- Validate digital signatures on credential
- Verify issuer's AID and KEL
- Check witness receipts and threshold compliance
2. Schema Validation
- Verify credential conforms to specified schema SAID
- Validate all required fields present
- Check field value constraints and formats
- Verify schema version compatibility
3. Chain Verification
- Verify ACDC edge references to parent credentials
- Validate entire credential chain back to GLEIF root
- Check edge operator constraints (I2I, DI2I, NI2I)
- Verify delegation relationships
4. Status Verification
- Query Transaction Event Log (TEL) for credential status
- Verify credential not revoked
- Check issuer credential validity
- Verify LEI status for Legal Entity credentials
5. Business Logic Validation
- Verify credential type appropriate for use case
- Check role permissions match required authorization
- Validate credential attributes meet requirements
- Verify presentation context matches credential scope
Verification Tools:
- vlei-verifier: Service for cryptographic verification of vLEI credentials
- sally: vLEI Audit Reporting Agent for credential presentation verification
- KERIA: Cloud agent for AID and credential management
- SignifyTS/SignifyPy: Client libraries for credential operations
Revocation Conditions
vLEI credentials may be revoked under various conditions:
QVI Credential Revocation:
- QVI fails Annual vLEI Issuer Qualification
- QVI fails to remediate qualification issues
- QVI's LEI lapses or is retired
- QVI violates vLEI Issuer Qualification Agreement
- GLEIF terminates QVI relationship
Legal Entity Credential Revocation:
- Legal Entity's LEI becomes inactive
- Legal Entity requests credential revocation
- QVI determines credential issued in error
- Legal Entity fails to maintain compliance
OOR/ECR Credential Revocation:
- Individual no longer holds specified role
- Legal Entity revokes authorization
- Legal Entity credential is revoked (cascading revocation)
- Individual requests credential revocation
- Credential issued in error or fraudulently
Revocation Process:
- Authorized party initiates revocation request
- Revocation event created in TEL
- Revocation event anchored to issuer's KEL
- TEL state updated to reflect revocation
- Grace period may apply (default 90 days for QVI credentials)
- Verifiers can query TEL for current status
Ghost Credentials:
During the grace period, credentials exist in a "ghost" state where they remain technically valid but are pending revocation. This allows for managed transitions when QVI relationships are terminated.
Primary Governance Framework
vLEI Ecosystem Governance Framework v3.0
- Primary document establishing governance structure
- Defines stakeholder roles and responsibilities
- Establishes core policies and principles
- Available through GLEIF official channels
Credential-Specific Frameworks
Qualified vLEI Issuer vLEI Credential Governance Framework
- Requirements for QVI credential issuance by GLEIF
- QVI qualification procedures
- Annual re-qualification requirements
- Grace period management
Legal Entity vLEI Credential Governance Framework
- Requirements for Legal Entity credential issuance by QVIs
- Identity verification procedures for Legal Entities
- Multi-signature requirements
- AID management policies
Legal Entity Official Organizational Role vLEI Credential Governance Framework
- Requirements for OOR credential issuance
- Identity assurance and authentication procedures
- Authorization credential requirements
- Role verification standards
Legal Entity Engagement Context Role vLEI Credential Governance Framework
- Requirements for ECR credential issuance
- Functional role definitions
- Privacy protection requirements
- Engagement context specifications
Qualified vLEI Issuer Authorization vLEI Credential Governance Framework
- Requirements for OOR and ECR authorization credentials
- Legal Entity authorization procedures
- Multi-signature requirements for authorization
- Authorization lifecycle management
Technical Requirements Documents
vLEI Ecosystem Governance Framework Technical Requirements Part 1: KERI Infrastructure
- KERI specification compliance requirements
- Backer (witness/registrar) management policies
- Key management infrastructure requirements
- GLEIF-specific KERI implementation standards
vLEI Ecosystem Governance Framework Technical Requirements Part 2: vLEI Credentials
- ACDC implementation requirements
- Cryptographic algorithm specifications
- Schema compliance requirements
- Serialization format standards
vLEI Ecosystem Governance Framework Technical Requirements Part 3: vLEI Credential Schema Registry
- SAID-based schema identification
- JSON Schema compliance requirements
- Semantic versioning strategy
- Official schema registry
Supporting Documents
vLEI Ecosystem Governance Framework Glossary
- Canonical definitions of all terms
- Role definitions
- Technical terminology
- Governance concepts
vLEI Ecosystem Information Trust Policies
- Information security policies
- Privacy policies
- Availability policies
- Confidentiality policies
- Processing integrity policies
vLEI Ecosystem Risk Assessment
- Risk categories and evaluation
- Mitigation strategies
- Compliance requirements
- Security considerations
vLEI Ecosystem Trust Assurance Framework
- Compliance matrix
- ISO 20000 certification requirements
- vLEI Issuer Qualification Program standards
- Software specifications
Qualification and Operational Documents
vLEI Issuer Qualification Agreement
- Contractual obligations for QVIs
- Service level requirements
- Compliance requirements
- Termination conditions
vLEI Issuer Qualification Program Checklist
- Application requirements
- Qualification assessment criteria
- Documentation requirements
- Compliance verification procedures
Non-Disclosure Agreement (Appendix 1)
- Confidentiality requirements
- Information protection obligations
- Breach notification procedures
- Perpetual validity provisions
Schema Specifications
All vLEI credential schemas are published in the official vLEI schema repository with specific SAIDs:
- QVI Credential Schema:
EBfdlu8R27Fbx-ehrqwImnK-8Cm79sqbAQ4MmvEAYqao
- Legal Entity Credential Schema:
ENPXp1vQzRF6JwIuS-mp2U8Uf1MoADoP_GqQ62VsDZWY
- OOR Authorization Schema:
EKA57bKBKxr_kN7iN5i7lMUxpMG-s19dRcmov1iDxz-E
- ECR Authorization Schema:
EH6ekLjSr8V32WyFbGe1zXjTzFs9PkTYmupJ9H65O14g
- OOR Credential Schema:
EBNaNu-M9P5cgrnfl2Fvymy4E_jvxxyjb70PRtiANlJy
- ECR Credential Schema:
EEy9PkikFcANV1l7EHukCeXqrzT1hNZjGlUk7wuMO5jw
These schemas are immutable and versioned, with any changes requiring new schema SAIDs and version numbers following semantic versioning principles.
Implementation Considerations
While vLEI credentials are primarily governance constructs, implementers should understand:
Governance Compliance: All implementations must strictly adhere to GLEIF governance frameworks. Deviation from specified procedures, schemas, or policies may result in invalid credentials or ecosystem exclusion.
Multi-Party Coordination: vLEI credential workflows involve multiple parties (GLEIF, QVIs, Legal Entities, individuals) requiring careful coordination and clear communication channels.
Identity Verification: The IAL2 identity assurance requirements with OOBI sessions represent significant operational overhead but are mandatory for ecosystem participation.
Cryptographic Infrastructure: Proper KERI infrastructure (witnesses, agents, key management) is essential. The multi-signature requirements for organizational identifiers require careful key management and operational procedures.
Privacy Management: ECR credentials containing PII require additional privacy protections. Graduated disclosure mechanisms and chain-link confidentiality must be properly implemented.
Status Monitoring: Continuous monitoring of credential status through TELs is essential for verifiers. Cached credential status can lead to acceptance of revoked credentials.
Grace Period Management: The 90-day grace period for QVI credential transitions requires careful planning when changing QVI relationships or managing QVI qualification issues.