Loading vLEI.wiki
Fetching knowledge base...
Fetching knowledge base...
This comprehensive explanation has been generated from 73 GitHub source documents. All source documents are searchable here.
Last updated: October 7, 2025
This content is meant to be consumed by AI agents via MCP. Click here to get the MCP configuration.
Note: In rare cases it may contain LLM hallucinations.
For authoritative documentation, please consult the official GLEIF vLEI trainings and the ToIP Glossary.
The vLEI Ecosystem Governance Framework is the comprehensive set of authoritative policy documents published by GLEIF that establishes information trust policies, technical requirements, credential frameworks, and operational procedures governing the Legal Entity (vLEI) ecosystem built on infrastructure.
The vLEI Ecosystem Governance Framework is defined in the official GLEIF documentation as a governance framework document that serves as the authoritative policy specification for the Verifiable LEI (vLEI) ecosystem. It defines comprehensive Information Trust Policies covering:
These policies apply universally to all vLEI Ecosystem Members, establishing a consistent governance model across the entire ecosystem.
The framework is governed by GLEIF (Global Legal Entity Identifier Foundation) and was first published as part of the draft vLEI Ecosystem Governance Framework Glossary in February 2022. The current version is v3.0, with the primary document finalized on August 30, 2023, and component frameworks updated through April 2025.
The vLEI Ecosystem Governance Framework operates as a Layer Four Ecosystem Governance Framework within the Trust over IP Foundation (ToIP) architecture. GLEIF serves dual roles as both Governing Authority and Administering Authority, consolidating governance control while maintaining the public-private partnership model that has characterized the Global LEI System since its inception following the 2008 financial crisis.
The framework establishes a hierarchical trust structure centered around GLEIF as the root authority:
GLEIF, with LEI 506700GE1G29325QX363, exercises the highest duty of care in generating and administering all AIDs within the ecosystem, recognizing these identifiers as the security foundation. The framework mandates that GLEIF must:
The framework defines multiple stakeholder categories:
Primary Stakeholders:
Representative Roles:
The vLEI Ecosystem Governance Framework v3.0 consists of multiple interconnected documents that together establish comprehensive governance:
The vLEI Ecosystem Governance Framework v3.0 Primary Document (v1.1, August 30, 2023) establishes:
The vLEI Ecosystem Information Trust Policies (v1.2, April 16, 2025) establish baseline requirements for:
Regulatory Compliance: All stakeholders MUST comply with governmental regulations including:
Privacy Policies: Requirements for protecting personal data of credential holders, with minimum compliance to Swiss Federal Data Protection Act where local legislation does not exist.
Security Policies: Mandatory IT security policies including:
Availability Targets: Defined service level requirements for credential issuance and verification infrastructure.
Developer Security: Software update and implementation procedures to maintain security posture.
The Technical Requirements Part 1: KERI Infrastructure (v1.3, April 16, 2025) establishes:
KERI Specification Management:
Backer Management:
Key Management Infrastructure:
GLEIF-Specific Infrastructure:
The framework includes separate governance documents for each credential type:
Qualified vLEI Issuer vLEI Credential Framework: Governs credentials issued by GLEIF to QVIs, enabling them to issue downstream credentials.
Legal Entity vLEI Credential Framework (v1.4, April 16, 2025): Governs credentials issued by QVIs to Legal Entities, establishing organizational digital identity.
Legal Entity Official Organizational Role vLEI Credential Framework (v1.4, April 16, 2025): Governs credentials for individuals in official organizational positions (CEO, CFO, Board Members, etc.).
Legal Entity Engagement Context Role vLEI Credential Framework (v1.4, April 16, 2025): Governs credentials for individuals in functional or engagement-specific roles.
Qualified vLEI Issuer Authorization vLEI Credential Framework (v1.3, April 16, 2025): Governs authorization credentials that enable LARs to instruct QVIs to issue or revoke role credentials.
Glossary (v1.3, December 15, 2023): Authoritative definitions for all First Letter Capitalized terms used throughout the framework.
Risk Assessment (v1.2, December 15, 2023): Comprehensive risk analysis using 5x5 risk matrix across Ecosystem, Credential, and Utility layers.
Trust Assurance Framework (v1.5, April 16, 2025): Compliance matrix mapping governance requirements across vLEI EGF, ISO 20000 Certification, vLEI Issuer Qualification Program, and vLEI Software specifications.
GLEIF Identifier Governance Framework (v1.0, December 16, 2022): Specific governance for GLEIF's Root AID and delegated AIDs (GIDA and GEDA).
As the Governing and Administering Authority, GLEIF's responsibilities include:
Root of Trust Management:
QVI Qualification and Management:
Framework Governance:
Ecosystem Oversight:
Qualified vLEI Issuers have specific obligations under the framework:
Credential Issuance:
Identity Verification:
Operational Requirements:
Compliance:
Legal Entities holding vLEI credentials must:
Credential Management:
Representative Authorization:
Privacy and Security:
OOR Persons and ECR Persons must:
Credential Custody:
Identity Verification:
Compliance:
The vLEI Ecosystem Governance Framework is fundamentally built on KERI (Key Event Receipt Infrastructure) technology, representing a significant architectural shift from traditional PKI-based systems to self-sovereign identity infrastructure.
Autonomic Identifiers (AIDs):
Key Event Logs (KELs):
Pre-rotation Mechanism:
All vLEI credentials are implemented as ACDCs (Authentic Chained Data Containers):
Standard ACDC Fields:
Graduated Disclosure:
Credential Chaining:
The framework implements sophisticated multi-signature requirements:
QVI Multi-sig:
Legal Entity Multi-sig:
GLEIF Root Multi-sig:
Witness Requirements:
Watcher Networks:
The framework establishes rigorous identity verification requirements aligned with international standards:
NIST 800-63A IAL2 Compliance:
Alternative Digital Identity Credentials:
OOBI Session Requirements:
Challenge-Response Protocol:
Legal Entity Verification:
DAR Verification:
LAR Verification:
OOR/ECR Person Verification:
The framework defines multiple issuance pathways:
QVI Credential Issuance (GLEIF to QVI):
Legal Entity Credential Issuance (QVI to Legal Entity):
OOR Credential Issuance (Two Pathways):
QVI-Mediated Path:
Direct Legal Entity Path:
ECR Credential Issuance (Similar dual pathway):
Verifiers must follow standardized procedures:
Credential Presentation:
Cryptographic Verification:
Status Verification:
Authorization Verification:
Credentials must be revoked under specific conditions:
QVI Credential Revocation:
Legal Entity Credential Revocation:
Role Credential Revocation:
Grace Periods:
The vLEI Ecosystem Governance Framework references and integrates with multiple external standards and specifications:
Core KERI Specification:
ACDC Specification:
CESR Specification:
IPEX Specification:
ISO 17442: Legal Entity Identifier (LEI) standard
ISO 20275: Entity Legal Forms code list
ISO 5009: Official Organizational Roles code list
ISO 20000: IT Service Management certification
ISO/IEC 27001: Information Security Management
NIST 800-63A: Digital Identity Guidelines - Identity Assurance
EU GDPR: General Data Protection Regulation
Swiss Federal Data Protection Act: Minimum data protection standard
eIDAS: European electronic identification and trust services regulation
vLEI Issuer Qualification Agreement: Contract between GLEIF and QVIs
vLEI Issuer Qualification Program Manual: Detailed qualification procedures
vLEI Issuer Qualification Program Checklist: Application requirements
Service Level Agreements: Availability and performance requirements
Non-Disclosure Agreements: Confidentiality requirements
Trustmark Usage Terms: Branding and marketing guidelines
All vLEI credential schemas are published in the official schema registry:
Repository: https://github.com/GLEIF-IT/vLEI-schema
Schemas:
Each schema includes:
The framework establishes clear compliance requirements and enforcement mechanisms:
Annual Qualification Reviews:
Incident Reporting:
Audit Requirements:
Remediation Requirements:
Credential Revocation:
Qualification Termination:
Contractual Obligations:
Liability and Disclaimers:
Dispute Resolution:
The framework includes provisions for evolution and updates:
Semantic Versioning:
Transition Periods:
Document DIDs:
Schema Versioning:
Schema Registry Management:
Framework Revisions:
Policy Clarifications:
The vLEI Ecosystem Governance Framework represents a comprehensive, technically sophisticated governance model that successfully bridges traditional organizational identity systems (LEI) with cutting-edge decentralized identity infrastructure (KERI/ACDC). By establishing clear roles, responsibilities, technical requirements, and compliance mechanisms, the framework enables a global, interoperable ecosystem for verifiable organizational identity that maintains the highest standards of security, privacy, and trust.
Root AID Management: GLEIF must maintain the highest security standards for the Root AID, including multi-signature controls with minimum 3 GARs, secure key generation with 128-bit cryptographic strength, and comprehensive witness pool infrastructure.
QVI Qualification: Implement rigorous qualification processes including application review, ISO 20000 certification verification, annual re-qualification assessments, and incident investigation procedures.
Framework Maintenance: Regularly update governance documents, manage schema registry, provide implementation guidance, and coordinate ecosystem-wide migrations.
Qualification Preparation: Obtain ISO 20000 certification, establish comprehensive IT security policies, designate Information Security Manager, implement incident reporting procedures, and prepare for annual qualification reviews.
Technical Infrastructure: Deploy KERI infrastructure with minimum 5 witnesses, establish credential registries using TEL, implement multi-signature controls (minimum 3 QARs, 2-of-N threshold), and maintain high availability systems.
Identity Verification: Develop procedures for IAL2 identity assurance, implement supervised OOBI session capabilities, establish challenge-response authentication workflows, and verify LEI status in Global LEI System.
Operational Compliance: Maintain audit trails, conduct employee training, implement privacy policies, report incidents to GLEIF, and participate in annual qualification reviews.
Governance Structure: Designate DAR with appropriate authority, authorize LARs for credential management, implement multi-signature controls when multiple LARs exist, and establish internal policies for representative authorization.
Credential Management: Contract with qualified QVI, establish Legal Entity AID with appropriate security, create credential registry for role credentials, and manage credential lifecycle (issuance, updates, revocation).
Representative Authorization: Issue QVI AUTH vLEI Credentials to authorize role credential issuance, perform identity assurance for OOR and ECR persons, conduct supervised OOBI sessions, and maintain records of authorized representatives.
Privacy and Security: Implement privacy policies protecting credential holders, comply with applicable data protection legislation, protect private keys, and report suspected breaches.
Wallet Setup: Establish secure wallet infrastructure, protect private keys associated with AID, implement backup and recovery procedures, and maintain credential custody.
Identity Verification: Participate in identity assurance processes, provide required identity documentation, complete supervised OOBI sessions, and respond to challenge messages.
Credential Usage: Present credentials only when authorized, comply with usage disclaimers, report lost or compromised credentials, and maintain credential validity through periodic updates.
For QVIs: Prepare for annual qualification reviews, maintain comprehensive documentation, implement audit procedures, track and report incidents, and remediate identified issues within specified timeframes.
For Legal Entities: Monitor LEI status and maintain Active Entity Status, track authorized representatives, review and update privacy policies, and ensure multi-signature requirements are met.
For All Participants: Stay informed of framework updates, participate in ecosystem communications, implement new requirements within specified timeframes, and maintain compliance documentation.
Version Transitions: Plan for 18-month backward compatibility periods, implement new versions within 12-month windows, avoid breaking changes during transition periods, and coordinate with ecosystem participants.
Schema Updates: Monitor schema registry for new versions, assess impact of schema changes, implement migration procedures, and test compatibility with existing credentials.
Policy Changes: Review updated governance documents, assess impact on operations, implement required changes, and document compliance with new requirements.