The vLEI Ecosystem Governance Framework is the comprehensive set of authoritative policy documents published by GLEIF that establishes information trust policies, technical requirements, credential frameworks, and operational procedures governing the verifiable Legal Entity Identifier (vLEI) ecosystem built on KERIprotocol infrastructure.
Related Concepts
No related concepts available
Comprehensive Explanation
vlei-ecosystem-governance-framework
Official Definition
The vLEI Ecosystem Governance Framework is defined in the official GLEIF documentation as a governance framework document that serves as the authoritative policy specification for the Verifiable LEI (vLEI) ecosystem. It defines comprehensive Information Trust Policies covering:
Information security requirements and standards
Privacy protections and compliance
Availability guarantees for vLEI services
Confidentiality protocols for sensitive data
Processing integrity policies for data handling
These policies apply universally to all vLEI Ecosystem Members, establishing a consistent governance model across the entire ecosystem.
Canonical Definition Source
The framework is governed by GLEIF (Global Legal Entity Identifier Foundation) and was first published as part of the draft vLEI Ecosystem Governance Framework Glossary in February 2022. The current version is v3.0, with the primary document finalized on August 30, 2023, and component frameworks updated through April 2025.
Official Abbreviations
vLEI EGF: verifiable LEI Ecosystem Governance Framework
EGF: Ecosystem Governance Framework (when context is clear)
Governance Context
Implementation Notes
Governance Implementation Considerations
For GLEIF
Root AID Management: GLEIF must maintain the highest security standards for the Root AID, including multi-signature controls with minimum 3 GARs, secure key generation with 128-bit cryptographic strength, and comprehensive witness pool infrastructure.
QVI Qualification: Implement rigorous qualification processes including application review, ISO 20000 certification verification, annual re-qualification assessments, and incident investigation procedures.
Framework Maintenance: Regularly update governance documents, manage schema registry, provide implementation guidance, and coordinate ecosystem-wide migrations.
For Qualified vLEI Issuers
Qualification Preparation: Obtain ISO 20000 certification, establish comprehensive IT security policies, designate Information Security Manager, implement incident reporting procedures, and prepare for annual qualification reviews.
Technical Infrastructure: Deploy KERI infrastructure with minimum 5 witnesses, establish credential registries using TEL, implement multi-signature controls (minimum 3 QARs, 2-of-N threshold), and maintain high availability systems.
Identity Verification: Develop procedures for IAL2 identity assurance, implement supervised OOBI session capabilities, establish challenge-response authentication workflows, and verify LEI status in Global LEI System.
Operational Compliance: Maintain audit trails, conduct employee training, implement privacy policies, report incidents to GLEIF, and participate in annual qualification reviews.
For Legal Entities
Governance Structure: Designate DAR with appropriate authority, authorize LARs for credential management, implement multi-signature controls when multiple LARs exist, and establish internal policies for representative authorization.
Credential Management: Contract with qualified QVI, establish Legal Entity AID with appropriate security, create credential registry for role credentials, and manage credential lifecycle (issuance, updates, revocation).
Representative Authorization: Issue QVI AUTH vLEI Credentials to authorize role credential issuance, perform identity assurance for OOR and ECR persons, conduct supervised OOBI sessions, and maintain records of authorized representatives.
Privacy and Security: Implement privacy policies protecting credential holders, comply with applicable data protection legislation, protect private keys, and report suspected breaches.
Position in vLEI Ecosystem
The vLEI Ecosystem Governance Framework operates as a Layer Four Ecosystem Governance Framework within the Trust over IP Foundation (ToIP) architecture. GLEIF serves dual roles as both Governing Authority and Administering Authority, consolidating governance control while maintaining the public-private partnership model that has characterized the Global LEI System since its inception following the 2008 financial crisis.
The framework establishes a hierarchical trust structure centered around GLEIF as the root authority:
GLEIF Root of Trust: GLEIF occupies the apex position with the GLEIF Root AID serving as the cryptographic anchor
Delegated GLEIF AIDs: Two primary delegated identifiers extend GLEIF's authority:
GIDA (GLEIF Internal Delegated AID): For internal GLEIF operations
GEDA (GLEIF External Delegated AID): For external ecosystem interactions, particularly with QVIs
Qualified vLEI Issuers (QVIs): Intermediate trust anchors that have undergone formal qualification
Role Holders: Individuals receiving OOR or ECR credentials
GLEIF's Governance Role
GLEIF, with LEI506700GE1G29325QX363, exercises the highest duty of care in generating and administering all AIDs within the ecosystem, recognizing these identifiers as the security foundation. The framework mandates that GLEIF must:
Maintain the GLEIF Root AID as the cryptographic root of trust
The vLEI Ecosystem Governance Framework v3.0 consists of multiple interconnected documents that together establish comprehensive governance:
Primary Framework Document
The vLEI Ecosystem Governance Framework v3.0 Primary Document (v1.1, August 30, 2023) establishes:
Stakeholder ecosystem definitions and roles
Trust chain architecture from GLEIF through QVIs to end entities
Localization policies (American English as official language, G20 translations required)
Core principles applicable across all component frameworks
Governance structure and authority delegation
Information Trust Policies
The vLEI Ecosystem Information Trust Policies (v1.2, April 16, 2025) establish baseline requirements for:
Regulatory Compliance: All stakeholders MUST comply with governmental regulations including:
EU GDPR (General Data Protection Regulation)
ISO/IEC 27001 Information Security Management standards
Local data protection legislation in applicable jurisdictions
Privacy Policies: Requirements for protecting personal data of credential holders, with minimum compliance to Swiss Federal Data Protection Act where local legislation does not exist.
Security Policies: Mandatory IT security policies including:
Annual review and maintenance requirements
Designation of Information Security Manager
Formal governance and revision management
Employee training and compliance
Incident reporting and management procedures
Availability Targets: Defined service level requirements for credential issuance and verification infrastructure.
Developer Security: Software update and implementation procedures to maintain security posture.
Technical Requirements
The Technical Requirements Part 1: KERI Infrastructure (v1.3, April 16, 2025) establishes:
KERI Specification Management:
18-month backward compatibility requirement for previous versions
12-month implementation window for new versions
Breaking change restrictions during transition periods
Backer Management:
Witness Pool Configuration: Minimum 5 witnesses using KAACE sufficient majority threshold
Discovery Mechanisms: Publication via well-known URIs, search engines, KERI DHT, and DID resolvers
Ledger Registrar Requirements: GLEIF-approved DID methods with appropriate security guarantees
Key Management Infrastructure:
Cryptographic Strength: Approximately 128 bits for key generation and storage
AID Requirements: Both issuer and issuee AIDs must be transferable
Pre-rotation Security: Highest level protection for next/pre-rotated keys
Multi-sig Requirements: At least 3 signers with threshold of 2 for QVIs
GLEIF-Specific Infrastructure:
Root AID Requirements: Minimum 3 notaries as witnesses with documented social media publication
Witness Network: GLEIF must maintain its own witness pool with redundancy
Delegation Structure: Formal delegation from Root AID to GEDA to QVI AIDs
Credential Frameworks
The framework includes separate governance documents for each credential type:
Revoke credentials when role changes or terminates
Identity Verification:
Participate in identity assurance processes
Provide required identity documentation
Complete supervised OOBI sessions
Respond to challenge messages during authentication
Compliance:
Use credentials only for authorized purposes
Comply with usage disclaimers and terms
Report lost or compromised credentials
Maintain credential validity through periodic updates
Technical Foundation
KERI Protocol Integration
The vLEI Ecosystem Governance Framework is fundamentally built on KERI (Key Event Receipt Infrastructure) technology, representing a significant architectural shift from traditional PKI-based systems to self-sovereign identity infrastructure.
Implementation guidance for ecosystem participants
Training and support during transitions
Policy Clarifications:
Interpretive guidance for ambiguous requirements
Best practice recommendations
Lessons learned from operational experience
Community feedback integration
The vLEI Ecosystem Governance Framework represents a comprehensive, technically sophisticated governance model that successfully bridges traditional organizational identity systems (LEI) with cutting-edge decentralized identity infrastructure (KERI/ACDC). By establishing clear roles, responsibilities, technical requirements, and compliance mechanisms, the framework enables a global, interoperable ecosystem for verifiable organizational identity that maintains the highest standards of security, privacy, and trust.
For Individual Credential Holders
Wallet Setup: Establish secure wallet infrastructure, protect private keys associated with AID, implement backup and recovery procedures, and maintain credential custody.
Identity Verification: Participate in identity assurance processes, provide required identity documentation, complete supervised OOBI sessions, and respond to challenge messages.
Credential Usage: Present credentials only when authorized, comply with usage disclaimers, report lost or compromised credentials, and maintain credential validity through periodic updates.
Compliance Monitoring
For QVIs: Prepare for annual qualification reviews, maintain comprehensive documentation, implement audit procedures, track and report incidents, and remediate identified issues within specified timeframes.
For Legal Entities: Monitor LEI status and maintain Active Entity Status, track authorized representatives, review and update privacy policies, and ensure multi-signature requirements are met.
For All Participants: Stay informed of framework updates, participate in ecosystem communications, implement new requirements within specified timeframes, and maintain compliance documentation.
Migration and Updates
Version Transitions: Plan for 18-month backward compatibility periods, implement new versions within 12-month windows, avoid breaking changes during transition periods, and coordinate with ecosystem participants.
Schema Updates: Monitor schema registry for new versions, assess impact of schema changes, implement migration procedures, and test compatibility with existing credentials.
Policy Changes: Review updated governance documents, assess impact on operations, implement required changes, and document compliance with new requirements.