Regulation Legal Entity Identifiers

Legal Entity Identifiers (LEI) use cases for Certificate Authorities and PKI Stakeholders

LEI Use Case Summary

Authorities in local jurisdictions drive financial regulation where LEIs are required (or proposed as a requirement). However there are growing numbers of non-regulatory (or yet to be regulated) use cases where the LEI can add significant value as the central, verifiable and pervasive live corporate identifier in online transactions.

LEIs in SSL/TLS Certificates

Certificate Authorities are ideally placed to incorporate the LEI, a persistent unique key to verifiable level 1 ‘who is who’ business data and level 2 ‘who owns who’ parental structures. Updated at least annually LEIs will always offer a improved alternative over any static multi-year certificate, business card or even company letter head.

Users relying on company identity data for any online use case need several things. They need it to be:

Live and accurate – representative of the company at the time of relying it

Regulated and consistent – there should be a credible standardized validation workflow of identity data

Transparent – published to a publicly accessible and verifiable open database

User friendly – Doing Business As should be supported where complicated group holding names would otherwise confuse users (KLM vs Koninklijke Luchtvaart Maatschappij N.V.)

Detailed when needed – as well as providing the ‘who is who’ aspect of company identity, when needed give insight into ‘who owns whom’ for corporate structure understanding

Challengeable – if inaccuracy is suspected, there should be a protocol to challenge

The Legal Entity Identifier (LEI) ecosystem was designed to meet all these requirements. Browsers are equally ideally placed to display LEIs to their stakeholders of businesses and consumers alike, extracting them from the underlying X509 SSL/TLS certificate underpinning the encrypted communications channel.

LEIs in Digital / Electronic Signing

Digital and Electronic Signatures solutions allow organisations to streamline workflows and build legally permissible signatures into documents and transactions. Incorporating LEIs into document signing workflow allows verifiable linkage between the signer and the signer’s corporate entity.

LEIs in Browsers / URL replacement

The average internet user does not know a whole lot about web security or what to look for when visiting a website. Browsers are ideally placed to provide reliable identity data to online consumers however they only control the top of the window, none of the pixels below the so-called “line of death” can be trusted. Ideally, people could look at the domain itself and get a sense of website identity, but the reality is that browsers can’t rely on their users to discern a legitimate URL from a fake one. There is a growing momentum to replace the URL with something that is not only more user-friendly, but that also enhances security and provides authenticated website identity information.

Whereas the most common use case for LEIs today remains within financial reporting, the LEI has the potential to be a central single corporate identifier for a multitude of use cases, including support for this next generation of online identity assurance.