The credential does not describe the company. It reproduces how the company decides.
Earlier this month the body that governs the LEI system explained, in its own words, how a verifiable LEI is actually held. One sentence is worth reading twice:
“the credential sits in a multi-signature group held by the entity's Legal Authorized Representatives, with a signing threshold of at least two. Authority in the credential matches authority in the organization.” — GLEIF, 4 September 2026
We did not author that standard and we claim no credit for it. That is exactly why it is worth citing. A standard described by the body that governs it is evidence. The same sentence in a vendor's deck is a claim.
Here is why the sentence carries more than it looks.
Most digital identity work answers one question well: which key signed this? It answers a second question quietly, by assumption: and therefore which organisation authorised it? Those are not the same question, and the gap between them is exactly where liability lives. Attestation is not attribution. A signature proves control of a key at a moment. It does not, on its own, prove that anyone with authority inside a legal entity decided anything.
A single signing key papers over that gap. It says: whoever holds this is the company. No corporate law anywhere works that way. Companies have joint signature rights, dual control, board resolutions, delegated mandates with limits — an entire apparatus whose purpose is that no one person is the company. The commercial register records it. Counterparties rely on it. It is one of the oldest accountability mechanisms we have, and it long predates every technology in this conversation.
A multi-signature group of Legal Authorized Representatives, with a signing threshold of at least two, is that apparatus made machine-readable. It does not invent a governance model for the digital world. It reproduces the one the entity already has, so that a signature carries the weight a signature is supposed to carry: not “a key was used”, but “this entity, through people authorised to act for it, decided”.
The consequence for the party on the other side is the useful part. A relying party checking such a credential is not asked to trust an operator's assurance that a key belongs to a company. It can check that the credential chains to the entity's legal identifier, that the presenter holds a role the entity granted, and that the signing threshold was met. Identity becomes resolvable in advance, by the party relying on it, rather than reconstructed afterwards out of logs and email.
That is the shape of an accountable economy. Not more compliance work rebuilt on every platform, but a credential that carries the entity's own authority structure with it, verified once under a governed standard and consumed everywhere downstream.
LTIN is in the process of obtaining the GLEIF accreditation, and our interest in this argument is obvious. But the argument does not depend on us. It rests on a standard that exists, governed by a body that publishes its own rules, and it would hold if we never issued a single credential.
What we do not claim: nothing here describes a capability of ours rather than a property of the standard, and LTIN holds no accreditation, certification or mark from GLEIF today.
