Legal Entity Identifier: Data Point Intelligence Guide

The LEI is the closest thing global finance has to a universal entity key, and unusually for identity data it is free, open and verified at source.

Understanding the Legal Entity Identifier as an intelligence artifact

A Legal Entity Identifier is a twenty-character alphanumeric code defined by ISO 17442 that uniquely identifies a legal entity participating in financial transactions. The structure is fixed: four characters identifying the issuing organisation, two reserved characters, twelve entity-specific characters and two check digits computed under ISO/IEC 7064 MOD 97-10. Each code is issued by an accredited Local Operating Unit after validating the entity against its home business registry, and the full reference data is published openly by GLEIF.

The record has two levels. Level 1 answers who the entity is: legal name, registered and headquarters addresses, home registry identifier, legal form, registration status and renewal date. Level 2 answers who owns whom, recording direct and ultimate accounting consolidating parents. Registration status matters analytically: lapsed codes indicate an entity that stopped renewing, and status values such as merged or retired carry specific corporate meaning.

Why it matters

The LEI solves the entity resolution problem that wrecks cross-border financial analysis. It maps a single entity across regulatory reporting regimes, trade repositories and registries without relying on name matching. Because issuance requires validation against a home registry, an LEI carries a verified link between a financial market participant and its legal registration. The parent relationship data provides an openly published, machine-readable view of corporate group structure that is otherwise expensive to assemble.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

Check-digit validity, which lets you reject malformed or invented codes instantly with no lookup required.
The four-character prefix identifying the issuing LOU, which indicates where the entity chose to register and often its operational base.
Registration status and next renewal date, where a lapsed code indicates an entity that stopped paying attention or stopped operating.
Direct and ultimate parent relationships, which reconstruct group structure across jurisdictions from a single authoritative source.
Reported exceptions where an entity declines to name a parent, which is itself a disclosure signal worth examining.
The linked home registry identifier, which provides a verified bridge from the LEI to national company registry records.
Divergence between legal address and headquarters address, which flags letterbox arrangements and cross-border structuring.
Entity legal form and status changes such as merger or dissolution, which date corporate events precisely in the reference data.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

GLEIF LEI Search — Authoritative free lookup for any LEI with full Level 1 reference data and relationship records
GLEIF Golden Copy files — Complete daily bulk downloads of all LEI records and relationships for offline analysis
GLEIF API — Programmatic access to entity records, parent and child relationships and registration history
ISO 17442 — The standard defining LEI structure, check-digit calculation and the reference data model
ESMA FIRDS — EU instrument reference data linking financial instruments to issuer LEIs
SEC EDGAR — US filings that increasingly carry LEIs, bridging the identifier to detailed disclosure documents
OpenCorporates — Cross-reference from the LEI's home registry identifier into wider company and officer data

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

Validate offline — Confirm the twenty-character structure and the MOD 97-10 check digits before querying anything, which eliminates typos and fabrications immediately.
Retrieve the Level 1 record — Pull legal name, addresses, legal form, status and the home registry identifier directly from GLEIF rather than a secondary aggregator.
Walk the ownership tree — Follow direct and ultimate parent relationships upward and child relationships downward to reconstruct the corporate group.
Bridge to the home registry — Use the published registry identifier to open the entity's national registry record, unlocking officers, filings and accounts.
Screen the whole group — Run every entity in the resolved structure against sanctions and enforcement lists, since exposure often sits at a parent or sibling.
Check reference data freshness — Compare last update and renewal dates against the events you are analysing, since lapsed records describe a past state.
Join to your own data — Use the LEI as the join key across counterparty, transaction and risk datasets to eliminate name-matching ambiguity permanently.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Collected by these disciplines

Financial Intelligence — Following Value Through the Financial System
Sanctions Intelligence — Screening, Designations, and Evasion Detection
Corporate Intelligence — Understanding Companies, Structure, and Control
Legal Intelligence — Law, Litigation, and Regulatory Intelligence

Investigated in these domains

Pivots to these data points

Company / Organization — A legal entity — corporation, LLC, NGO, or business.
Patent — An intellectual property filing granting invention rights.
Corporate Filing — A regulatory or corporate filing (SEC, Companies House, court).
Tax ID / VAT Number — A jurisdiction-issued tax registration number for a person or entity.

Inside the platform: where Legal Entity Identifier lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

datapoint.php?dp=dp_lei — Data point hub
sanctions.php — Anti-Money Laundering dashboard
search.php — Advanced search, filter and pivot
correlate.php — Correlation graph
cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

Enrichment Runner
Enrichment → Local
Correlate Infrastructure
Summarise (Copilot)
Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Validate offline is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
Building the picture. A single indicator is rarely the story. Walk the ownership tree turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
Producing something actionable. Analysis that ends in a document nobody can use is wasted. Join to your own data feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Legal Entity Identifier

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Defence procurement and supply chain assurance need to know which legal entity is actually behind a supplier and who consolidates it. The LEI provides that in an openly licensed, machine-readable form, with a verified link back to the entity's home business registry and published direct and ultimate parent relationships. That supports contracting decisions, ownership screening against adversary jurisdictions, and identification of group-level exposure where a subsidiary appears benign but the parent does not. Constraints are coverage: LEIs exist mainly for entities that participate in financial markets or are required to hold one by regulation, so absence of an LEI is normal for a small supplier and is not a finding in itself.

🕵 National intelligence

For national intelligence the LEI solves entity resolution across borders without name matching, which is the recurring technical obstacle in financial and corporate analysis. Requirements-driven use includes mapping group structures of entities of interest, joining regulatory reporting and trade repository data, and identifying which financial market participants sit under a parent in a jurisdiction of concern. Because GLEIF publishes the full reference data under an open licence with no reuse restriction, analysis can be conducted and disseminated without source protection concerns. The limitation to state in every assessment is that Level 2 parent data reflects accounting consolidation and self-reported relationships, not necessarily control in the sense an intelligence assessment means.

👮 Law enforcement

In law enforcement the LEI functions as a verified bridge between a financial market participant and its home registry record. Because issuance requires validation against that registry by an accredited Local Operating Unit, an LEI record carries an evidenced link that supports production orders directed at the right legal entity in the right jurisdiction. The registration status field is evidentially useful: lapsed, merged and retired all carry defined meanings with dates. For financial crime casework the parent relationship data identifies where to direct enquiries across a group. Retain the record version and retrieval date, since reference data is updated on renewal and a decision must remain explainable against the data available at the time.

🔍 Private investigation and corporate security

Corporate investigators use the LEI as the cheapest reliable entity resolution key available. It replaces fuzzy name matching in counterparty screening, links a trading name to a validated legal name and registered address, and exposes group structure through parent relationships. The data is openly licensed, so there are no redistribution constraints, which is unusual and valuable in commercial due diligence. Practical limits are coverage and freshness: many private companies have no LEI, and records describe the state at last renewal. Treat a lapsed LEI as a prompt to check the entity's status in its home registry rather than as evidence that the entity has ceased to exist.

📰 Journalism and OSINT media

For journalists the LEI is a verification shortcut that turns a company name into a validated legal identity with an address, a legal form, a home registry identifier and a published parent. That is a documentary basis for stating which entity in a group actually did something, which matters when a story concerns a multinational whose subsidiaries have similar names. The data is open, free and citable with no access barrier, which makes it ideal for reproducible reporting. Be careful with parent relationships: they reflect accounting consolidation as reported by the entity, so describe them accurately rather than as ownership percentages or as proof of operational control.

🌍 NGO, humanitarian and human rights

Accountability and anti-corruption work needs to connect a local operating company to the group that ultimately consolidates it, which is exactly what Level 2 LEI data provides in a form that is free, open and machine readable. That supports research on financial flows, concession holders and corporate responsibility without any licensing barrier, which matters for organisations without research budgets. Because records concern legal entities rather than individuals, personal data exposure is minimal, though sole trader and small entity records can identify natural persons. Combine LEI structure data with national registry records and financial filings, and state clearly where the parent chain terminates in an unreported relationship.

🎓 University and research

The Global LEI Index is one of the highest-quality open entity datasets available, with daily bulk Golden Copy files, a documented data model and validation against source registries. It supports research on financial networks, corporate group structure, regulatory reporting quality and entity resolution methodology. Reproducibility is straightforward because the Golden Copy files are versioned and dated: pin the file date in the methods section. Known limitations to report are selection into the dataset, since LEI holding is driven by regulatory requirement rather than by economic significance, and the reporting exceptions in Level 2 data that leave many parent relationships unreported for defined reasons.

Playbook: working Legal Entity Identifier end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Validate the code offline

Confirm the twenty-character structure, the character set and the ISO/IEC 7064 MOD 97-10 check digits locally before querying anything. This eliminates transcription errors and fabrications in a millisecond and without a network call, and it should be built into any system that accepts an LEI as input. A good output is a validation function applied at ingestion with rejected values logged. Stop and query the source of the data if a supposedly authoritative feed is supplying codes that fail their check digits, because that indicates an upstream data quality problem.

Phase 2 — Retrieve the Level 1 record

Pull the legal name, legal and headquarters addresses, legal form and jurisdiction, entity status, registration status and the home business registry identifier directly from GLEIF rather than from a secondary aggregator. The registry identifier is the field that unlocks everything else. A good output is a stored record with its last update date and next renewal date. Note the entity legal form code, since it determines what the home registry publishes and which filings exist.

Phase 3 — Read registration status carefully

Interpret the registration status field precisely, because ISSUED, LAPSED, MERGED, RETIRED, ANNULLED and DUPLICATE each carry a defined meaning with specific analytic consequences. Lapsed means renewal stopped, which may mean the entity ceased regulated activity, changed structure or simply neglected the fee. Merged and retired record corporate events with dates. A good output states the status, its date and what it does and does not imply, rather than treating any non-issued status as evidence that the entity no longer exists.

Phase 4 — Walk the Level 2 relationship tree

Follow direct and ultimate accounting consolidating parent relationships upward and child relationships downward to reconstruct the group as reported. Record the relationship type, the reported period and the validation source for each edge. Where a relationship is not reported, GLEIF records a defined exception reason such as no legal obligation to consolidate, and that reason is itself informative. A good output is a group tree in which reported edges and exception-flagged gaps are visually distinct rather than silently merged.

Phase 5 — Bridge to the home registry

Use the published home registry identifier to open the entity's national registry record, which unlocks officers, filings, accounts, charges and status history that the LEI record does not contain. This is the single highest-value pivot in the workflow, because it converts a verified financial identity into a full corporate research file. A good output is a linked registry record with its own retrieval date. Where the registry identifier is absent or the registry is not publicly searchable, record that limitation explicitly.

Phase 6 — Screen the resolved group

Run every entity in the reconstructed structure against sanctions, enforcement, debarment and PEP sources, because exposure frequently sits at a parent or a sibling rather than at the counterparty in front of you and ownership thresholds make indirect holdings decisive. A good output is a screening record covering the whole tree with list versions and dates. Route hits to compliance and counsel immediately. Note that the LEI tree reflects accounting consolidation, so it may not capture control relationships that sanctions rules care about.

Phase 7 — Cross-check against other identifier systems

Bind the LEI to the entity's tax registration, stock ticker, national registry number, MIC or BIC where relevant, and any sector licence numbers, producing an identifier table that lets financial, trade and regulatory data be joined deterministically. A good output is a validated identifier set with the source and check status for each entry. Where two systems disagree about the entity's legal name or address, record the divergence rather than picking one, because the disagreement is often the interesting part.

Phase 8 — Assess reference data freshness

Compare the last update and next renewal dates against the period you are analysing, since reference data describes the state at last validation and a lapsed record describes a past state. For any decision that will be reviewed later, capture the record as it stood at decision time. A good output is a decision file containing the version of the reference data relied upon. This is what makes a historical decision explainable when the current record no longer matches it.

Phase 9 — Use bulk Golden Copy for scale

For portfolio-level work, download the daily Golden Copy files rather than querying the API entity by entity, which gives complete, consistent, dated snapshots suitable for reproducible analysis. Retain the file date. A good output is a versioned local dataset with a documented ingestion date and record count. Reconcile record counts between snapshots to detect ingestion failures, because a partially loaded file produces a silently incomplete group structure that looks perfectly normal.

Phase 10 — Join to your own counterparty data

Use the LEI as the primary join key across counterparty master data, transaction records, exposure calculations and risk systems, eliminating name-matching ambiguity permanently. Backfill historical records where possible, and require an LEI at onboarding for any counterparty that has one. A good output is a counterparty master where the proportion of records keyed by LEI is measured and rising. This is a data governance change more than an analytic one, and it pays back on every subsequent investigation.

Phase 11 — Handle the coverage gap explicitly

Where a counterparty has no LEI, record that as a known state rather than a failure, and resolve the entity through the national registry instead. LEI holding is driven by regulatory requirement, so absence is normal for small and non-financial entities and says nothing about legitimacy. A good output is a coverage statistic for your portfolio and a documented fallback resolution path. Stop treating LEI absence as a risk flag, because it produces noise that obscures genuine findings.

Phase 12 — Document and cite reproducibly

Cite the LEI itself rather than the entity name in every product, since the code is unambiguous, permanent and freely verifiable by any reader. Record the reference data version, the retrieval date and any relationship exceptions relied upon. A good output is an analysis another party can reproduce exactly from the code and the date, using freely available open data with no licence barrier. This is a genuine advantage of the LEI system that most analytic products fail to exploit.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
GLEIF LEI Search	Open	Authoritative free lookup for any LEI returning full Level 1 reference data and Level 2 relationship records.	Primary retrieval of entity reference data and group relationships for a specific code or name.
GLEIF Golden Copy files	Open	Complete daily bulk downloads of all LEI records, relationship records and reporting exceptions in standard formats.	Builds reproducible, dated local datasets for portfolio-scale group structure analysis.
GLEIF API	Open	Programmatic access to entity records, direct and ultimate parent and child relationships and registration history.	Automates entity resolution and relationship traversal inside counterparty and investigation systems.
ISO 17442	Licensed	The standard defining LEI structure, the check digit scheme and the reference data model for legal entity identification.	Authoritative specification for offline validation and for understanding what the reference data model guarantees.
ISO/IEC 7064	Licensed	Check character system standard defining MOD 97-10, the algorithm used for LEI check digit validation.	Provides the validation algorithm implemented at ingestion to reject malformed or fabricated codes.
GLEIF Registration Authorities list	Open	Mapping of home business registries and their identifiers to the codes used in LEI reference data.	Translates the home registry identifier in an LEI record into an actual registry and a searchable reference.
ESMA registers	Open	EU financial instrument and entity reference data linking instruments and reporting entities to issuer LEIs.	Bridges from an LEI to the financial instruments an entity issues and its regulatory reporting footprint.
SEC EDGAR	Open	US registrant filings that increasingly carry LEIs, linking the identifier to full disclosure documents and subsidiary lists.	Connects an LEI to detailed narrative and financial disclosure for US-listed entities.
Companies House	Open	UK registry providing the officer, ownership and filing detail that an LEI record deliberately does not contain.	The destination of the home registry bridge for UK entities, unlocking officers and filing history.
OpenCorporates	Registration	Cross-jurisdiction company records that can be joined to LEI data to extend coverage to entities without an LEI.	Fallback entity resolution where a counterparty has no LEI, which is the common case for small entities.
OFAC Sanctions List Search	Open	US designations increasingly published with entity identifiers, aliases and ownership and control statements.	Screening of every entity in a resolved LEI group tree rather than the immediate counterparty alone.
Financial Stability Board publications	Open	Policy documentation on the global LEI system, its governance and its role in systemic risk measurement.	Explains why the system exists and what regulatory reporting regimes mandate LEI use.
Bank for International Settlements	Open	Research and statistics on financial interconnectedness and identifier standards in cross-border finance.	Context for interpreting group structures and cross-border exposure derived from relationship data.
GLEIF vLEI documentation	Open	Specification for verifiable LEI credentials that bind organisational identity to cryptographically verifiable digital credentials.	Relevant where organisational identity assurance in digital transactions is part of the analysis.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Legal Entity Identifier. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

Offline MOD 97-10 validator — Rejects malformed and fabricated codes at ingestion with no network call. Limitation: validates structure only, so a well-formed unissued code passes.
GLEIF API client — Retrieves entity and relationship records programmatically for resolution workflows. Limitation: per-entity querying is slow for portfolio-scale analysis.
Golden Copy ingestion pipeline — Loads complete dated snapshots for reproducible bulk analysis. Limitation: partial loads produce silently incomplete group trees that look normal.
Graph database — Stores and traverses parent and child relationships across large group structures efficiently. Limitation: reported relationships only, so gaps must be modelled explicitly.
Entity master data management — Uses the LEI as primary key across counterparty and transaction systems. Limitation: coverage gaps require a documented fallback resolution path.
Sanctions screening engine — Screens every entity in a resolved tree against designation lists with versioned snapshots. Limitation: designations rarely carry LEIs, so name matching returns at the boundary.
Registry bridging scripts — Convert the home registry identifier into a direct link to the national registry record. Limitation: registry identifier formats and availability vary widely.
Snapshot diffing — Compares successive Golden Copy files to detect status changes and new relationships. Limitation: requires disciplined retention of historical snapshots.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

Enrichment Runner — Walks the indicator set through a chosen provider in time-boxed, cursor-based batches that resume rather than restart.
Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

Validate the check digits before you query anything. MOD 97-10 validation costs nothing, catches every transcription error and most fabrications, and belongs at the ingestion boundary of any system that accepts an LEI as input rather than at the point of analysis.
Registration status has precise meanings that reward reading carefully. Lapsed means renewal stopped, not that the entity is gone; merged and retired record dated corporate events; and treating any non-issued status as death produces confident errors about live companies.
Level 2 relationships describe accounting consolidation as reported by the entity, not control in the sense that a sanctions regime or an intelligence assessment means. Describe them accurately, because overstating them as ownership is a common and consequential error.
Reporting exceptions are data, not gaps. When an entity records that it has no legal obligation to consolidate, that statement is itself informative about the group's structure and jurisdiction, and it should be preserved rather than collapsed into a missing value.
The home registry identifier is the highest-value field in the record, because it converts a verified financial identity into a full corporate research file with officers, filings and accounts. Analysts who stop at the LEI record are leaving most of the value unused.
Absence of an LEI means the entity was not required to have one. LEI holding tracks regulatory obligation rather than economic significance, so flagging absence as a risk indicator generates noise that buries the findings that matter.
Capture the reference data version used for any decision. Records change at renewal, and a decision made on data that no longer exists is indefensible unless you retained the snapshot, which the Golden Copy files make trivially easy.
Cite the LEI rather than the entity name in every product. The code is permanent, unambiguous and verifiable by any reader against free open data, which is a reproducibility advantage that almost no analytic product actually exploits.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Legal Entity Identifier is producing anything, and they are worth baselining before you change process or tooling.

Proportion of counterparty master records keyed by a validated LEI, trending upward, which measures whether name-matching ambiguity is actually being eliminated.
Percentage of LEI-holding counterparties whose full group tree has been resolved and screened, rather than the immediate entity alone.
Rate of check digit validation failures at ingestion, by source system. A persistent rate points to an upstream data quality problem worth fixing at source.
Freshness of the local reference dataset measured against the Golden Copy publication date, since analysis on a stale snapshot silently describes a past state.
Proportion of decisions with a retained reference data snapshot, which determines whether historical decisions remain explainable under review.
Coverage gap statistic: share of counterparties with no LEI, tracked so that fallback resolution effort can be planned rather than improvised.
Number of screening hits found at a parent or sibling rather than at the counterparty, which quantifies the value of resolving the whole tree.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

Coverage is partial. LEIs exist where regulation requires them, so many private and non-financial entities have none at all.
Lapsed records continue to be published with stale reference data and are frequently mistaken for current information.
Level 2 relationship data relies on accounting consolidation rules and does not capture control exercised through other means.
Reported exceptions mean parent data is legitimately absent, which is not the same as an entity having no parent.
One operating group may hold many LEIs across subsidiaries, so counting codes is not the same as counting organisations.
The LEI verifies registration, not conduct, and its presence says nothing about whether an entity is legitimate in substance.

Legal and ethical considerations

GLEIF publishes LEI reference data under an open licence with no restriction on use or redistribution, which makes it one of the cleanest datasets in entity intelligence. Records concern legal entities rather than individuals, so personal data exposure is minimal, though sole trader and small entity records can identify natural persons and should be treated accordingly. Retain the record version and retrieval date used for any conclusion, since reference data changes on renewal and a decision made on lapsed data must remain explainable.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Legal Entity Identifier, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 4 intelligence disciplines, 2 mission domains, 4 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

What does an LEI actually guarantee?

That an accredited Local Operating Unit validated the entity against its home business registry at the point of issuance or last renewal, and that the published reference data reflects that validation. That is a meaningful verified link between a financial market participant and its legal registration, which is more than most identifiers offer. It does not guarantee that the entity is solvent, legitimate, currently active or that its data is fresh, and it says nothing about beneficial ownership. Read the registration status and last update date alongside the record, because they qualify everything else in it.

Does a lapsed LEI mean the company is gone?

No. Lapsed means the entity stopped paying for renewal and the record was not revalidated. That happens when an entity ceases regulated activity and no longer needs the code, when a group consolidates its LEI holdings, when a renewal invoice was simply missed, and sometimes when the entity has genuinely wound up. The status is a prompt to check the home business registry, which will show whether the company is active, dissolved, in liquidation or struck off. Report the LEI status and the registry status separately, because they answer different questions.

How reliable is the parent relationship data?

Reliable for what it claims and frequently misread. Level 2 records direct and ultimate accounting consolidating parents as reported by the entity under defined accounting standards, validated by the Local Operating Unit. It is not an ownership percentage, not a control assessment and not a complete group map, because many relationships fall under documented reporting exceptions such as no obligation to consolidate. Use it as a strong, openly licensed starting structure, mark exception-flagged gaps explicitly, and corroborate against corporate registry filings and financial statements before asserting control.

Can I use GLEIF data commercially?

Yes. GLEIF publishes the Global LEI Index under an open licence with no restriction on use or redistribution, which is unusual among entity datasets and is a deliberate policy of the system. That means you can embed it in commercial products, redistribute it and build derived datasets without a licence negotiation. The practical obligations are attribution as a matter of good practice and accuracy about what the data represents. This openness is the main reason the LEI is the correct default join key in any system that needs cross-border entity resolution.

Why do many of our counterparties have no LEI?

Because LEI holding is driven by regulatory obligation rather than by size or significance. Entities are required to hold one when they participate in regulated financial markets, report to trade repositories or fall within specific reporting regimes. A privately held manufacturer, a small supplier or a non-financial services firm typically has no requirement and therefore no code. Absence is the normal state for most companies in the world. Resolve those entities through national registries instead, and record LEI coverage as a portfolio statistic rather than treating gaps as anomalies.

Should I query the API or download the Golden Copy?

Query the API for interactive lookups and small workflows; download the Golden Copy for anything at portfolio scale or anything that must be reproducible. The Golden Copy files are complete, dated daily snapshots of all records, relationships and reporting exceptions, which makes them ideal for research, backtesting and decision archiving. Pin and retain the file date in your methods and your decision files. Reconcile record counts on each load, because a partially ingested file produces incomplete group trees that display perfectly normally and are very hard to detect later.

How does the LEI relate to other entity identifiers?

It complements rather than replaces them. The home business registry number identifies the entity to its state; the tax registration identifies it to the revenue authority; tickers, BICs and MICs identify it in specific market contexts. The LEI's contribution is a single global code that is validated against the home registry and published openly with relationship data, which makes it the natural join key across systems that use different local identifiers. Build an identifier table binding all of them per entity, and record disagreements between them rather than resolving them silently.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

ISO 17442 defines the LEI structure, check digit calculation and reference data model for legal entity identification.
ISO/IEC 7064 MOD 97-10 provides the check character algorithm that enables offline validation of an LEI.
Global LEI System governance under the Financial Stability Board and the Regulatory Oversight Committee defines accreditation and data quality obligations.
MiFID II, EMIR and comparable reporting regimes mandate LEI use in transaction and trade reporting, driving coverage in financial markets.
GLEIF Common Data File formats define the structure of Level 1 records, Level 2 relationship records and reporting exception files.
ISO 20022 financial messaging incorporates the LEI as the party identification standard in payment and securities messages.
FATF Recommendations on beneficial ownership provide the wider policy context in which entity identification and group transparency operate.
vLEI specifications extend the system to cryptographically verifiable organisational identity credentials.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

Global LEI Index — GLEIF. Authoritative openly licensed reference data for all issued Legal Entity Identifiers and their relationships.
ISO 17442 Legal Entity Identifier — International Organization for Standardization. The standard defining LEI structure and the reference data model.
Global LEI System policy documents — Financial Stability Board. Governance framework and rationale for the global entity identification system.
ESMA registers and reference data — European Securities and Markets Authority. EU instrument and entity reference data linking issuers to LEIs.
EDGAR — US Securities and Exchange Commission. Filings connecting LEIs to detailed corporate disclosure and subsidiary lists.
Companies House register — UK Government. Home registry destination for the LEI registry bridge in the UK.
Sanctions List Search — US Department of the Treasury, Office of Foreign Assets Control. Designation data screened against resolved corporate group structures.
BIS statistics and research — Bank for International Settlements. Context on cross-border financial interconnection and identifier standards.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: LEI-keyed entity resolution with group structure expansion and screening across every related entity in the ownership tree. Explore the platform, or browse the rest of the library by following any tag above.