Organisational Digital Identity: Prove Who a Company Is and Who Speaks for It

Organisational digital identity is a verifiable, machine-checkable way to prove which legal entity you are dealing with and which people, systems or agents are authorised to act for it. Most business processes still rely on registry look-ups, PDFs of certificates of incorporation, letters of authority and email domains, all of which are slow to check and easy to forge, which is why invoice fraud and supplier impersonation keep working. This guide explains the building blocks (legal entity identifiers, the verifiable LEI, verifiable credentials, electronic seals) and the proposed EU Business Wallet, how they fit together, and what security and identity teams should do now. It is for identity architects, procurement and finance security leads, and anyone designing B2B onboarding; person-level wallets and the wider eIDAS framework are covered in the eIDAS 2.0 and the European Digital Identity Framework Guide.

Key takeaways

• Two questions, not one. Organisational identity has to answer "which entity is this?" and "is this person or system authorised to act for it, in this role?"; most fraud exploits the second.
• The identifier layer exists already. The Legal Entity Identifier (LEI, ISO 17442) is a 20-character code with public reference data on who is who and who owns whom, and in the EU the European Unique Identifier (EUID) identifies companies in business registers.
• vLEI adds verifiable roles. GLEIF's verifiable LEI framework issues credentials to legal entities and to their official representatives and functional role holders, through Qualified vLEI Issuers.
• The EU Business Wallet is still a proposal. The Commission proposed a Regulation on European Business Wallets on 19 November 2025 (COM(2025) 838); it would let companies identify themselves, sign, seal, hold attestations and manage mandates, and is in the ordinary legislative procedure.
• Verification is the hard part. A credential only helps if relying parties check issuer trust, status and role scope every time and remove manual overrides.

What it is

A person-level digital identity says "this is Jane". An organisational identity says "this is Example Ltd, registered in this jurisdiction, with this identifier, and Jane is its finance director with authority to approve payments up to this limit". It covers three layers:

The LEI is administered by GLEIF, a not-for-profit foundation backed by the G20 and the Financial Stability Board and overseen by the Regulatory Oversight Committee. LEIs are issued by accredited LEI issuers (Local Operating Units), and each LEI represents exactly one legal entity with verified reference data, including ownership structure. See the KYB Guide for how these data sources feed business verification today.

How it works

The verifiable LEI (vLEI)

GLEIF's vLEI Ecosystem Governance Framework (version 4.0, based on the Trust over IP Governance Metamodel and reviewed at least annually) defines who issues what:

The trust chain is anchored in GLEIF's Root Autonomic Identifier (AID) and delegated AIDs, and the technical layer uses Key Event Receipt Infrastructure (KERI) plus a vLEI credential schema registry. In practice a verifier checks that a credential chains back to GLEIF through a qualified issuer, that it has not been revoked, and that the role matches the action requested.

Verifiable credentials in general

The W3C Verifiable Credentials Data Model v2.0 became a W3C Recommendation on 15 May 2025. It defines issuers, holders, verifiers and subjects, supports selective disclosure, and can be secured with embedded Data Integrity proofs or enveloping JOSE and COSE signatures. An organisation can be the subject and holder of credentials just like a person, with an authorised representative presenting them. See the Verifiable Credentials Guide and the Decentralised identifiers (DIDs) guide.

The proposed EU Business Wallet

The Commission's proposal for a Regulation on the establishment of European Business Wallets (COM(2025) 838 final, procedure 2025/0358(COD)) was published on 19 November 2025. As described in the proposal text and the EDPS opinion of 20 January 2026, a business wallet would provide:

• Identification and authentication: using the EUID where one exists, or a nationally designated register identifier where it does not.
• Signing and sealing: including qualified electronic signatures and seals.
• Attestations: issuing, storing and presenting qualified and non-qualified electronic attestations of attributes, such as licences or certifications.
• A secure channel: a qualified electronic registered delivery service for official documents and notifications.
• Mandates: a role-based system of technical and administrative mandates, so several representatives can use one wallet with delegated rights.
• A European Digital Directory: a Union-wide contact and discovery mechanism maintained by the Commission, relying on business registers.

Wallets would be offered by notified service providers, not issued by Member States, and certification would not be mandatory (unlike the European Digital Identity Wallets, which remain person-focused). The proposal removes legal persons as beneficiaries of European Digital Identity Wallets, while sole traders keep using their personal wallets. The proposal text says public sector bodies must make business wallet use possible within 24 months of entry into force, with a transition period ending at 36 months. These are proposed provisions: the European Economic and Social Committee gave its opinion on 18 March 2026 and the text may change before adoption, so plan around the direction rather than exact dates. See the EUDI Wallet Architecture and Reference Framework Guide for the person wallet side.

Why it matters

• Payment and supplier fraud: business email compromise works because a payment change request from a lookalike domain or a hijacked mailbox cannot be checked against a verifiable statement of who is authorised. Role credentials let finance teams require a valid, unrevoked approval credential before changing bank details. See the Email Identity and BEC Guide.
• Onboarding speed and accuracy: verifying a counterparty from a credential takes seconds rather than days of document checks, and reduces the copies of passports and board minutes held in supplier files.
• Delegation to systems and agents: as AI agents and automated systems transact for companies, a verifier needs to know which organisation stands behind the agent and what it may commit to. See the Know Your Agent (KYA) Guide.
• Regulatory reporting: regulators already use LEIs in financial reporting; verifiable signing by an identified officer strengthens the evidence trail.

Choosing an approach

Rolling it out

1. Map high-risk organisational assertions: bank detail changes, contract signature, regulatory filings, supplier onboarding.
2. Clean up the identifier layer: record each counterparty's LEI or registry identifier in your vendor master and keep your own LEI and register data current.
3. Pilot credential verification on one process with a few willing partners, in report-only mode alongside existing checks.
4. Define role policy: which role credential is required for which action, and how revocation is checked.
5. Switch to enforcement for that process, keeping a documented, logged fallback route for partners without credentials.
6. Roll back by returning to the existing manual check if issuer or status services fail, and treat that as an incident.

What to measure: share of active suppliers with a verified identifier; share of bank detail changes backed by a verified role credential; number of manual overrides of failed verification; time to onboard a verified counterparty; time to revoke a role credential when someone leaves.

Common misconceptions

• "An LEI proves who I am talking to": an LEI is a public identifier anyone can quote. Proof needs a credential bound to keys the entity controls, and a role credential for the person acting.
• "The Business Wallet is already law": as of November 2026 it is a Commission proposal under the ordinary legislative procedure.
• "Organisations get EUDI Wallets": the proposal would remove legal persons from the EUDI Wallet scope and give them business wallets instead, though sole traders keep personal wallets.
• "Once issued, a role credential is safe": people change roles and leave. Verifiers must check status at every use, and organisations must revoke promptly as part of leaver processes.
• "Domain names are organisational identity": domains and email addresses are easy to spoof or register in lookalike form; they identify infrastructure, not legal entities or authority.

Related concepts

• Electronic seals and qualified trust services: the eIDAS seal is the long-standing legal-person signature; see the eIDAS Qualified Trust Services Guide.
• B2B identity in applications: multi-tenant applications model customer organisations, administrators and federation; see the B2B CIAM and Organisation Management Guide.
• Credential protocols: issuance and presentation use protocols such as those in the OpenID for Verifiable Credential Issuance Guide.

Practitioner checklist

• Keep your organisation's LEI and business register data accurate, and record counterparties' identifiers in the vendor master.
• List the business actions where you need proof of authority, starting with bank detail changes and contract signature.
• Require verified entity identity at supplier onboarding and a role-bound approval for payment changes.
• Pilot vLEI or attestation-based verification with willing partners before enforcing it.
• Check credential issuer trust, revocation status and role scope on every use, not just at onboarding.
• Add role credential revocation to joiner, mover and leaver processes.
• Track the European Business Wallets proposal through the legislative process and plan for public sector acceptance timelines.
• Log and review every manual override of a failed verification.

Standards and references

• GLEIF: Introducing the verifiable LEI (vLEI)
• GLEIF: Introducing the Legal Entity Identifier (LEI)
• Council of the EU: Commission proposal for a Regulation on the establishment of European Business Wallets, COM(2025) 838
• EDPS: Opinion 5/2026 on the European Business Wallets proposal
• European Economic and Social Committee: Opinion on European business wallets
• EUR-Lex: Regulation (EU) 2024/1183 establishing the European Digital Identity Framework
• W3C: Verifiable Credentials Data Model v2.0

Related NHI Mgmt Group resources: eIDAS 2.0 and the European Digital Identity Framework Guide · Verifiable Credentials Guide · KYB Guide · Digital Identity Wallets Guide