Identifiers

What is an LEI?

For the team that owns a company master and has to defend it.

Somebody has asked you for your counterparties' LEIs — a supervisory register, a payments migration, an onboarding form — and the ones you hold are a mix of valid, missing and lapsed. A Legal Entity Identifier is a twenty-character code that identifies a legal entity that participates in a financial transaction. It is issued under ISO 17442, it is free to consume, it is published by the body that assigns it, and it carries a machine-readable ownership layer. It is the best company identifier in common use, and the thing most people get wrong about it is renewal: a lapsed LEI is still the entity's identifier, and treating a lapse as evidence about identity is a bug.

A stewardship queue, a CRM after a migration or a merger, a supplier file before a payment run, counterparty onboarding that has to survive an audit. Read the argument here, take the takeaways at the foot into your next vendor conversation, and send us a file when you want the same measurement on your own rows.

Identifiers · 2,172 words · every figure carries the population it was measured over

Reading time
11 min read
Sections
8
Questions answered
6
Key takeaways
7
the same measurement, on your rows
A first file is a few hundred of your own rows with the matches you already have beside them. The numbers in this article come back measured on your data, and we write nothing to your systems.
Start free →
Self-serviceCreate your workspace online and verify your email to start matching company records. Free starts with 300 credits and no card. Paid monthly plans are available in workspace Billing; VAT is added where applicable. Usage is tracked without automatic overage charges. Trust and security
On this page

The structure, and the two characters that catch typos

An LEI is twenty alphanumeric characters and the layout is fixed by ISO 17442. The first four identify the Local Operating Unit that issued it. The next two are reserved and set to zero. Characters seven to eighteen are the entity-specific part, assigned by the issuing unit and carrying no meaning you should try to parse. The last two are check digits computed under the ISO 7064 MOD 97-10 scheme.

Those last two characters are the practical reason to prefer an LEI over almost any other identifier on a form. A mistyped LEI fails its own checksum, offline, with no lookup and no network call, so a transcription error is caught at the point of entry rather than surfacing later as a match that will not resolve. In our own pipeline an LEI is checked against its published checksum before it is trusted as an identifier at all, which is a cheap guard against the class of error where a well-formed-looking string binds a decision it should never have reached.

There is no jurisdiction encoded in the value and there is no meaning in the prefix beyond the issuer. An LEI issued by a unit in one country says nothing about where the entity is registered, and a system that infers jurisdiction from the prefix is inferring the wrong thing.

Who issues it, and why that matters more than it sounds

The Global Legal Entity Identifier Foundation — GLEIF — operates the system, accredits the Local Operating Units that actually issue codes, and publishes the whole reference dataset. Global: roughly 3.4 million LEIs assigned across all registration statuses, about 2.0 million of them with registration status ISSUED and most of the rest LAPSED (GLEIF, golden copy of 2026-09-25). Authoritative by definition: the body that publishes the record is the body that assigns the code.

The publishing arrangement is the unusual part. GLEIF publishes the full record set under CC0, which means the data is genuinely open rather than open-with-a-clause, and it is the one source in our inventory that grades its own facts: every record carries a corroboration level, so an uncorroborated self-reported name can be demoted below a filed one rather than trusted equally. Almost no commercial dataset offers that, and it is the property that makes the LEI record usable as evidence rather than merely as a lookup.

It also happens to be where several other identifiers can be obtained lawfully. The GLEIF payload carries the issuing register's authority code with the number held in it, the ISO 20275 legal form code, BIC codes for financial institutions, and an OpenCorporates identifier — the last of which can therefore be used without touching OpenCorporates' own data or terms, because GLEIF publishes the mapping itself.

Level 1: who you are

Level 1 is the entity's own reference data, and it is the part most integrations use. It carries the legal name, other and previous names, the legal address and the headquarters address, the entity's legal form as an ISO 20275 code, the entity status, and the registration details linking the record back to the register of incorporation — the authority code of that register and the number the entity holds in it.

That last field pair is the quietly valuable one for matching. It is a published crosswalk from the LEI to the company registration number, qualified by the register that issued it, produced by the body that assigned the LEI. It solves the register-scoping problem described in the identifiers article, for the subset of companies that hold an LEI, without any inference on your part.

Previous names deserve their own note. They are register facts with validity dates rather than inferences, so an entity that renamed in 2021 is matchable under both names with a citation for each. This is a case string matching handles badly — the two names are frequently not similar at all — and a register handles trivially.

Level 2: who owns you, and on what basis

Level 2 is the relationship data, and it answers a narrower question than most people assume. It records the direct and ultimate accounting consolidating parent — the entity that consolidates this one in its financial statements under the applicable accounting standard — together with the parent's own LEI where the parent holds one.

Accounting consolidation is not majority ownership and the two frequently diverge. A company can be majority-owned and not consolidated; a company can be consolidated on control grounds without a majority stake. Rendering an LEI parent into a field called "parent company" alongside a credit bureau's ownership parent produces a column where two different claims are indistinguishable, and nobody looking at the resulting report can tell which one they are reading. Every ownership edge we return therefore states its basis and its certainty rather than being flattened into one field.

The absences are structured too. Where an entity reports no parent, it supplies a reason code — the parent has no LEI, the parent is one or more natural persons, there is no consolidating parent, and several others covering legal obstacles and non-public arrangements. Those codes are a finding rather than a gap: "the parent is a natural person" and "we do not know" are different states, and a system that renders both as an empty field has thrown away the useful half.

The coverage limit follows directly. Subsidiary lists derived from Level 2 are complete only with respect to entities that themselves hold an LEI, so an ownership walk that stops is reporting the edge of the identifier system rather than the edge of the group. We report what was not walked for exactly that reason: you cannot infer depth from an empty field.

Renewal and lapse

An LEI must be renewed annually. Renewal is a re-verification of the Level 1 reference data against an authoritative source, performed by the issuing unit, and it is what keeps the record's claims about the entity current. If the holder does not renew, the registration status moves to lapsed.

The registration status is a statement about the registration, not about the entity, and the record carries an entity status separately for exactly that reason. An entity can be active with a lapsed registration — this is the common case, and it usually means nobody had a reporting obligation that year — and an entity can be inactive with a registration still in good standing. Other statuses exist for codes that have been merged into another, retired, or annulled because they should never have been issued, and each of those means something different again.

The dataset also records who last verified the record and when, which is the field to read if you want to know how much weight the Level 1 address deserves today. Nothing in this system revalidates itself on a schedule on our side either: freshness advances when a resolution re-observes a value, and there is no background job quietly refreshing your records behind you.

What a lapsed LEI means for matching

The intuitive handling of a lapse is wrong, and it costs you recall on rows you could have matched.

A lapsed LEI is still that entity's LEI. The code was assigned to a legal entity and it continues to identify that legal entity; the lapse says the holder stopped paying for annual re-verification. So two records carrying the same lapsed LEI are the same legal entity, and a matcher that declines to use a lapsed identifier is discarding the strongest signal in the record because of an administrative fact about a subscription.

The correct handling separates three questions that the status field is often asked to answer at once. Is this the same entity — yes, the identifier still binds, and an agreeing LEI decides. Is the reference data attached to it current — no, treat the Level 1 name and address as of the last verification date rather than as of today, which matters most for address-sensitive work like structured payment addresses. Is the entity still trading — the LEI record does not answer that; the register of incorporation does, and that is a different lookup.

Two further rules follow. A lapse is never a non-match signal: two records with different LEIs are different entities whether or not either has lapsed, and two records with the same LEI are the same entity on the same terms. And a lapsed record's ownership data ages faster than its identity data — a consolidating parent recorded three years ago and never re-verified is a claim about 2023, and presenting it as a current group structure is the sort of quiet staleness a concentration report cannot survive.

Where an LEI is actually required

Adoption is driven by obligation rather than by enthusiasm, which is why coverage skews the way it does. Two current examples are enough to explain the shape of the data.

The first is the DORA register of information: EU financial entities must maintain and submit a register of their contractual arrangements with ICT third-party service providers, with each provider identified by its legal entity identifier. That obligation has applied since 17 January 2025, and it is the reason a great many technology suppliers acquired an LEI who had no financial reporting reason to hold one.

The second is payments. GLEIF and Swift publish a free monthly BIC-to-LEI relationship file, which turns a bank identifier into a legal entity identifier without a commercial licence — a useful thing when the ISO 20022 migration requires you to establish that a named counterparty, a BIC and a structured address all describe the same entity.

The consequence for anyone planning a matching strategy is straightforward. An LEI is the best identifier to have and the worst one to assume: it is present for financial counterparties, listed issuers, regulated firms and increasingly for suppliers to regulated firms, and it is largely absent for small private companies. Plan for the register number as the primary key and the LEI as the strong corroborator, rather than the other way round.

What an LEI does not guarantee

It says nothing about whether an entity is trading, solvent, sanctioned, creditworthy or well governed. It is an identifier, and reading a status field as a risk signal is the same category error as reading a match confidence as a recommendation.

It does not identify branches or establishments in the way some registers do, it does not identify natural persons, and it does not identify securities. Where the entity you are trying to identify is a division, a site or a brand rather than a legal person, there is no LEI to find and its absence is not a data gap.

And it does not make the surrounding matching problem go away. An agreeing LEI decides a match on its own; a record that carries no LEI is exactly as hard as it was before, which for a name and a country is a shape that measured well on a high name-uniqueness register and would measure much worse on a low one. The identifier is the easy path, and the reason a resolver exists is the rows that do not have one.

Key takeaways

What to take away

  • An LEI is twenty characters under ISO 17442: four for the issuing unit, two reserved zeros, twelve entity-specific, and two ISO 7064 MOD 97-10 check digits that catch a typo offline.
  • GLEIF publishes the whole dataset under CC0 and grades its own facts with a corroboration level, which is what makes the record usable as evidence rather than only as a lookup.
  • Level 1 carries the entity's own reference data including a register-qualified company number — a published crosswalk you do not have to infer.
  • Level 2 records accounting consolidating parents, which is not majority ownership, and structures its absences as reason codes rather than as empty fields.
  • Registration status describes the registration; entity status describes the entity. An active entity with a lapsed registration is the common case.
  • A lapsed LEI still identifies the entity. Use it to bind the match, and treat the attached Level 1 data as of its last verification date rather than as of today.
  • Coverage follows obligation: strong among financial counterparties and suppliers to regulated firms, thin among small private companies. Plan for the register number as primary and the LEI as corroborator.

Those takeaways hold for anybody's data. The number for yours comes out of your own rows — a few hundred of them, with the matches you already have beside them.

Start free
Still not answered?it will name the article that covers it, or say where the field has no settled answer
Ask whatever this article left open. If the answer is a number it comes with the population it was measured over, and if it belongs to another article or a glossary entry I will name that one.

Prefer to put it to a person? Talk to us instead →

Is this your file?

The article is for anyone. The measurement behind it is worth commissioning for one kind of team.

built for

Teams with a company master they have to defend — an MDM or stewardship queue, a CRM after a migration or a merger, a supplier file before a payment run, or counterparty onboarding that has to survive an audit.

wrong for

Buying breadth as the product: we hold a fraction of an incumbent’s records and are not building a global company graph. Entity Bind resolves companies and organisations only. It does not resolve people, vessels, bank-account ownership, sanctions exposure, emissions or geolocation, and its results may not be used for eligibility decisions about individuals, including employment, credit and tenancy.

Sources

The papers, regulators and registers this article quotes, each with the caveat that travels with it.

the basis for every figure above

Internal fixtures only. The historical 2026-08-29 per-tier recording covers 317 GB companies with identifier-rich arrivals seeding the catalogue first; the context tier includes country and registered-town prose. Its legacy replay has no full-prompt-verified calls and cannot certify current calibration. The September 5 CI reports cover 1,176 labelled pairs and 705 records over 250 companies using offline stubs. These are not independent customer holdouts or live production validation; the 99% minimum-input product target remains unmet. Scope is company and organisation identity only — not people, vessels, bank-account ownership, sanctions or emissions. Results may not be used for eligibility decisions about individuals, including employment, credit and tenancy.

Figures read off the product repository on 2026-09-05. The per-tier rates come from the live-adjudicated 317-company recording of 2026-08-29; the gate figures come from the stub-adjudicated continuous-integration run and are a floor rather than a ceiling. The two are never averaged. Entity Bind holds no SOC 2, no ISO 27001 and no other certification, and claims none. Every figure, with the population it was measured over and the method behind both recordings, is set out on the accuracy page. The retention, erasure, tenancy and sub-processor detail a security review asks for is under Trust and security, with where assurance stands: no external validation of the accuracy figures and no customer holdout.

the ask

The same measurement, on your own rows.

Create your workspace, verify your email and run your first company file. The Free plan needs no card. Create API keys in your workspace when you need an integration.

300 credits. No card.

For a guided review of your file, explore the Merge Safety Sprint →

The questions this article answers

What does LEI stand for?

Legal Entity Identifier. It is a twenty-character alphanumeric code defined by ISO 17442 that identifies a legal entity participating in a financial transaction. Global: roughly 3.4 million LEIs assigned across all registration statuses, about 2.0 million of them with registration status ISSUED and most of the rest LAPSED (GLEIF, golden copy of 2026-09-25), issued by GLEIF, which issues them through accredited Local Operating Units, and the reference dataset is published openly.

Is a lapsed LEI still valid for matching?

Yes, and treating it otherwise costs you recall for no benefit. The code was assigned to a legal entity and continues to identify it; a lapse means the holder stopped paying for annual re-verification. So two records carrying the same lapsed LEI are the same legal entity. What the lapse does tell you is that the reference data attached to the record — the name, the addresses, the parent — should be read as of its last verification date rather than as of today.

Does a lapsed LEI mean the company has stopped trading?

No, and the record carries the two facts separately for precisely this reason: registration status describes the registration, entity status describes the entity. An active company with a lapsed registration is the common case and usually means nobody had a reporting obligation that year. Whether a company is still trading is a question for the register of incorporation, which is a different lookup.

What is the difference between Level 1 and Level 2 LEI data?

Level 1 is who you are: legal name, previous names, legal and headquarters addresses, ISO 20275 legal form, entity status, and the registration details that link back to the register of incorporation. Level 2 is who owns you: the direct and ultimate accounting consolidating parents, with structured reason codes where none is reported. Level 2 is about accounting consolidation rather than majority ownership, and the two genuinely diverge.

How often does an LEI need renewing?

Annually. Renewal is a re-verification of the Level 1 reference data against an authoritative source by the issuing Local Operating Unit, and the record carries the date of the last verification. Nothing here revalidates on a cadence on our side either — freshness advances when a resolution re-observes a value, and there is no background job refreshing your records behind you.

Can you supply an LEI for a company that does not have one?

No, and the response says so explicitly rather than returning an empty field. Where the global LEI system holds none for a resolved company, the crosswalk reports that as a finding distinct from a scheme no wired source supplies at all. For a register submission those are different problems with different remedies, and only the first one is about the provider.