A trusted issuer is an on-chain identity, such as a compliance provider or your own compliance team's identity, whose signed verifications your system accepts. On this screen a verification policy manager decides whose verifications count across the whole system, and for which verification topics. A token can add its own trusted issuers on top, as Can an issuer be trusted for one asset only? explains. An eligibility check confirms that a participant's identity carries the verifications a rule requires. Every check reads the trust you set here at the moment it runs.
Use this screen when you onboard a new source of verifications, when an issuer's scope of authority changes, or when your system must stop trusting one. Connecting a compliance provider registers the provider's identity here for you, so you do not add a provider by hand. This screen does not issue verifications to anyone: a participant gets verified on Verify a participant, and the evidence categories themselves are defined on Verification topics, which must exist before you can assign them here.
The “This system” tab lists trusted issuer identities with their assigned verification topics and whether each entry is system-owned or inherited from the global directory.
Steps
Open Trusted issuers
Open “Compliance”, then Trusted issuers. The “This system” tab is selected by default and lists each issuer with its “Issuer identity”, “Assigned topics” and “Source”.
The table names an issuer by the wallet of the participant behind it, calls your organisation's own identity “This system”, and shows No participant linked when the identity has no linked wallet or no name the Console can show.
A row whose source reads “Global” is inherited from the directory and shows the text Managed globally instead of a menu. Only a directory administrator changes such an entry, and not from this screen.
Decide which topics to grant
Grant only the topics this issuer's own checks cover. A valid claim from the issuer then counts for those topics, and other required claims, expiry checks and asset rules can still block a movement. A topic you grant that the issuer does not verify widens its authority past its evidence.
A topic you leave out makes every check that requires it fail for this issuer's claims, which is right only when you limit the issuer on purpose, such as during a phased rollout. The same choice applies when you later change the issuer's topics on Edit topics.
Add an issuer
- Select Add trusted issuer.
- In Issuer identity address, choose or paste the issuer's identity contract address, not its signing wallet. The field searches the participants and contacts you can see and takes a pasted
0xaddress, as Address fields describes. - Choose at least one topic under Verification topics.
- Select Add issuer and confirm with your wallet verification.
An address without a registered identity is refused. The Console reports: “This address must be a registered identity before it can be added as a trusted issuer.”
Entering an address that is already a trusted issuer turns the sheet into an update instead of a duplicate. Its current topics load into the picker, and the review step lists exactly what you are adding and removing. Drop a topic the issuer already holds and that same review step warns: “Removing a topic only removes the issuer association. Existing claims issued for that topic will not be revoked.”
The “Add trusted issuer” sheet with an “Issuer identity address” field and a “Verification topics” selection.
Change an issuer's topics
Open the menu at the end of the issuer's row and select Edit topics. The address cannot change. The selection must differ from the current set before “Review” activates. Removing a topic ends only the authorisation: claims already issued for that topic are not revoked, but from then on a claim this issuer signs for that topic no longer satisfies a check. On each participant's “Verifications” tab, those claims then show “Issuer not trusted for this topic” instead of “Active”.
One row is your organisation's own identity. The system signs your exchange-rate feeds and your assets' base price claims with it, and it also writes each participant's “Residence” claim from the country on their approved KYC profile. So it must stay trusted for these topics:
- “Base price”
- “Price feed”
- “Document hash”
- “Instrument structure”
- “Residence”
- “Retail participant”
- “Institutional participant”
- “Proprietary participant”
The row for this identity is named “This system”. The sheet shows these topics locked above the picker, in the order the row lists them, with “These topics are required by the system for this identity and can't be removed.”, and you cannot remove them. Because the locked topics already count as a selection, the picker no longer asks for at least one more. If the identity does not hold one of them yet, the note says so and saving grants it. A change through the Platform API that leaves one of these topics out is refused with a conflict that names the missing topics.
Remove an issuer
Removing an issuer deletes its registry entry, with no paused state. From the next check on, its claims stop counting, and a participant whose only evidence came from it fails checks, often as a missing required claim rather than one naming the removed issuer. The participant's Verifications tab shows each such claim as “Issuer not trusted for this topic”. Check the current trust registry when you investigate such a failure.
- Open the issuer's row menu and select Remove issuer.
- Confirm the dialog, then confirm with your wallet verification.
You cannot remove your organisation's own identity. Its Remove issuer item is unavailable and says the system requires this identity, and the Platform API refuses the removal with a conflict. Without that identity, your exchange-rate feeds would reject every update.
To restore trust after a removal, add the same identity address back with the topics it should hold. The claims it issued count towards verification again, because checks read the current registry rather than its history. Between removal and re-add, every check treats that issuer's claims as absent evidence.
The three trust tiers
A token resolves its trusted issuers across three tiers. The This system tab holds the issuers your own system trusts, and it is the only one you can change here. The “Global directory” tab lists the platform directory of issuers that every system inherits. Inherited entries also appear in your system table with the source “Global”, and nothing on this screen edits them.
A trusted issuer in the global directory counts towards every check in your system, the same as one you added, and you cannot remove it here. A token with its own trusted issuer registry adds a third tier for that one asset.
What a change records
Each of these changes is an operation the organisation's Audit trail records, with your name and the role you held at the time.
Troubleshooting
The issuer address is rejected
No verification topics are selectable
The picker stays disabled until you choose an issuer address, and it can only offer topics that exist. Select the issuer first. If the list is empty, create the topic on Verification topics and return.
A row shows Managed globally instead of a menu
The entry is inherited from the global directory, and this screen cannot change directory entries. Ask a directory administrator to adjust it. Your system-level rows stay editable.
Review stays inactive on Edit topics
The selected set matches the issuer's current topics, or is empty. Change the selection so it differs and keeps at least one topic. To drop every topic, remove the issuer instead.
The page shows no add button or row menus
The line “Only a Verification policy manager can change the trusted issuers of this system.” means your account lacks the “Verification policy manager” role on this system. Ask someone with the Permission manager role to grant it, or hand the change to someone who holds it.
Frequently asked questions
Can an issuer be trusted for one asset only?
Yes, when the token has its own trusted issuer registry, and not from this screen. A token without one uses the system and global issuers alone. The token's Governance role adds a token-level entry on that token's own trusted issuers screen, and that entry's claims count for that asset. Removing it leaves the inherited system and global trust intact. Use this screen when the issuer should count for the whole system.
Why can I see the Global directory tab but not change it?
This screen never edits the directory. Unless you are a directory administrator, the tab shows the notice “You are viewing the global trusted issuers in read-only mode. Contact a directory administrator to make changes.” instead of the table. A directory administrator can browse and search the directory per network, but the Console still offers no way to add, edit, or remove an entry there. A directory administrator changes the directory outside this screen, and every system inherits the result.
API routes
The trusted issuer endpoints in the Platform API reference cover register, replace the topic set, add or remove one topic, and remove, for deployments that manage trust from code.