# Trusted issuers

Source: https://docs.settlemint.com/docs/console/compliance/trusted-issuers
Authorise identity issuers for specific verification topics.

A trusted issuer is an on-chain identity, such as a [compliance provider](https://docs.settlemint.com/docs/console/compliance/compliance-providers) or your own compliance team's identity, whose signed verifications your system accepts. On this screen a verification policy manager decides whose verifications count across the whole system, and for which verification topics. A token can add its own trusted issuers on top, as [Can an issuer be trusted for one asset only?](#can-an-issuer-be-trusted-for-one-asset-only) explains. An eligibility check confirms that a participant's identity carries the verifications a rule requires. Every check reads the trust you set here at the moment it runs.

Use this screen when you onboard a new source of verifications, when an issuer's scope of authority changes, or when your system must stop trusting one. Connecting a compliance provider registers the provider's identity here for you, so you do not add a provider by hand. This screen does not issue verifications to anyone: a participant gets verified on [Verify a participant](https://docs.settlemint.com/docs/console/participants/verify-a-participant), and the evidence categories themselves are defined on [Verification topics](https://docs.settlemint.com/docs/console/compliance/verification-topics), which must exist before you can assign them here.

![Trusted issuers registry](https://docs.settlemint.com/docs/screenshots/console-trusted-issuers.light.en.webp)

[Screenshot] The "This system" tab lists trusted issuer identities with their assigned verification topics and whether each entry is system-owned or inherited from the global directory.

## Before you start [#before-you-start]

- **A role that can open the page.** The sidebar shows "Trusted issuers" to the "Permission manager", "System manager", "Verification policy manager", "Feeds manager" and "Compliance manager" roles.
- **The Verification policy manager role.** Only this role can add, change or remove an issuer in the system registry. Everyone else sees the table under the line "Only a Verification policy manager can change the trusted issuers of this system.", with no add button and no row menus.
- **A second approver, when your organisation requires one.** When the "Compliance configuration" group is protected under [Approvals](https://docs.settlemint.com/docs/console/organisation-settings/general#approvals), each change on this screen waits on [Actions](https://docs.settlemint.com/docs/console/essentials/actions#decide-an-administrative-change) until another person approves it, and nothing changes until then.
- **A verification topic.** At least one must exist before you can add an issuer.
- **A registered identity.** The issuer's address must already be a registered identity in the system.
- **Your wallet verification.** Adding, editing and removing an issuer each confirm with it.

## Steps [#steps]

### Open Trusted issuers [#open-trusted-issuers]

Open "Compliance", then **Trusted issuers**. The "This system" tab is selected by default and lists each issuer with its "Issuer identity", "Assigned topics" and "Source".

The table names an issuer by the wallet of the participant behind it, calls your organisation's own identity "This system", and shows **No participant linked** when the identity has no linked wallet or no name the Console can show.

A row whose source reads "Global" is inherited from the directory and shows the text **Managed globally** instead of a menu. Only a directory administrator changes such an entry, and not from this screen.

### Decide which topics to grant [#decide-which-topics-to-grant]

Grant only the topics this issuer's own checks cover. A valid claim from the issuer then counts for those topics, and other required claims, expiry checks and asset rules can still block a movement. A topic you grant that the issuer does not verify widens its authority past its evidence.

A topic you leave out makes every check that requires it fail for this issuer's claims, which is right only when you limit the issuer on purpose, such as during a phased rollout. The same choice applies when you later change the issuer's topics on **Edit topics**.

### Add an issuer [#add-an-issuer]

1. Select **Add trusted issuer**.
2. In **Issuer identity address**, choose or paste the issuer's identity contract address, not its signing wallet. The field searches the participants and contacts you can see and takes a pasted `0x` address, as [Address fields](https://docs.settlemint.com/docs/concepts/operating/address-fields) describes.
3. Choose at least one topic under **Verification topics**.
4. Select **Add issuer** and confirm with your wallet verification.

An address without a registered identity is refused. The Console reports: "This address must be a registered identity before it can be added as a trusted issuer."

Entering an address that is already a trusted issuer turns the sheet into an update instead of a duplicate. Its current topics load into the picker, and the review step lists exactly what you are adding and removing. Drop a topic the issuer already holds and that same review step warns: "Removing a topic only removes the issuer association. Existing claims issued for that topic will not be revoked."

![Add trusted issuer sheet with the issuer identity address and verification topics](https://docs.settlemint.com/docs/screenshots/console-trusted-issuers-add-form.light.en.webp)

[Screenshot] The "Add trusted issuer" sheet with an "Issuer identity address" field and a "Verification topics" selection.

## Change an issuer's topics [#change-an-issuers-topics]

Open the menu at the end of the issuer's row and select **Edit topics**. The address cannot change. The selection must differ from the current set before "Review" activates. Removing a topic ends only the authorisation: claims already issued for that topic are not revoked, but from then on a claim this issuer signs for that topic no longer satisfies a check. On each participant's "Verifications" tab, those claims then show "Issuer not trusted for this topic" instead of "Active".

One row is your organisation's own identity. The system signs your exchange-rate feeds and your assets' base price claims with it, and it also writes each participant's "Residence" claim from the country on their approved KYC profile. So it must stay trusted for these topics:

- "Base price"
- "Price feed"
- "Document hash"
- "Instrument structure"
- "Residence"
- "Retail participant"
- "Institutional participant"
- "Proprietary participant"

The row for this identity is named "This system". The sheet shows these topics locked above the picker, in the order the row lists them, with "These topics are required by the system for this identity and can't be removed.", and you cannot remove them. Because the locked topics already count as a selection, the picker no longer asks for at least one more. If the identity does not hold one of them yet, the note says so and saving grants it. A change through the Platform API that leaves one of these topics out is refused with a conflict that names the missing topics.

## Remove an issuer [#remove-an-issuer]

Removing an issuer deletes its registry entry, with no paused state. From the next check on, its claims stop counting, and a participant whose only evidence came from it fails checks, often as a missing required claim rather than one naming the removed issuer. The participant's **Verifications** tab shows each such claim as "Issuer not trusted for this topic". Check the current trust registry when you investigate such a failure.

1. Open the issuer's row menu and select **Remove issuer**.
2. Confirm the dialog, then confirm with your wallet verification.

You cannot remove your organisation's own identity. Its **Remove issuer** item is unavailable and says the system requires this identity, and the Platform API refuses the removal with a conflict. Without that identity, your exchange-rate feeds would reject every update.

To restore trust after a removal, add the same identity address back with the topics it should hold. The claims it issued count towards verification again, because checks read the current registry rather than its history. Between removal and re-add, every check treats that issuer's claims as absent evidence.

## The three trust tiers [#the-three-trust-tiers]

A token resolves its trusted issuers across three tiers. The **This system** tab holds the issuers your own system trusts, and it is the only one you can change here. The "Global directory" tab lists the platform directory of issuers that every system inherits. Inherited entries also appear in your system table with the source "Global", and nothing on this screen edits them.

A trusted issuer in the global directory counts towards every check in your system, the same as one you added, and you cannot remove it here. A token with its own trusted issuer registry adds a third tier for that one asset.

## What a change records [#what-a-change-records]

Each of these changes is an operation the organisation's [Audit trail](https://docs.settlemint.com/docs/console/reporting/audit-trail) records, with your name and the role you held at the time.

## You should see [#you-should-see]

- Look for "Trusted issuer added successfully" or "Trusted issuer topics updated successfully", then confirm the issuer's row appears in the **This system** tab with the source "System" and exactly the topic set you selected.
- If the toast reads "Still processing. Track progress in Actions.", follow the change in "Actions" instead of submitting it again. The table updates once the transaction confirms.
- To prove the trust chain end to end, issue a verification against one of the issuer's topics and run a transfer through the token's **Transfer pre-check** tab, as [Verify a participant](https://docs.settlemint.com/docs/console/participants/verify-a-participant) describes.

## Troubleshooting [#troubleshooting]

**The issuer address is rejected**

The address has no registered identity in the system. Register the participant and its identity first, on
[Users](https://docs.settlemint.com/docs/console/participants/users) or [Entities](https://docs.settlemint.com/docs/console/participants/entities), then add it here.

**No verification topics are selectable**

The picker stays disabled until you choose an issuer address, and it can only offer topics that exist. Select the
issuer first. If the list is empty, create the topic on [Verification
topics](https://docs.settlemint.com/docs/console/compliance/verification-topics) and return.

**A row shows Managed globally instead of a menu**

The entry is inherited from the global directory, and this screen cannot change directory entries. Ask a directory
administrator to adjust it. Your system-level rows stay editable.

**Review stays inactive on Edit topics**

The selected set matches the issuer's current topics, or is empty. Change the selection so it differs and keeps at
least one topic. To drop every topic, remove the issuer instead.

**The page shows no add button or row menus**

The line "Only a Verification policy manager can change the trusted issuers of this system." means your account lacks
the "Verification policy manager" role on this system. Ask someone with the Permission manager role to grant it, or
hand the change to someone who holds it.

## Frequently asked questions [#frequently-asked-questions]

### Can an issuer be trusted for one asset only?

Yes, when the token has its own trusted issuer registry, and not from this screen. A token without one uses the system and global issuers alone. The token's Governance role adds a token-level entry on that token's own trusted issuers screen, and that entry's claims count for that asset. Removing it leaves the inherited system and global trust intact. Use this screen when the issuer should count for the whole system.

### Why can I see the Global directory tab but not change it?

This screen never edits the directory. Unless you are a directory administrator, the tab shows the notice "You are viewing the global trusted issuers in read-only mode. Contact a directory administrator to make changes." instead of the table. A directory administrator can browse and search the directory per network, but the Console still offers no way to add, edit, or remove an entry there. A directory administrator changes the directory outside this screen, and every system inherits the result.

## API routes [#api-routes]

The trusted issuer endpoints in the [Platform API reference](https://docs.settlemint.com/docs/api-reference/v2) cover register, replace the topic set, add or remove one topic, and remove, for deployments that manage trust from code.