The Identity tab of a participant shows the On-Chain Identity that regulated tokens check before a wallet may hold or receive them: whether it exists on the selected network, whether the organisation's identity registry has registered it, and which verifications it carries. Any user can open this tab for a participant they can work as. An identity manager also registers identities and recovers users who lost their wallet. On-Chain Identity explains the identity, its claims, the identity registry and trusted issuers.
A Participant is the platform's record of one person or organisation. A verification is a claim an issuer signed onto the identity, such as a know-your-customer result. Reading the Identity tab changes nothing.
The “My participants” detail page for an investor's participant.
The header marks the participant “Working now” and reads “Person”, “Present on this chain”, “Owner” and the number of accounts. The tabs are “Overview”, “Identity”, “Wallets” and “Holdings”, with “Identity” open. Its status card lists “Kind”, “Identity”, “Identity contract”, “Registration status”, “Verification status” and “Country / jurisdiction”. Below it, the “Chains” section explains that it shows the participant's identity on every network your organisation is connected to, and that an identity installed there is filed as a pending registration that your identity manager approves. The list of networks is masked in this capture.
Steps
Open the Identity tab
Select On-chain identity in the account menu. The Console opens the “Identity” tab of the participant you work as, or of your own participant when you work as no one else. Navigation describes the top bar.
Other links open the same tab. They include the “Complete verification” link on an offering's eligibility check, the “Open identity steps” button on a Wealth page before your identity is registered, and the Register action on the portfolio's “Identity not registered” notice. A link that came from another page shows a Back button that returns you there.
To open another participant's identity, select “My participants” in the account menu, open the participant, and select the Identity tab.
Read the status summary
The Status card describes the network selected in the account menu. The Identity row says whether the identity contract exists on that network: “Present on this chain” or “Not created on this chain”. The Registration status row says where the organisation's identity registry on that network stands:
Verification status counts the active verifications on the identity, or shows “No active verifications”. Country / jurisdiction shows the country the registration recorded, which compliance rules read.
The identity contract row of the Status card also offers View on explorer and “Show QR code”.
Check each network in the Chains list
The Chains list shows the participant's identity on each network the organisation is connected to, with the default network marked “Default”. Each row shows whether the identity is present and its registration status on that network.
When the identity is missing on a network, the row offers Install identity on this chain. Set up your identity on another network gives the steps.
Review the verifications
The Verifications section lists the active verifications on the identity, each with its topic. A verification that an issuer revokes leaves this list. A failed read shows “Failed to load verifications. Please try again.” rather than an empty list, so reload before you conclude that the identity has none.
The section also shows Issue verification. Only a user with the verification issuer role, the system role that issues verifications, can use it. For everyone else it is unavailable and shows the reason. Verify a participant covers issuing and revoking.
Set up your identity on another network
You set up an identity on a network other than the default from the Chains list or from the dashboard. Either way, an identity manager in your organisation accepts the registration from the “Pending participant registrations” panel, which Entities describes.
From the Chains list
- On the Identity tab, find the network's row in “Chains” and select “Install identity on this chain”.
- Verify your wallet in Confirm the identity install.
The install creates the identity, binds the wallet, and files a pending registration. The row reads “Installing identity…” until the install finishes. A failed install shows the error and offers Retry the identity install.
The platform checks the install only after you confirm it. It refuses the install when:
- the organisation is not connected to the network
- the participant's custody provider is not enabled there
- the participant holds no key managed by a custody provider to carry there
- the key is in self custody, so only the participant can sign
- the participant's smart wallet, an account contract that signers control, has more than one signer
After a refusal the button becomes unavailable, with a note that says why. When the platform refuses the install and the participant has its own account on that network, the row offers Create identity instead, and that account creates the identity.
From the dashboard
When your organisation uses more than one network and you switch to one that is not the default, the dashboard's Needs attention panel checks your identity there. It shows “Set up your identity on [network]” when you have no identity on that network, and “Finish registering on [network]” when the identity exists but is not registered.
- Select Register identity on the prompt.
- Verify your wallet in the Register identity dialog.
With no identity, the prompt creates one. With an identity that is not registered, it files a pending registration. The prompt does not appear on the default network. It does not appear on a Canton network either, which only a deployment that has switched Canton on offers.
Register, change or remove a registration
An identity manager registers an identity from the user's detail page under “Organisation participants”, then “Users”. When the user's wallet has no identity, the page offers “Create identity”. When the identity exists but is not registered, it offers Register identity, which asks for the country to record. Registering activates every wallet of the same owner that is not active yet, in one transaction. Users describes the detail page.
For a registered user, the identity card offers “Change country” and Remove registration. Removing a registration takes the wallet out of the identity registry, so the wallet can no longer receive tokens that check the registry. The identity contract and its verifications stay on the ledger.
Recover a user who lost their wallet
If you lost access to your wallet, ask an identity manager in your organisation to recover it. Afterwards you set up your sign-in and transaction PIN again on Security.
An identity manager recovers a user who lost access to their wallet, or whose wallet is compromised. The recovery gives the user a new wallet and a new identity and moves their tokens across.
Identity recovery is the “Recovery” protection group of the Administration approval family, and that group starts on. The identity manager who executes a recovery therefore needs a second person: another owner or administrator of the organisation approves the recovery, or a platform administrator does, and only then does the platform run it, as the identity manager who asked. The wizard reads “Waiting for a second person” until that decision. An owner who turns the “Recovery” group off in Approvals lets one identity manager recover a wallet alone, and so does an organisation that holds no owner or administrator besides the person recovering.
- Open “Organisation participants”, then “Users”, and open the user. Open the Verifications tab and note each verification and its issuer, so you can compare the list after the recovery.
- Open the “Security” tab. In the “Identity recovery” card, select Recover identity. The button is unavailable when the user has no wallet address.
- In the Validation step, check the user's name, email and “Lost wallet” address, the Identity status with the OnchainID address, the identity contract's address, and its status, and the Token balances that the recovery moves. The step reads “This identity can be recovered” or lists the blocking reasons. A recovery is blocked when the wallet is already marked lost, when the user has no identity contract, or when the identity has no registration at all. An identity whose registration is still pending can be recovered, and its status reads “Registration pending”. Select “Next”.
- In the Impact summary step, read the “Destructive operation” warning and the changes listed under “What will happen”. The list says “KYC claims will need re-verification”. That applies to verifications from issuers other than your organisation's own issuer, which the recovery does not carry across, and to any of your organisation's own verifications it cannot issue again. The Console does not list which verifications moved, so compare the new “Verifications” tab with the list you noted in step 1. Select “Next”.
- In the “Execute recovery” step, type “RECOVER IDENTITY” to confirm, select Execute recovery, and enter your transaction PIN or transaction code in “Verify your identity”. Nothing runs yet: the step reads “Waiting for a second person” until another owner or administrator of the organisation approves the recovery. Close the wizard and follow the approval on Actions. The recovery starts once it is approved.
The Identity recovery dialog with four steps, Validation, Review, Execute and Summary.
The Validation step shows User information with the name, email and lost wallet address, Identity status with the OnchainID address and its status, Token balances that the recovery moves, and whether the identity can be recovered, with any blocking reasons.
The Execute recovery step shows each stage as it runs: creating the new wallet, the new identity and the new smart wallet, authorising the smart wallet on the new identity, disabling the lost wallets, registering the new wallets in the identity registry, revoking sessions, and recovering tokens. When a recovery runs longer than the request, it continues in the background and the Console follows its status.
The recovery also reissues every verification that your organisation's own issuer identity signed on the lost identity. A verification from another issuer does not move, so ask each other issuer to reissue its verifications on the new identity. When mail delivery is configured, the user receives an email that an administrator recovered their wallet. Without mail delivery, tell the user yourself.
When the recovery finishes, the “Recovery complete” step shows the new wallet address, the new OnchainID address and the number of tokens recovered. A token that could not move is listed under “Tokens not recovered” with its reason, such as a paused token. Those positions stay on the lost wallet. A user with the custodian role on that asset recovers each one from the asset: open the asset, choose “Actions”, then Recover lost wallet.
Troubleshooting
The Identity tab says the identity is not available
The tab reads “Identity not available yet”. The participant has no identity on the network selected in the account menu. Install it from the Chains list on the same tab, or switch to a network where the “Chains” list shows it as present.
Install identity on this chain became unavailable after I confirmed
The platform refused the install, and the note under the button gives the reason. When the organisation is not connected to the network or the custody provider is not enabled there, an organisation owner connects the network or enables the custody provider first. When the participant's key is in self custody, the participant signs on that network itself.
Registration status stays at Pending approval
An identity manager has not accepted the registration yet. Ask an identity manager in your organisation to accept it from the Pending participant registrations panel on Entities.
Verification status shows no active verifications after I completed KYC
A know-your-customer submission becomes a verification only after a reviewer approves it and an issuer issues it. When the identity is registered, approving the submission also issues a Residence verification for the participant's country. A draft, a submission under review, or one sent back for changes adds nothing. Check your submission on Profile, and check that you opened the identity of the participant you submitted as.
The recovery stopped because the recovery attempts are exhausted
The message reads “Identity recovery attempts are exhausted; contact support.” The platform allows 16 recovery attempts for the same user on a network, and this user has used them all. Contact support.
The recovery stopped and cannot continue
The message starts with “Identity recovery cannot continue; contact support.” and ends with the reason the custody provider gave when it refused to open the replacement wallet. The first attempt ends as Recovery failed with that refusal, and every later attempt stops with this message and the same reason. Contact support with the reason.
The recovery was refused because the lost wallet's custody account is shared with another organisation
One organisation cannot recover a wallet on behalf of another. The organisation that shares the custody account handles the recovery.
The recovery was refused because the organisation has no claim issuer to issue its verifications again
The recovery reissues the organisation's own verifications on the new identity, so it needs the organisation's issuer identity. The message says the organisation has no operations binding, the record that links the organisation to the issuer identity that signs its verifications, or that the binding names no claim issuer. The recovery stops before it creates the new wallet. Contact support to configure the organisation's issuer, then run the recovery again.
On-chain identity in the account menu opens My participants instead
The Console could not resolve a participant for you, so it opens the participant list. Reload the page and select On-chain identity again. If the list opens again, check on My participants that you have a participant in this organisation.
Frequently asked questions
Does a revoked verification disappear from the identity?
It depends on who revoked it. The Identity tab lists only active verifications, so a revoked one leaves the list either way. A revoke by the issuer leaves the claim on the identity, marked revoked. A revoke made as the participant's own identity removes it, and its history shows “Verification removed”. On-Chain Identity explains how the ledger keeps that history.
Who else can see this identity?
A system manager, an identity manager or a verification issuer can read any identity in the organisation. A system manager is the role that sets up the platform, runs its upgrades and holds its core configuration. Other users read only the identities of the participant they work as. An identity manager or verification issuer sees the user's verifications on the user's detail page, which also shows revoked ones.
Are registration and verification the same thing?
No. Registration means the organisation's identity registry holds the wallet with its country. Verification means an issuer signed a claim onto the identity. The Console and Platform API issue a verification only to an identity the registry holds, and a token may require a registered wallet, specific verifications, or both.