A company has always acted through other people, the people it employs, and now the agents it deploys. Global FinReg and Concordium turn an existing Legal Entity Identifier (LEI) into a verified, on-chain corporate identity, then extend that same accountability to everyone and everything acting in the company's name.
Businesses act online through websites, wallets, platforms and automated systems, but those digital touchpoints do not necessarily prove if a legal entity is responsible for them. A counterparty needs to know that an action was authorised by a real company and that the company remains answerable for the outcome. That link has to exist before an order is placed, a contract is accepted or money changes hands. Once something goes wrong, a wallet address or activity log cannot create accountability that was never established.
A Company Only Ever Acts through Somebody Else
A limited company cannot sign anything. It has no hands. Every contract it enters and every payment it authorises is carried out by someone given authority to act on its behalf, and commerce spent centuries building the paperwork that proves it: board resolutions, signing authority, delegated spending limits. Slow, and rarely on display, but it means that when something goes wrong there is a documented line back to the legal entity that answers for it.
An AI agent settling an invoice for a company is doing what a junior employee with a corporate card does. The difference is that nothing about the agent tells you which company it acts for, or whether it was authorised at all. Reputation scores do not close that gap. They describe how an agent behaved before, not whether anybody carries the consequences of what it does next.
ERC-8004 shows the gap. It gives AI agents an on-chain anchor: a registry entry, metadata, discoverability. What it does not carry is a verified connection between the agent and the business that authorised it.
Super Fast Corporate Verification Process
Corporate verification is normally a waiting game. Submit the documents, wait for someone to read them, and then wait for a decision. At most, this process takes a couple of days, while for a company whose paperwork is already in order, it is a matter of minutes.
The reason behind the speedy process is the LEI. A Legal Entity Identifier is a twenty-character code that identifies a company to regulators and counterparties anywhere in the world. Since January 2018, EU investment firms have generally needed an LEI from their legal-entity clients before executing transactions covered by MiFIR reporting rules. Getting one means having the company's reference data verified against official registers, including ownership relationships where those are recorded, which is a large part of the work a corporate identity requires.
Global FinReg is a global LEI specialist and the Identity Provider (IDP) for corporate identity on Concordium. As such, Global FinReg can turn the LEI directly into a verified on-chain identity, with no second verification process in between.
Global FinReg describes three different scenarios for companies:
- If a company’s LEI code is already with Global FinReg, it will receive a Concordium corporate identity immediately.
- If a company does not have a LEI code, a LEI can be issued in as little as one hour, and the identity verification can be done immediately afterwards.
- If a company’s LEI is with a different provider, it can be moved to Global FinReg in a matter of 3-5 days, after which time the identity verification can be completed.
For a business that does not need a LEI code, you can still apply for an identity. Global FinReg reviews the registration documents, confirms the beneficial owners or the people authorised to act for the company, and verifies their personal identification. This makes the turnaround time for an identity verification roughly twelve hours.
In comparison, a full corporate onboarding at a bank usually takes 90 to 120 days.
The whole process starts inside the wallet rather than on a website. Companies can use Concordium’s own wallet or supported third-party wallets and custody infrastructure, such as Bitcoin.com, Ledger and Dfns. The service is available globally..
"Since the LEI code has already verified what a corporate identity has to establish: namely which legal entity it is and verified it against official registers, a company does not need to conduct a second verification. Once the company has been verified, the same identity can cover its employees, as well as the AI agents acting on its behalf."
David Silverman, Founder, Global FinReg
None of the KYB paperwork goes on-chain. Personal data will never appear on the chain in any form, encrypted or otherwise, and stays offline with the Identity Provider. The chain only carries identity disclosure data, which no single party can decrypt on its own. The Identity Provider knows which company it verified, but not what that company does on-chain.
What the Company Passes Down
Once a corporate identity exists, it stops being a single credential and becomes something the company can build on. Employees and AI agents carry proof that the company authorised them, anchored to its verified corporate identity. The company does not repeat the whole verification for every AI agent, but each agent still gets its own registration, its own key binding and its own permissions. What is saved is the work of proving the company. What still has to be recorded is the delegation.
That is where the speed stops being a convenience and starts being the architecture. A business can spin up thousand agents in an afternoon, and an identity model needing a human reviewer for each one does not survive contact with that. Corporate identity is what makes that safe to do. A company can hand an agent real authority, a spending limit, a contracting right, a permission to act, because that authority now traces back to a legal entity that answers for it. The agent gets to act. The company still carries the risk. That trade is what corporate identity is actually for.
One where the expensive verification happens once, at the level of the legal entity, does.
Part of this is running. The Concordium Agent Registry went live in May 2026, and an agent operating on Ethereum or another chain can carry a Verified by Concordium Badge back to its owner without migrating. Part of it is ahead: the Agent IDP is still to come, and extending a corporate identity to employees and AI agents in bulk is targeted later this year.
Why Registering the Agent Is the Moment That Counts
Accountability, as most organisations experience it, is forensic. Something goes wrong, and an investigation works backwards through logs and invoices until it arrives at a name. That takes weeks, and sometimes it arrives nowhere at all, which is what happens every time an on-chain exploit ends with an address and no person attached to it.
Registering an agent on the Concordium Agent Registry works the other way round. Every agent in the registry is owned by a Concordium account, and every Concordium account carries a verified identity from the moment it is created. Without one behind it, an agent cannot enter the registry as a verified agent at all. The question of who answers for what the agent does is therefore settled before it does anything, rather than after something has gone wrong.
That answer is not on public display. It sits encrypted, split across independent parties, and reachable only through the Identity Disclosure Process, which begins with a court order. What changes is not that you can see the owner. It is that there is an owner to reach. The counterparty is not taking a view on a piece of software, but dealing with a company that has put its own verified identity behind everything that software does.
The practical shape of this is delegation, and the boundaries are what make it possible rather than what holds it back. The identity behind the agents is the company's, not the individual's, and it carries an envelope: what may be spent, what may be approved, which jurisdictions it can sign in. An employee already works inside that envelope, an agent they create works inside it too, and so does the next hundred. The company's reach extends, the envelope does not. What a team could authorise in a day, a fleet can execute in parallel, with every action inside the same limits and traceable to the company that stands behind it.
That envelope is only partly machinery today. Registration records the agent and the verified account behind it, and CIS-8, Concordium's key-linking standard, links the external keys that sign for it. The credentials describing what an agent is permitted to do, its limits and the jurisdictions it may operate in, arrive with the Agent IDP, which is not live yet. None of it is a log of what the agent actually did, and none of it bounds the damage an agent can cause.
That will be the job of Protocol-Level Locks (PLLs), where the limits on what can move are set when the lock is created, so a verified but compromised agent cannot move value beyond them.
One Identity Layer, Two Kinds of Actor
Concordium built this in order, and the order is the argument. Verified humans came first, payments came second, and corporate identity extends the same design to the legal entities that employ people and now deploy software. It remains the only blockchain where verified humans and verified AI agents operate on the same identity layer.
A company can prove who it is in days rather than months, and it will shortly pass that proof down to everything acting in its name. Which leaves the harder question. Registration establishes who stands behind an agent. What that agent was permitted to do, and then what it actually did, are separate problems needing separate mechanisms, and both are being built.
The agents that get the most latitude won't be the ones with the fewest checks. They'll be the ones whose checks are already done.
Join the Concordium Community, follow us on X.