Legal Entity Identifier (LEI) - Global

Detects ISO 17442 Legal Entity Identifiers (LEIs) — the 20-character uppercase alphanumeric codes issued under the Global LEI System (GLEIF) that uniquely identify legal entities in financial transactions. Structure: characters 1-4 are the LEI-issuer (LOU) prefix, characters 5-6 are reserved and set to "00", characters 7-18 are the entity-specific part, and characters 19-20 are numeric check digits (ISO 7064 MOD 97-10). Requiring the literal "00" at positions 5-6 and two digits at positions 19-20 makes the format far more distinctive than a generic 20-character alphanumeric run. Known recall cost: pre-2013 CICI-era legacy LEIs — interim identifiers issued before the "00" reservation, grandfathered into the GLEIF system and still live and checksum-valid — do not carry "00" at positions 5-6 and are NOT matched. This class includes major counterparties such as Microsoft (INR2EJN1ERAN0W5ZP974), Deutsche Bank (7LTWFZYICNSX8D621K86) and Apple (HWUPKR0MPOU8FGXBT394), so documents dealing with such entities' LEIs will be missed. This is a deliberate precision-over-recall trade-off: dropping the "00" anchor would widen the pattern to any 20-character uppercase alphanumeric run ending in two digits.

Type: regex
Engine: boost_regex
Confidence: high
Confidence justification: High confidence: the fixed 20-character length, uppercase-only charset, reserved "00" at positions 5-6 and numeric check-digit pair at positions 19-20 make coincidental collisions rare; the evidence-gated 85 tier is the recommended workhorse. The 65 tier is discovery-only because the MOD 97-10 checksum cannot be enforced in the exported SIT, so a bare structural match is not confirmed to be an issued LEI. Recall is knowingly reduced by the "00" requirement: live, checksum-valid pre-2013 CICI-era legacy LEIs without "00" at positions 5-6 — including major counterparties such as Microsoft, Deutsche Bank and Apple — are structurally excluded, a deliberate precision choice documented in the description.
Jurisdictions: global
Regulations: MiFID II, EMIR, Dodd-Frank Act
Frameworks: ISO 27001, ISO 27701, SOC 2
Data categories: business-identifier, financial
Scope: narrow
Risk rating: 4
Platform compatibility: Purview: Compatible, GCP DLP: Unsupported, Macie: Unsupported, Zscaler: Compatible, Palo Alto: Unsupported, Netskope: Unsupported

Pattern

(?<![A-Za-z0-9])[A-Z0-9]{4}00[A-Z0-9]{12}\d{2}(?![A-Za-z0-9])

Corroborative evidence keywords

LEI, Legal Entity Identifier, GLEIF, ISO 17442, counterparty, legal entity, data record, database record, record set, data extract, data export, database table, spreadsheet, data registry, registry entry, master data, bulk export, data dump

Proximity: 300 characters

Should match

5493001KJTIIGC8Y1R12 — GLEIF's own published LEI — 5493 LOU prefix, "00" at positions 5-6, valid MOD 97-10 check digits
213800LBQA1Y9L22JB70 — Barclays PLC's published LEI (2138 LOU prefix), checksum-verified
529900T8BM49AURSDO55 — Structurally valid LEI under the 5299 LOU prefix with computed MOD 97-10 check digits

Should not match

HWUPKR0MPOU8FGXBT394 — Live checksum-valid pre-2013 CICI-era legacy LEI (Apple Inc.) without the reserved "00" at positions 5-6 — documented false-negative class, deliberately excluded
INR2EJN1ERAN0W5ZP974 — Live checksum-valid pre-2013 CICI-era legacy LEI (Microsoft Corporation), positions 5-6 are "EJ" — documented false-negative class, deliberately excluded
7LTWFZYICNSX8D621K86 — Live checksum-valid pre-2013 CICI-era legacy LEI (Deutsche Bank AG), positions 5-6 are "FZ" — documented false-negative class, deliberately excluded
5493001KJTIIGC8Y1R1 — Only 19 characters, one short of the fixed LEI length
5493001KJTIIGC8Y1RAB — Letters in positions 19-20, which must be the two numeric check digits
5493001kjtiigc8y1r12 — Lowercase — LEIs are uppercase-only (pattern is case-sensitive)
X5493001KJTIIGC8Y1R12 — 21 characters — the boundary guards reject LEIs embedded in longer alphanumeric runs

Known false positives

A 20-character uppercase serial/reference number that happens to carry "00" at positions 5-6 and two trailing digits can satisfy the structure; the MOD 97-10 checksum that would reject most such strings is not expressible as a regex and has no Purview validator function. Mitigation: Require LEI/GLEIF keywords within the proximity window for the reporting tier; keep the bare structural tier discovery-only. Downstream consumers can verify candidates against the GLEIF API for authoritative validation. The "00" positions 5-6 anchor is what keeps this collision surface small; its cost is the known false-negative class of pre-2013 non-"00" legacy LEIs (CICI-era registrations, including major counterparties such as Microsoft, Deutsche Bank and Apple) described in the pattern description.
Repeated-digit sentinels such as an all-zeros 20-character string satisfy the structure, and all-same-digit values pass any weighted-mod checksum (0 mod N = 0). Mitigation: AllDigitsSameFilter drops repeated-digit values before they can match.