A Legal Entity Identifier is a 20-character code defined by ISO 17442: 18 characters identifying the entity, then two check digits. The checksum is MOD 97-10 from ISO/IEC 7064 — map letters A–Z to 10–35, read the whole 20 characters as one integer, divide by 97, and a valid LEI leaves a remainder of exactly 1. That makes a mistyped or transposed identifier detectable arithmetically, with no lookup and no network call, which is why regulators run the check before accepting a filing.
What an LEI is
A Legal Entity Identifier (LEI) is a 20-character code that uniquely identifies a legal entity in financial transactions, issued under the Global LEI System. The first 18 characters identify the entity; the final two are check digits. Those two digits exist for one reason: to make a mistyped or transposed identifier detectable without looking anything up.
The format is fixed: 18 alphanumeric characters followed by 2 digits, defined by the ISO 17442 standard. If a value doesn't match that shape, it isn't a well-formed LEI — before you even reach the checksum.
The MOD 97-10 checksum
LEIs use MOD 97-10, the check-digit scheme from ISO/IEC 7064 — the same maths that validates an IBAN bank account number. The rule is elegant: treat the whole 20-character string as one very large integer (mapping letters A–Z to 10–35), divide by 97, and the remainder must equal 1. If it's anything else, the identifier is wrong.
Take the 18-character prefix and append 00, convert every letter to a number (A=10 … Z=35), read the result as one integer, take it modulo 97, and the check digits are 98 − remainder. To verify an existing LEI, run the full 20 characters through the same conversion and confirm the integer mod 97 equals 1. A single wrong character almost always breaks that equality — which is exactly the point.
Because a 20-character LEI expands to a ~38-digit integer, a correct implementation reduces it step by step (remainder = (remainder × 10 + next) mod 97) rather than trying to hold the whole number at once. Get that detail wrong and large LEIs silently mis-validate — one of the subtler bugs in home-grown checkers.
Why it matters for DORA
The DORA Register of Information identifies every entity — your own, your providers, and their ultimate parents — by LEI. A register carrying an LEI that fails its checksum is carrying a provably wrong identifier, and that is exactly the kind of defect a supervisor's validation catches on submission. Worse, a wrong-but-well-formed LEI can point at the wrong company entirely, quietly misstating who sits behind a critical service.
The checksum only proves an LEI is internally consistent. It does not prove the LEI is issued and active — for that you check it against the GLEIF register. Both matter: the checksum catches typos instantly and offline; the lookup catches a well-formed code that was never issued or has lapsed.
Checking LEIs at scale
One LEI is easy to check by hand. A register with hundreds of arrangements, each naming a provider and a parent, is not — and that's where errors hide. Qgentic DORA runs the ISO 17442 checksum on every identifier as it assembles the register, flags any that fail, and — where your procurement master data holds the correct value — repairs the broken one and records the correction in the audit trail. You can watch it catch and repair a deliberately broken LEI in the live demo.
Qgentic validates every identifier in your register automatically, and repairs a broken one from your master data.
See the DORA platform Try the live demo