ISO 25500-3:2026

• Abstract:

  This document specifies the requirements for formatting request types (verify, resolve, and search) and replies to those requests, in order to verify trading entity identity data with the authoritative source. The following are within the scope of this document: the syntax requirements and application protocol interface (API) for a request and response to a request for the verification of an international business identifiers (IBID) to verify trading entity identity data (verify); the syntax requirements and API for a request and reply to the request for resolution of an IBID or international business registration number (IBRN) to other data associated with the trading entity (resolve); the syntax requirements and API for a request and response to a request to search for an IBID, IBRN, or authoritative legal entity identifier (ALEI) given a legal name (search). The following are outside the scope of this document: the methods used for the resolution of IBIDs and IBRNs by the register that issued the ALEI.

• Status: Published
• Publication Date: 03-Nov-2026
• ICS: 35.240.63 - IT applications in trade
• Technical Committee: ISO/TC 184/SC 5 - Interoperability, integration, and architectures for enterprise systems and automation applications
• Drafting Committee: ISO/TC 184/SC 5 - Interoperability, integration, and architectures for enterprise systems and automation applications
• Current Stage: 6060 - International Standard published
• Start Date: 04-Nov-2026
• Completion Date: 04-Nov-2026

ISO 25500-3, published by ISO, is a standard for supply chain interoperability and integration that specifies how to verify a trading entity’s identity using machine-readable requests and replies for IBID, IBRN and ALEI data. It is aimed at systems, registers, buyers, suppliers and government bodies that need automated identity verification with an authoritative source.

What does ISO 25500-3 specify?

ISO 25500-3 specifies the request and response syntax, plus the application interface protocol (API), for verifying trading entity identity data with the authoritative source. It covers three exchange patterns: verify, resolve and search.

The document focuses on automated exchanges to a register identified by its ISO 8000-116 prefix. It excludes the methods used by the register to resolve IBIDs and IBRNs internally.

Annex	What it covers
Annex A	Document identification and the object identifier for open information systems

The document is organized into Scope, Normative references, Terms and definitions, Trading entity identity processes, Conformance, Annex A and Bibliography. Clause 4 is the technical core, and Clause 5 states how conformity is achieved.

What are the key requirements of ISO 25500-3?

ISO 25500-3 sets out the exact data that must appear in each request type, the allowed replies, and the format of the returned data. In practice, that means a system can send a standardized query to a register and interpret the response without relying on manual handling.

• Verify requests and replies - Clause 4.2

  • A verify request is sent to the register identified by its ISO 8000-116 prefix and includes the requester’s ISO 25500-3 formatted IBID, the respondent’s ISO 8000-116 prefix and the IBID to be checked.
  • The reply can report an IBID syntax error, an IBID data error, request denied, timed out, or IBID verified correct.
  • In practice, this is the fastest identity check when a system already knows the trading entity’s IBID.

• Resolve requests and replies - Clause 4.3

  • A resolve request uses the requester’s IBID, the respondent’s ISO 8000-116 prefix and the target IBID or IBRN.
  • The reply is sent in ISO 8000-114 interoperable data format (.idf) and can contain an error, denial, timeout or the requested data.
  • The note in 4.3.2 gives a recommended minimum dataset, including legal name, ALEI or IBRN, date of origin, legal status, citizenship type, jurisdiction of domestic registration, legal form and legal service address.

• Search requests and replies - Clause 4.4

  • A search request uses the requester’s IBID, the respondent’s ISO 8000-116 prefix and the trading entity’s legal name.
  • The reply can say the legal name was not found, or return an IBID, an IBRN with legal name, or an ALEI with legal name.
  • In practice, this supports look-up by name when the identifier is not yet known.

• Targeting the authoritative source

  • All three processes are sent to the register identified by its ISO 8000-116 prefix.
  • This matters because the request is routed to the body that holds the authoritative legal record for the jurisdiction.

• Conformance - Clause 5

  • Trading entity data verification conforms when the specified request and reply requirements in 4.2, 4.3 and 4.4 are applied.
  • This gives implementers a clear test for whether their exchange format matches the standard.

• Implementation context in the introduction

  • The introduction recommends the industrial internet, with callback security and a prefix name server (PNS), for exchange between verified parties.
  • In practice, this supports trusted automated exchange while keeping electronic address information confidential.

What terms does ISO 25500-3 define?

ISO 25500-3 uses the terms and definitions from ISO 25500-2. The following abbreviations are central to the document’s exchanges and reply formats.

• Authoritative Legal Entity Identifier (ALEI) - The authoritative identifier for a legal entity, issued by the governing body that maintains the legal record.
• International business registration number (IBRN) - The ISO 8000-116 formatted identifier created by adding a prefix to the local ALEI.
• International business identifier (IBID) - The ISO 25500-3 formatted string that combines the IBRN, legal name and date of origin for verification.
• Application interface protocol (API) - The exchange rules that define how requests and replies are structured and sent.
• Prefix name server (PNS) - A routing and visibility mechanism mentioned in the introduction for exchanging verified data through registered prefixes.
• Know your customer (KYC) - A supply chain use case mentioned in the introduction for verifying legal identity.
• Know your supplier (KYS) - A supply chain use case mentioned in the introduction for verifying the identity of suppliers.

Who uses ISO 25500-3?

ISO 25500-3 is used by buyers, suppliers, business registers and government agencies that need to verify legal trading entities. It is also relevant to system developers and data exchange implementers who build automated interfaces for identity verification, resolution and search.

The introduction links it to supply chain operations such as planning, sourcing, making, delivering and returning. It also fits regular verification work, including domestic and foreign registration checks and large-scale validation of many entities.

Which standards are used with ISO 25500-3?

Standard	What it contributes
ISO 8000-114	The interoperable data format used for the data reply in resolve exchanges
ISO 8000-116	The formatting of authoritative legal entity identifiers and the register prefix used in requests
ISO 25500-2	The vocabulary used for the terms and definitions in this part
ISO 25500-1	Recommended in the introduction for the industrial internet context
ISO 25500-100	Recommended in the introduction for supply chain data verification context
ISO/IEC 8824-1	Cited for the ASN.1 basis of the document identifier in Annex A
ISO 10303-1	Gives the meaning of the Annex A object identifier

What does the ISO 25500-3 document contain?

ISO 25500-3 contains the technical wording for three request types and their replies: verify, resolve and search. It gives the fields that belong in each request, the permitted response outcomes and the data format used for returned entity information.

It also includes a note that recommends a minimum dataset for resolved entity data. Annex A provides the document identification object identifier for open information systems, which helps with unambiguous machine identification of the standard.

International
Standard
ISO 25500-3
First edition
Supply chain interoperability and
2026-11
integration —
Part 3:
Verification of trading entity
identity
Interopérabilité et intégration dans la chaîne
d'approvisionnement —
Partie 3: Vérification de l'identité de l'entité commerciale
Reference number
© ISO 2026
All rights reserved.
This ISO publication is protected by copyright and is owned by ISO and/or its licensors.
The content of this ISO publication is provided under licence, not sold. Use is subject to the applicable licence terms issued by ISO,
an ISO member body, or an authorized third-party distributor.
Except as required for implementation or expressly permitted by a separate licence, no part of this ISO publication may be
reproduced, distributed, modified, used, or made available in any form or by any means – electronic or mechanical, including
photocopying, scanning, recording, or posting on internal or external digital platforms.
Any use beyond the scope of the granted rights is prohibited and may result in legal action.
ISO copyright office
CP 401 • CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland
ii
Contents Page
Foreword .iv
Introduction .v
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Trading entity identity: verification, resolution, and search processes . 2
4.1 General .2
4.2 Verify: Request and reply for IBID verification .2
4.2.1 Request for IBID verification .2
4.2.2 Reply to request for IBID verification .2
4.3 Resolve: Request and reply to the request for resolution of an IBID or IBRN to other
data associated with the trading entity .2
4.3.1 Request for IBID or IBRN resolution .2
4.3.2 Reply to request for IBID or IBRN resolution .3
4.4 Search: Request and reply for IBID or IBRN or ALEI search through legal name .3
4.4.1 Request for IBID, IBRN, or ALEI through legal name search .3
4.4.2 Reply to request for IBID, IBRN, or ALEI through legal name search .3
5 Conformance . 3
Annex A (informative) Document identification . 4
Bibliography . 5

iii
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out through
ISO technical committees. Each member body interested in a subject for which a technical committee
has been established has the right to be represented on that committee. International organizations,
governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely
with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types
of ISO documents should be noted. This document was drafted in accordance with the editorial rules of the
ISO/IEC Directives, Part 2 (see www.iso.org/directives).
ISO draws attention to the possibility that the implementation of this document may involve the use of (a)
patent(s). ISO takes no position concerning the evidence, validity or applicability of any claimed patent
rights in respect thereof. As of the date of publication of this document, ISO had not received notice of (a)
patent(s) which may be required to implement this document. However, implementers are cautioned that
this may not represent the latest information, which may be obtained from the patent database available at
www.iso.org/patents. ISO shall not be held responsible for identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions
related to conformity assessment, as well as information about ISO’s adherence to the World Trade
Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www.iso.org/iso/foreword.html.
This document was prepared by Technical Committee ISO/TC 184, Automation systems and integration,
Subcommittee SC 5, Interoperability, integration, and architectures for enterprise systems and automation
applications.
A list of all parts in the ISO 25500 series can be found on the ISO website.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www.iso.org/members.html.

iv
Introduction
The effectiveness, efficiency, and security of a supply chain can be increased through standardization to
create greater interoperability and integration across applications, facilities, companies, and borders.
At each step of the supply chain from planning, sourcing, making, delivering, and returning, buyers and
suppliers need a standardized way to quickly identify and verify legal trading entities to limit corporate
identity theft and potentially fraudulent transactions.
A legal entity is created when it is formally recognized by the governing body of a nation, state or community
that has the authority to set and enforce laws relating to property and trade. The most common way for a
business to obtain legal status is through registration of its legal name in an authoritative business register.
The business register creates a record and assigns a local record number; this is the authoritative legal entity
identifier (ALEI). A business formed in one jurisdiction can also be required to register as a legal entity in
another jurisdiction where it regularly conducts business, which is called a foreign registration (as opposed
to domestic registration). Some legal entities, like government agencies, are typically formed through legal
actions such as proclamations, regulations, and acts and are not typically referred to by an identifier within
those acts. Thus, a government agency’s legal name is its ALEI.
Some legal entities attain proxy identifiers (identifiers issued by an organization that is not the originator
of the legal entity or object identified) through various sources and, unlike ALEI issuers that follow legal
requirements for assigning identifiers and granting access to the datasets they represent, there are no
requirements for proxy identifier issuers for the assignment of and access to the proxy legal entity identifiers
(or the datasets they represent) that they control. However, every legal entity has a government issued,
verifiable authoritative identifier, an ALEI, issued at its formation by the governing body under which it was
created and that maintains its legal existence; this governing body is the authoritative source of data on
that legal entity. As part of the supply chain meeting know your customer (KYC) and know your supplier
(KYS) demands, each legal entity can be verified with the authoritative source. This verification is typically
done by either searching authoritative source’s online database, with its own structure and terminology, or
asking (via phone call, email, fax, or postal mail) an employee of the governing body to search its paper or
electronic documents to verify the entity’s details. These methods are not suited for automated processing
and add time and cost to the verification process, especially for
...