Information integrity 

The governance of the LDTF MUST comprise the functions described below. A person or organisation MAY perform more than one function where responsibilities, decision-making authority and conflicts of interest are documented and appropriately managed. Framework Administration and Compliance and Assurance MUST have sufficient capacity for initial onboarding and continuing oversight, whether delivered internally, externally or through a combination. 

​

Governing Authority 

​

The Governing Authority is accountable for the overall governance and strategic direction of the LDTF. 

The Governing Authority MUST: 

• Approve the LDTF and material changes to it; 

• Establish the strategic direction and governance principles of the LDTF; 

• Approve the establishment, mandate and delegated authority of governance functions; 

• Oversee the performance and effectiveness of the LDTF; 

• Consider significant risks affecting the LDTF or Next Gen NLIS ecosystem; 

• Resolve matters escalated beyond the authority of delegated functions; 

• Oversee material compliance, assurance and Participant matters requiring strategic intervention; 

• Monitor relevant legal, regulatory, technological and market developments and consider their implications for the LDTF. 

• Ensure that the governance arrangements remain appropriate as the ecosystem develops. 

Policy and Standards function 

​

The Policy and Standards function MUST oversee the development and maintenance of LDTF Policy, Rules, standards and associated requirements. 

​

Within its delegated authority, the Policy and Standards function MUST: 

• Consider proposed changes to requirements; 

• Assess the impact of proposed changes upon Participants and the Next Gen NLIS ecosystem; 

• Maintain alignment between LDTF requirements, applicable standards, contractual arrangements and relevant legal or regulatory requirements; 

• Determine where specialist or stakeholder consultation is required; 

• Make decisions within its delegated authority; and 

• Submit material changes or matters outside its delegated authority to the Governing Authority for approval. 

Compliance and Assurance function 

​

The Compliance and Assurance function MUST oversee Participant conformity with applicable LDTF requirements. 

The Compliance and Assurance function MUST have sufficient independence from Framework Administration to provide objective assurance. 

​

The Compliance and Assurance function MUST: 

• Establish or apply the assurance requirements applicable to Participants; 

• Oversee certification, accreditation or other conformity assessment processes established under the LDTF; 

• Consider evidence of Participant compliance; 

• Oversee periodic or event-driven assurance activities; 

• Identify and report material non-conformities; 

• Require or recommend remediation where appropriate; 

• Escalate material or persistent non-compliance in accordance with the governance and compliance procedures; and 

• Provide assurance information to the Governing Authority necessary for effective oversight. 

Where independent third parties undertake assessment, audit or certification activities, their role, competence, independence, authority and reporting obligations MUST be defined. 

​

Framework Administration function 

​

The Framework Administration function MUST be responsible for the day-to-day administration of the LDTF. 

​

Within its delegated authority, the Framework Administration function MUST: 

• Administer Participant onboarding and lifecycle processes; 

• Maintain authoritative records of Participants, roles, status and relevant authorisations; 

• Maintain the Trust Registry or equivalent authoritative Participant record; 

• Administer LDTF documentation and approved changes; 

• Coordinate operational communications with Participants; 

• Maintain governance and administrative records; 

• Provide information required by other governance functions; 

• Administer routine compliance and Participant management activities within its delegated authority; and 

• Escalate matters requiring policy, assurance or strategic decisions to the function with the appropriate authority. 

Framework Administration MUST NOT make policy, assurance or enforcement decisions outside its documented delegated authority. 

​

Decision-making and delegation 

​

Each governance function MUST have a documented mandate defining its responsibilities, decision-making authority, accountability, reporting obligations and escalation routes. Where a committee or panel performs the function, its terms of reference MUST also address membership, chairing, quorum and decision-making arrangements. 

​

Governance decisions MUST be made at the lowest level possessing the necessary delegated authority. 

​

Matters MUST be escalated where they: 

• Exceed delegated authority; 

• Would result in a material change to the LDTF; 

• Materially affect Participant rights or obligations; 

• Create significant legal, operational, financial or reputational risk; 

• Involve significant or systemic non-compliance; or 

• Cannot be resolved through the applicable governance process. 

​

The Governing Authority MUST maintain a record of material delegations of authority. 

​

Governance records and transparency 

​

Material governance decisions MUST be recorded with sufficient information to establish the decision, the function or authority making it, the date and, where appropriate, the basis for it. 

​

Governance records MUST be retained for an appropriate period and made available to authorised governance, assurance or audit functions where required. 

​

Participants MUST be informed of governance decisions that materially affect their obligations, participation status or operation within the LDTF. 

​

Review of governance arrangements 

​

The Governing Authority MUST periodically review the effectiveness of the LDTF governance arrangements. 

​

A review MUST also be undertaken where there is a material change to the Next Gen NLIS ecosystem, operating model, applicable law or regulation, Participant population, technology or risk environment that could materially affect the suitability of the governance arrangements. 

​

Changes resulting from such reviews MUST be managed through the LDTF change management process administered by Framework Administration. 

​

Governance functions 

​

Each governance function MUST have a documented mandate appropriate to its purpose and the risks of the decisions it makes. A function MAY be carried out by an individual, a team, an external provider or a collective arrangement. 

​

Mandate and delegation 

​

The mandate MUST define the function’s purpose, responsibilities, accountable authority, delegated powers, reporting and escalation arrangements, competence requirements and arrangements for review. A function MUST operate within its mandate. 

​

The Governing Authority MUST retain accountability for delegated functions. Assignment to an external provider MUST specify its duties, authority, access to information, reporting obligations and oversight arrangements. 

​

Competence and representation 

​

Those carrying out a function MUST possess, or have access to, the expertise needed for its responsibilities. Relevant Participants, trade bodies, professional organisations, public authorities, regulators, industry representatives and subject matter experts MAY provide input where this supports effective governance. 

​

A Participant MAY nominate a supplier or other representative to fulfil an agreed representative role, but MUST remain accountable for that role and ensure the representative is bound by applicable governance obligations.

Governance arrangements MUST provide a means for matters arising within a delegated function to be reported to the function responsible for its oversight and for relevant expertise to inform decisions at that level. A person MAY carry out responsibilities across functions where appropriate, subject to documented authority and management of conflicts.

Conflicts of interest 

​

Persons carrying out governance functions MUST declare actual, potential or perceived conflicts of interest relevant to matters under consideration. The responsible function MUST record and manage those conflicts. A person whose conflict could reasonably affect an objective decision MUST NOT take part in that decision unless the applicable arrangements permit it and suitable controls are in place. 

​

Processes and decisions 

​

Each function MUST maintain proportionate processes for receiving and considering matters, assigning responsibility, obtaining evidence and advice, making decisions within delegated authority, recording material reasons and actions, communicating outcomes, contributing to the LDTF risk register and escalating matters beyond its authority. 

​

Where a collective arrangement carries out a function, its terms of reference MUST specify membership, chairing, quorum, voting or consensus arrangements, substitutes and decisions outside scheduled meetings. These requirements apply only where relevant to the form in which the function is performed. 

​

A decision MUST be made only by a function or person possessing the necessary authority. Material decisions MUST identify the authority exercised and any resulting actions. 

​

Specialist and stakeholder advice 

​

The Governing Authority or a function with expressly delegated authority MAY establish a specialist advisory arrangement where stakeholder, technical, legal or operational input is required. This may take the form of a time-limited consultation, forum, panel or another suitable advisory arrangement. 

​

A request for such an arrangement MUST set out its purpose, scope, participants, expected outputs, reporting route and anticipated duration. Its establishment MUST be approved by the Governing Authority or a function to which it has expressly delegated that authority. Framework Administration MUST maintain a record of approved arrangements. 

​

Unless expressly delegated decision-making authority, an advisory arrangement MUST NOT create or change binding LDTF requirements, determine Participant status or exercise powers reserved to another function. Its recommendations MUST be referred to the function with authority to decide the matter. 

​

Governance function records and reporting 

​

Each function MUST maintain sufficient records to demonstrate the exercise of its responsibilities, including, where applicable, appointments, conflicts, matters considered, decisions, recommendations, actions and escalations. 

​

A delegated function MUST report to its accountable authority at a frequency and level of detail appropriate to its mandate. Material risks, unresolved matters and decisions outside its delegated authority MUST be reported without undue delay. 

​

Review 

​

Governance functions MUST be reviewed periodically, normally at least annually, to determine whether their mandate, resourcing, delegated authority and operating arrangements remain appropriate. Changes to delegated authority MUST be approved by the authority empowered to make them. 

Compliance obligations and assessment 

All Participants in the LDTF MUST be subject to appropriate compliance and audit arrangements to provide assurance that they continue to meet the requirements applicable to their participation in the LDTF. 

​

Compliance MUST be assessed against the requirements applicable to the Participant, including, as relevant: 

1. LDTF Rules; 

2. Participant and role-specific requirements; 

3. User agreements and their schedules, operating agreements and other contractual obligations associated with participation in the LDTF; 

4. Applicable technical, security, operational and assurance requirements; 

5. Applicable legal and regulatory requirements; and 

6. Any other binding instruments, conditions or obligations established under or recognised by the LDTF. 

​

The requirements applicable to a Participant MUST be determined by its role, the services or functions it performs, the information it accesses, provides or processes, and any additional obligations arising from its participation in the LDTF. 

​

Compliance with the LDTF is an ongoing obligation and MUST NOT be treated solely as a condition of initial onboarding or approval. 

​

Participants MUST maintain sufficient records and evidence to demonstrate their compliance with applicable requirements and MUST make such evidence available for authorised compliance, assurance and audit activities. 

​

The Governing Authority MUST establish and maintain arrangements for monitoring and assessing Participant compliance with the LDTF. 

​

Compliance activities MUST be proportionate to the Participant's role, the nature and significance of the services it provides, the information it handles and the risks associated with its participation. 

​

Compliance MAY be assessed through one or more mechanisms, including: 

1. Participant attestations or declarations; 

2. Review of compliance records and evidence; 

3. Periodic or risk-based assessments; 

4. Monitoring of operational performance or compliance indicators; 

5. Investigation of incidents, complaints or suspected non-compliance; 

6. Other assurance activities considered appropriate under the LDTF; and 

7. Independent certifications or assurance reports. 

​

The nature, scope and frequency of compliance activities MAY differ between Participant roles and MAY be adjusted in response to changes in risk, services, performance or compliance history. 

​

Recognition of other compliance and assurance regimes 

​

The LDTF MAY recognise compliance, certification, accreditation or assurance obtained under other recognised schemes, standards or regulatory regimes where these are relevant to demonstrating a Participant's compliance with the LDTF or associated instruments. Such regimes MAY include, but are not limited to: 

​

• Cyber Essentials or Cyber Essentials Plus (cyber security controls and protection against common cyber threats); 

• ISO/IEC 27001 (information security management); 

• ISO 9001 (quality management); 

• ISO 22301 (business continuity management); 

• ISO/IEC 20000-1 (IT service management); 

• ISO/IEC 27701 (privacy information management); and 

• Other recognised industry, professional or regulatory assurance schemes relevant to the Participant's role or activities. 

​

Recognition of such evidence MUST be proportionate to its relevance, scope, currency and level of assurance and MUST NOT, by itself, be taken as evidence of compliance with LDTF requirements that fall outside the scope of the applicable scheme, standard or assurance activity. 

​

Other equivalent international, national or industry standards MAY be accepted where the Compliance and Assurance function determines that they provide an appropriate and equivalent level of assurance for the applicable LDTF requirements. 

​

Third-party and subcontracted services 

​

Where a Participant relies upon a third party or subcontractor to perform a function, provide a service, operate a system or process, store or otherwise handle information that is subject to LDTF requirements, the applicable LDTF requirements MUST extend to those activities. 

​

The Participant MUST ensure that the third party or subcontractor meets the compliance, security, assurance, audit and other LDTF requirements applicable to the functions, services, systems or information for which the third party or subcontractor is responsible. 

​

The Participant MUST ensure that the requirements applicable to a third party or subcontractor are covered by its contractual or other binding arrangements. Existing arrangements MAY be relied upon where sufficient; any gap MUST be addressed through an appropriate variation or other binding measure. The arrangements MUST include rights to obtain evidence of compliance and support authorised assurance activity where required. 

​

The use of a third party or subcontractor MUST NOT transfer or diminish the Participant's accountability for compliance with the LDTF. 

​

Where a third party or subcontractor performs a key function or handles information material to the operation or security of the LDTF, the Compliance and Assurance function MAY require direct evidence of compliance, independent assurance or audit of that third party or subcontractor. 

​

Where a third party or subcontractor provides equivalent functions or services to more than one Participant, evidence of compliance or assurance already established against defined LDTF requirements MAY be recognised and reused. The third party or subcontractor SHOULD NOT be required to repeat equivalent assurance activities for each Participant where the existing assurance remains current, valid and applicable to the functions or services being provided. 

​

Reuse of such assurance MUST be limited to the requirements, functions, services and operating arrangements within its assessed scope. Each Participant MUST demonstrate that its use of the third party or subcontractor falls within that scope and MUST address any Participant-specific arrangements, configurations, integrations, responsibilities or risks that are not covered by the existing assurance. 

​

The Participant MUST notify Framework Administration of a material change to a third party or subcontractor, the assured service, systems or operating arrangements that could affect compliance. The Compliance and Assurance function MUST determine whether existing assurance remains sufficient or proportionate further evidence or assessment is required. 

​

Where permitted by the LDTF, a third party or subcontractor that has demonstrated compliance with defined requirements MAY be authorised to use a distinct Trust Mark appropriate to the scope of its assurance. Such use MUST NOT imply that the third party is an LDTF Participant unless separately authorised as one. 

​

Changes to recognised compliance or assurance status 

​

Where a Participant relies upon certification, accreditation, compliance or assurance under a third-party regime as evidence of its compliance with the LDTF or associated instruments, the Participant MUST notify the Compliance and Assurance function as soon as reasonably practicable where that certification, accreditation, compliance or assurance is withdrawn, suspended, expires without renewal, becomes subject to a material qualification or restriction, or otherwise ceases to provide the assurance previously relied upon. 

​

The Participant MUST provide sufficient information to enable the impact upon its LDTF compliance to be assessed and MUST cooperate with any resulting compliance or assurance activity. 

​

A change in third-party compliance or assurance status MUST be assessed to determine whether the Participant continues to meet the applicable LDTF requirements and whether remediation, additional assurance, restrictions or other action is required. 

​

Periodic assessment and audit 

​

Participants MUST cooperate with periodic or risk-based assessments and audits authorised under the LDTF and MUST provide reasonable access to relevant information, records, evidence, systems and personnel in accordance with the applicable arrangements. 

​

The scope of an audit MUST be defined and MUST relate to requirements applicable to the Participant under the LDTF or associated binding instruments. 

​

Audits MAY be undertaken by the Compliance and Assurance function, an appropriately authorised third party, or another authorised function to undertake the audit. 

​

Persons or organisations undertaking audits MUST have appropriate competence and MUST be sufficiently independent of the activities being assessed to provide objective findings. 

​

Where existing independent certification, audit or other assurance provides sufficient evidence of compliance with an LDTF requirement, the LDTF MAY recognise that evidence in place of undertaking duplicative assurance activity. 

​

Such recognition MUST be based on an approved assurance profile or other documented assessment that identifies the external certification, audit or assurance scheme, the LDTF requirements against which it may be recognised, the scope and conditions of recognition, and any additional evidence or assessment required. 

​

The LDTF MUST define the evidence required to demonstrate that the recognised certification, audit or assurance remains valid and applicable to the Participant and the activities within scope. 

​

Non-compliance 

​

Where a compliance or audit activity identifies actual or suspected non-compliance, the finding MUST be recorded and assessed in accordance with the applicable compliance process. 

​

The Participant MUST be informed of material findings affecting its compliance status and, where appropriate, provided with an opportunity to respond and provide additional evidence. 

​

The Participant MUST address identified non-compliance within any period specified by the applicable governance or assurance process. 

​

The response to non-compliance MUST be proportionate to its nature, severity, duration and potential impact upon the LDTF, other Participants, relying parties or the integrity of the ecosystem. 

​

Material, persistent or systemic non-compliance MUST be escalated to the function possessing the appropriate authority. 

​

Non-compliance MAY result in corrective or remedial action, increased monitoring or assurance, restrictions upon participation, suspension or termination, in accordance with the applicable LDTF Rules and contractual or other binding arrangements. 

​

Compliance records and reporting 

​

Compliance and audit activities MUST be appropriately documented. 

​

Records MUST include, as applicable, the scope and basis of the assessment, evidence considered, findings, identified non-compliance, required remediation, decisions made and closure of resulting actions. 

​

Material compliance issues MUST be reported to the function with appropriate authority in accordance with the governance and escalation arrangements established under the LDTF. 

​

Compliance records MUST be retained for an appropriate period and MUST be available to authorised governance, assurance and audit functions where required. 

Certification and assurance 

The LDTF MUST define the method by which compliance with applicable requirements is demonstrated and assessed for each Participant role and requirement. 

​

The method of assurance MUST be proportionate to the nature of the Participant's role, the services and information for which it is responsible, the potential impact of non-compliance and the level of risk presented to the LDTF and its Participants. 

Compliance and assurance methods MAY include: 

​

• Self-assessment or self-declaration against defined LDTF requirements; 

• Submission and review of documentary evidence; 

• Recognition of relevant existing certification, accreditation or other independent assurance; 

• Assessment or audit undertaken by the Framework Administration or Compliance and Assurance function; 

• Assessment, audit or certification undertaken by an appropriately qualified independent assurance body; 

• Periodic assessments or audits; 

• Targeted or for-cause audits arising from incidents, complaints, material changes or identified risks; and 

• Combinations of these methods where a single form of assurance does not provide sufficient evidence of compliance. 

​

Where independent assurance is required, the LDTF MUST define any requirements applicable to the competence, independence, accreditation or approval of the body undertaking the assessment. The LDTF MAY require the use of an accredited or otherwise recognised certification or conformity assessment body where the nature or level of risk warrants independent assurance. 

​

Where self-assessment is permitted, the Participant MUST provide an accurate assessment against the applicable requirements and MUST retain sufficient evidence to substantiate the assessment. The LDTF MAY require supporting evidence, undertake verification or subject the Participant to subsequent periodic assessment or audit. 

​

The applicable assurance method, scope, frequency and level of evidence MAY vary between Participant roles and MAY vary between requirements applicable to the same Participant. A Participant MUST comply with the assurance method specified for its role and applicable requirements. 

​

Risk and maturity 

​

The Governing Authority MUST periodically review the compliance and assurance methods applied under the LDTF to ensure that they remain proportionate to risk and provide sufficient confidence in Participant compliance. 

​

The level and method of assurance MAY change in response to the risk presented by a Participant or Participant role, changes to the services or information being provided, compliance history, incidents, changes to the wider ecosystem, or other factors that materially affect the level of assurance required. 

​

The assurance model MAY also evolve as the LDTF matures. The LDTF MAY initially permit proportionate forms of self-assessment, existing third-party assurance or targeted assessment and subsequently introduce more formal, independent or standardised assurance requirements as participation, risk, operational experience and the maturity of the LDTF develop. 

Changes to assurance requirements MUST be managed through the applicable LDTF governance and change management processes and MUST be communicated to affected Participants. 

​

Assurance outcomes 

​

The outcome of an assurance activity MUST be recorded and MUST provide sufficient information to determine whether the Participant meets the applicable LDTF requirements. 

​

Where assurance identifies deficiencies or non-compliance, the Participant MAY be required to provide additional evidence, undertake corrective action or remediation, or undergo further assessment before compliance is accepted or continued participation is permitted. 

​

The LDTF MUST define the authority responsible for accepting assurance outcomes and determining whether the evidence provided is sufficient to demonstrate compliance. 

​

Continuing assurance 

​

Certification, assessment or other evidence of compliance MUST remain valid and appropriate for the period for which it is relied upon. 

​

The LDTF SHOULD define periods of validity, reassessment or renewal requirements, periodic assessment or audit activities or other continuing assurance requirements appropriate to the Participant role and level of risk. 

​

Participants MUST notify the Framework Administration or Compliance and Assurance function of material changes that could affect the validity of an assurance outcome or their continued compliance with applicable requirements. 

​

Such changes MAY include material changes to services, systems, operating arrangements, ownership or control, key suppliers, certifications or accreditations, or other circumstances upon which the previous assessment relied. 

​

Additional assurance 

​

The LDTF MAY require additional or enhanced assurance where existing evidence is insufficient to provide appropriate confidence in a Participant's compliance. 

​

Additional assurance MAY be required following a material change, incident, complaint, identified non-compliance, deterioration in compliance or assurance status, significant change in risk, or other circumstances that give reasonable grounds to reconsider the Participant's compliance. 

​

The requirement for additional assurance MUST be proportionate to the nature and significance of the matter giving rise to it. 

Participant status and continuity 

Onboarding and transition 

​

An organisation MUST complete the applicable onboarding process before becoming a Participant in the LDTF. 

​

Onboarding MUST establish that the organisation is eligible to perform the applicable Participant role, has entered into or is otherwise bound by the applicable agreements, schedules and other legal or binding instruments, and has demonstrated compliance with the LDTF requirements applicable to that role. 

​

The onboarding and compliance requirements applicable to a Participant MUST be determined by its Participant role and the applicable Policy, Rules, schedules, agreements and other associated instruments. 

​

Where an organisation performs more than one Participant role, the LDTF MUST determine the onboarding and compliance requirements applicable to each role and whether evidence provided for one role may be relied upon for another. 

​

A Participant MUST NOT be recorded as active in the Trust Registry, or exercise rights or authorisations arising from participation, until the applicable onboarding requirements have been satisfactorily completed or a transitional arrangement expressly permitted by the LDTF applies. 

​

Transition of existing NLIS users 

Existing users of NLIS who will participate in Next Gen NLIS MAY be onboarded into the LDTF through a phased transitional process during the switchover. Each MUST undergo due diligence and assessment against the requirements applicable to its intended Participant role. 

​

Existing evidence of onboarding, compliance or assurance MAY be recognised where it is determined to be current, relevant and equivalent to the applicable LDTF requirements. Where such equivalence is established, the Participant MAY be granted a waiver from repeating the corresponding onboarding or assurance activity. 

​

Any requirements for which existing evidence is absent, insufficient or not equivalent MUST be satisfied through the transitional onboarding process, including through additional evidence, self-assessment, assurance or remedial action as applicable. 

​

The basis for any equivalence determination or waiver MUST be documented. Where a waiver is granted an associated memorandum of understanding may be issued that contains appropriated mitigation and a remediation plan.  

As part of transitional onboarding, each existing Participant MUST confirm its compliance with the LDTF requirements applicable to its role. This MAY initially be demonstrated through self-assessment or self-certification, supported by such evidence as the LDTF considers appropriate. 

​

Acceptance through the transitional onboarding process MUST NOT remove the Participant's obligation to comply with the LDTF or prevent the LDTF from subsequently requiring further evidence, independent assurance, audit or other compliance activity. 

​

Where transitional onboarding identifies requirements that have not yet been fully satisfied, remedial action MAY, by exception, be agreed and managed under the transitional arrangements for the switchover to Next Gen NLIS. 

​

Any such switchover remediation MUST be documented, identify the outstanding requirements and actions required, assign responsibility for their completion and specify an appropriate period for remediation. 

​

The use of switchover remediation MUST NOT be permitted where the identified deficiency presents an unacceptable risk to the security, integrity or operation of the LDTF, its Participants, relying parties or information. 

​

The Governing Authority MUST determine when the switchover arrangements cease to apply. Following the end of the switchover period, all Participants MUST be subject to the normal onboarding, compliance, assurance and remediation requirements of the LDTF. 

​

Organisational change and transfer of responsibility 

​

Changes to the organisational structure, legal status, ownership, responsibilities or operating arrangements of a Participant MUST NOT, in themselves, remove, suspend or transfer the Participant's obligations under the LDTF. 

​

Where an organisational change affects multiple Participants, each Participant MUST continue to comply independently with the LDTF and its applicable Rules, schedules, agreements and other associated instruments until responsibility has been formally transferred to, and accepted by, another organisation in accordance with the applicable contractual and LDTF requirements. 

​

A Participant undergoing, or becoming aware of, a material organisational change that could affect its participation or compliance MUST notify Framework Administration or the Compliance and Assurance function as soon as reasonably practicable. 

​

Framework Administration and the Compliance and Assurance function MUST assess the effect of the change upon the Participant’s status, responsibilities, assurance and compliance requirements and determine whether further evidence, assessment, onboarding or other action is required. 

​

Responsibility for compliance MUST NOT be treated as transferred solely because operational functions, personnel, systems, assets or services have transferred between organisations. 

​

A transfer of responsibility MUST only take effect for the purposes of the LDTF when: 

1. The organisation assuming responsibility has formally accepted the applicable LDTF obligations; 

2. Any applicable contractual or other binding arrangements have been established or amended; 

3. Any required onboarding, compliance or assurance activities have been satisfactorily completed; 

4. The transfer has been approved or recognised by the appropriate LDTF authority; and 

5. The Participant records and Trust Registry have been updated to reflect the change. 

​

Until these conditions have been satisfied, each existing Participant MUST remain accountable for the LDTF obligations applicable to it. 

​

The LDTF MAY establish transitional arrangements where necessary to maintain continuity of participation, services, information and accountability during organisational change. Such arrangements MUST clearly identify the Participants involved, their respective responsibilities, the period for which the transitional arrangements apply and the conditions under which responsibility will transfer. 

​

Following completion of a transfer, the Framework Administration MUST ensure that the Trust Registry and other authoritative records identify the organisation accountable for the applicable Participant role and the effective date from which that responsibility applies. 

​

Continuity and recognition of existing status 

​

For the purposes of the LDTF, recognition of existing status means the controlled recognition and continuation or transfer of an existing Participant's participation rights, approvals, authorisations, assurance outcomes or other recognised status following an organisational or structural change, without requiring the affected organisation to repeat requirements that have already been satisfactorily met. 

​

Recognition of existing status MAY be permitted where the Governing Authority determines that existing participation or compliance arrangements remain applicable and that their continuation or transfer does not materially increase risk to the LDTF or its Participants. 

​

Recognition of existing status MUST NOT be automatic. The appropriate LDTF authority MUST determine whether existing rights or participation status may be recognised by a successor or reorganised Participant and whether any conditions, additional evidence or assurance are required. 

​

In determining whether recognition of existing status is appropriate, consideration SHOULD be given to the continuity of the Participant's functions, responsibilities, personnel, systems, services, contractual arrangements, assurance status and risk profile, and to any material change in the legal entity or operating arrangements. 

​

Recognition of existing status MAY apply to all or part of a Participant's existing participation, rights, approvals or assurance status and MAY be subject to conditions, limitations or a defined transitional period. 

​

Where recognition of existing status is permitted, the decision, its scope, any conditions and its effective date MUST be documented, and the Trust Registry and other applicable Participant records MUST be updated accordingly. 

​

Recognition of existing status MUST NOT remove any obligation to comply with applicable LDTF requirements and MUST NOT prevent the LDTF from requiring additional assurance or reassessment where subsequently considered necessary. 

​

Until recognition of existing status or transfer has been formally approved, the existing accountability and compliance arrangements MUST continue to apply. 

​

Termination and leaving the LDTF 

​

A Participant's participation in the LDTF MAY end through voluntary withdrawal, termination by the Governing Authority or another function with delegated authority, expiry or termination of an applicable agreement, cessation of the Participant's relevant activities, or another circumstance defined by the LDTF or associated contractual arrangements. 

​

Termination or withdrawal MUST be managed in a controlled manner to protect the continuity, integrity and security of the LDTF, its Participants, relying parties and information. 

​

Voluntary withdrawal 

A Participant MAY withdraw from the LDTF in accordance with the notice periods, conditions and processes established by the LDTF and applicable contractual arrangements. 

​

A Participant intending to withdraw MUST notify the Framework Administration in accordance with the terminate procedures as set out in the relevant User Agreement and MUST cooperate with activities reasonably necessary to manage its exit. 

​

Withdrawal MUST NOT take effect until the applicable exit requirements have been completed or the effective date of withdrawal has otherwise been agreed or determined in accordance with the applicable contractual arrangements. 

​

Termination of participation 

A Participant's participation MAY be terminated where permitted by the LDTF or applicable contractual arrangements. 

​

Grounds for termination MAY include: 

​

1. Material, persistent or systemic non-compliance; 

2. Failure to remediate identified non-compliance within a required period; 

3. Loss of a certification, authorisation, licence or other status necessary for participation; 

4. Conduct that creates an unacceptable risk to the LDTF, other Participants or relying parties; 

5. Material breach of an applicable agreement; 

6. Insolvency, dissolution or cessation of relevant activities; or 

7. Other grounds for termination established by the LDTF or applicable contractual arrangements. 

​

Except where immediate action is necessary to manage a material risk, the Participant SHOULD be informed of the grounds for proposed termination and provided with an appropriate opportunity to respond or remediate before a final decision is made.  A decision to terminate participation MUST be made by the function possessing the necessary delegated authority and MUST be recorded. 

​

Exit requirements 

On withdrawal or termination, the Participant MUST comply with applicable exit requirements. 

​

These MAY include requirements to: 

​

1. Cease representing itself as an active or approved LDTF Participant; 

2. Cease exercising rights, permissions or authorisations arising from participation; 

3. Return, revoke, disable or securely dispose of credentials, keys, certificates or other access mechanisms where required; 

4. Complete or appropriately transfer outstanding transactions, responsibilities or services; 

5. Cease using the Trust Mark and cease any representation, branding, marketing or other activity that could reasonably imply current participation in, approval by, endorsement by or association with the LDTF, Land Data or NLIS, except where expressly permitted; 

6. Preserve, transfer, return or securely dispose of information in accordance with applicable requirements; 

7. Provide information or assistance necessary to support an orderly transition; 

8. Complete outstanding compliance, remediation or reporting obligations where these remain applicable; and 

9. Satisfy any other exit obligations established by the LDTF or applicable contractual arrangements. 

​

The Framework Administration MUST update the Trust Registry and other authoritative records to reflect the Participant's changed status and the effective date of withdrawal or termination. 

​

Relevant Participants and relying parties MUST be informed where the change in status materially affects their ability to rely upon, interact with or receive services from the departing Participant. 

​

Continuing obligations 

Withdrawal or termination MUST NOT extinguish obligations that, by their nature or under the applicable LDTF Rules, legal requirements or contractual arrangements, are intended to continue after participation ends. 

​

Continuing obligations MAY include requirements relating to confidentiality, information protection, retention and disposal, audit records, evidence, liability, dispute resolution, outstanding compliance matters and cooperation with investigations relating to activities undertaken while the organisation was a Participant. 

​

The period for which an obligation continues MUST be determined by the applicable LDTF requirement, legal requirement or contractual arrangement. 

​

Re-entry 

A former Participant seeking to re-enter the LDTF MUST follow the onboarding and assurance requirements applicable at the time of re-entry. 

​

The LDTF MAY take account of previous participation, assurance and compliance history when determining the onboarding or assurance activities required. 

​

Previous participation MUST NOT create an automatic entitlement to re-entry or restoration of previous rights or authorisations. 

​

Participant status and Trust Marks 

​

The LDTF MAY establish one or more Trust Marks to identify an approved status. The Governing Authority MUST define what each Trust Mark represents, including whether it indicates participation, a specified assurance status or another approved status. A participation mark MUST NOT imply independent certification unless that claim is expressly authorised. The LDTF MAY also maintain a digitally signed online list of Participants. 

​

Use of each Trust Mark MUST be subject to rules established by the Governing Authority. These rules MUST define eligibility, the claim made, permitted scope and presentation, and the circumstances in which authorisation may be suspended or withdrawn. 

​

A Participant MUST NOT use the Trust Mark in a manner that misrepresents the scope of its participation, compliance, assurance status, services or activities. Where participation or compliance applies only to particular roles, services or activities, use of the Mark MUST NOT imply that other parts of the Participant's organisation or services have been assessed or approved under the LDTF. 

​

The LDTF MAY establish different forms or levels of the Mark where it is necessary to distinguish between Participant status, compliance status, certification or other levels of assurance. 

​

Right to use a Trust Mark 

A Participant MAY use the Trust Mark only while it satisfies the eligibility requirements established for its use. 

​

The right to use the Mark MUST NOT, by itself, constitute certification, accreditation, regulatory approval or a warranty of the Participant or its services unless the LDTF expressly defines the Mark as representing such status. 

​

The Governing Authority or an appropriately delegated function MAY suspend or withdraw a Participant's right to use the Trust Mark where the Participant no longer satisfies the applicable requirements, its compliance or assurance status is under review, or continued use could misrepresent its status under the LDTF. 

​

Cessation of use 

Where a Participant withdraws from, is terminated from, or otherwise ceases to participate in the LDTF, any right to use a Trust Mark based upon that participation MUST cease from the effective date of the change in status. 

​

The former Participant MUST cease displaying or representing itself as entitled to use the Trust Mark and MUST, within any period specified by the LDTF, remove the Mark from websites, documentation, marketing materials, systems and other materials under its control. 

​

Where use of the Trust Mark has been suspended, the Participant MUST cease its use for the duration of the suspension unless expressly permitted otherwise. 

​

Termination, withdrawal or suspension of the right to use the Trust Mark MUST NOT require the alteration or destruction of historical records where the Mark accurately represented the Participant's status at the time the record was created, provided that continued retention cannot reasonably be interpreted as representing current participation or compliance. 

​

Protection and misuse 

Participants MUST NOT permit another organisation to use the Trust Mark by virtue of their own participation unless expressly permitted under the LDTF. 

​

Actual or suspected unauthorised, misleading or fraudulent use of the Trust Mark MAY be treated as a compliance matter and MAY result in enforcement action under the LDTF or applicable contractual, intellectual property or other legal arrangements. 

The Framework Administration MUST maintain sufficient records to establish which Participants are currently authorised to use the Trust Mark and the status upon which that authorisation is based.  

​

Third-party and subcontractor use of a Trust Mark 

Where permitted by the LDTF, a third party or subcontractor that has independently demonstrated compliance with defined requirements MAY be authorised to use a distinct Trust Mark appropriate to the scope and status of that assurance. Such use MUST NOT imply that the organisation is an LDTF Participant unless it is separately authorised as one. 

​

Use of the Trust Mark by a subcontractor MUST be limited to the functions, services or products within the scope of the assurance upon which the authorisation is based and MUST NOT imply that the subcontractor is an LDTF Participant where this is not the case. 

​

The right to use the Trust Mark MUST be subject to the applicable LDTF branding and usage requirements and MAY be suspended or withdrawn where the subcontractor's assurance expires, is suspended or withdrawn, or the subcontractor otherwise ceases to meet the conditions under which use was authorised. 

​

Where the same assured function, service or product is provided to multiple Participants, the subcontractor MAY continue to use the Trust Mark without obtaining separate authorisation in respect of each Participant, provided that the underlying assurance remains valid and applicable. 

Enforcement and dispute resolution 

Principles 

​

The LDTF MUST maintain arrangements for responding to non-compliance, breaches of LDTF requirements and other conduct that may adversely affect the operation, security, integrity or trustworthiness of the LDTF. 

​

Enforcement action MUST be proportionate to the nature, severity, duration and potential impact of the matter and SHOULD, where appropriate, provide a Participant with a reasonable opportunity to remedy non-compliance before more restrictive action is taken. 

​

In determining the appropriate response, consideration SHOULD be given to: 

​

1. The nature and severity of the non-compliance; 

2. The actual or potential impact upon the LDTF, other Participants, relying parties or information; 

3. Whether the matter is isolated, repeated, persistent or systemic; 

4. The Participant's compliance history; 

5. The Participant's willingness and ability to remediate the matter; 

6. Whether the Participant notified the LDTF of the matter and cooperated with its resolution; 

7. Any immediate or continuing risk arising from the non-compliance; and 

8. Any mitigating or aggravating circumstances relevant to the matter. 

​

Enforcement action under the LDTF MUST NOT prevent action being taken under applicable contractual arrangements, law or regulation where separately available or required. 

​

Remediation and corrective action 

​

Where non-compliance can reasonably be remedied without unacceptable risk to the LDTF, the Participant MAY be required to undertake corrective or remedial action. 

​

Required remediation MUST identify the non-compliance to be addressed, the action or outcome required and the period within which remediation is expected to be completed. 

​

The Participant MUST cooperate with the remediation process and provide sufficient evidence to demonstrate completion of required actions. 

​

The Compliance and Assurance function MAY undertake or require additional assessment, audit or assurance to confirm that remediation has been satisfactorily completed. 

Failure to complete agreed or required remediation within the applicable period MAY result in escalation or further enforcement action. 

​

Enforcement measures 

​

Where appropriate, the function with documented delegated authority MAY apply one or more enforcement measures in response to non-compliance. The Compliance and Assurance function MUST assess the matter and MAY recommend action; material decisions MUST be reserved to or escalated to the Governing Authority as defined in the delegation. 

Measures MAY include: 

​

1. A requirement to provide further information or evidence; 

2. A formal notification or warning; 

3. A requirement to undertake corrective or remedial action; 

4. Increased monitoring, reporting, audit or assurance; 

5. Conditions or restrictions upon particular activities, services, permissions or authorisations; 

6. Suspension of particular rights or authorisations; 

7. Suspension of participation in the LDTF; 

8. Suspension or withdrawal of the right to use the Trust Mark; 

9. Termination of participation; and 

10. Where an enforcement measure affects only a particular role, service or activity, the authorised function MAY restrict the measure to that scope where doing so provides sufficient protection. 

​

The imposition of an enforcement measure MUST be documented together with its basis, scope, effective date, any conditions attached to it and, where applicable, the requirements for its removal. 

​

Where an enforcement measure affects only a particular role, service or activity, the LDTF MAY restrict the measure to that scope where doing so provides sufficient protection. 

​

Suspension 

A Participant's participation, or specified rights, services, permissions or authorisations associated with its participation, MAY be suspended where continued unrestricted participation presents an unacceptable risk or where suspension is otherwise permitted under the applicable LDTF or contractual arrangements. 

​

Suspension MAY be imposed where: 

​

1. Material non-compliance has been identified; 

2. Required remediation has not been completed; 

3. A material incident or risk requires investigation; 

4. Certification, accreditation, authorisation or other assurance relied upon by the LDTF has been suspended or withdrawn; 

5. The Participant has failed to cooperate with an authorised compliance or assurance activity; or 

6. Other circumstances create reasonable grounds to restrict participation pending investigation, remediation or determination. 

​

Suspension MUST NOT, by itself, terminate the Participant's membership of or obligations under the LDTF. 

​

The scope and conditions of suspension MUST be documented and communicated to the Participant. The Participant MUST continue to comply with all LDTF obligations that remain applicable during the suspension. 

​

Where appropriate, the Participant MUST be informed of the actions or conditions necessary for suspension to be lifted. 

The Framework Administration MUST ensure that the Participant's status and any affected rights or authorisations are appropriately reflected in the Trust Registry. 

​

Where a suspension materially affects other Participants or relying parties, those parties MUST be informed where necessary to prevent inappropriate reliance upon the suspended Participant, service or authorisation. 

​

Urgent and protective action 

Framework Administration, or another function with expressly delegated authority, MAY take immediate protective action where there are reasonable grounds to believe that continued participation or activity presents a material and immediate risk to the LDTF, its Participants, relying parties, information or services. 

​

Such action MAY include immediate restriction or suspension without completion of the normal remediation or enforcement process. Circumstances MAY include a material cyber security compromise, loss or suspected compromise of cryptographic keys, or another incident creating an immediate risk. 

​

Any urgent action MUST be limited to what is reasonably necessary to manage the identified risk and MUST be subject to review as soon as reasonably practicable. 

​

The affected Participant MUST be informed of the action, the reason for it and the applicable review or dispute process as soon as it is appropriate to do so. 

​

Enforcement decisions 

Enforcement decisions MUST be made by the function with appropriate authority or function possessing the necessary delegated authority. 

​

The Participant MUST be informed of any material enforcement decision affecting its participation and MUST be provided with sufficient information to understand the basis for the decision, subject to any lawful restrictions upon disclosure. 

​

Except where urgent protective action is required, a Participant SHOULD be provided with an appropriate opportunity to respond to material findings before a decision to suspend or terminate participation is made. 

​

Material enforcement decisions MUST be recorded, including the evidence considered, the decision made, the authority under which it was made and any resulting actions or conditions. 

​

Review and appeal 

A Participant MUST have access to a documented process, administered by Framework Administration, through which it may request review of a material compliance or enforcement decision affecting its participation, rights or authorisations. 

The review process MUST define the grounds upon which review may be requested, the period within which a request must be made, the body responsible for considering the review and the possible outcomes. 

​

Where reasonably practicable, a review SHOULD be undertaken by persons who were not responsible for the original decision. 

A request for review MUST NOT automatically suspend the original decision. The body responsible for the review MAY suspend, vary or otherwise modify the effect of the decision while the review is undertaken where appropriate. 

​

The outcome of the review and the reasons for it MUST be recorded and communicated to the Participant. 

​

Dispute resolution 

​

The LDTF MUST maintain operational and governance steps for resolving disputes arising from participation in, or the operation or interpretation of, the LDTF. The applicable agreement MUST identify the binding dispute resolution route and its relationship to those steps. 

​

Participants SHOULD seek to resolve disputes at the lowest appropriate level and through the applicable operational or governance process before formal escalation. 

​

Where a dispute cannot be resolved, it MUST be escalated in accordance with the applicable governance arrangements. 

​

The dispute resolution process MUST provide, as appropriate, for: 

​

1. Recording and notification of the dispute; 

2. Identification of the matters in dispute; 

3. Exchange of relevant information and evidence; 

4. Consideration by a function or person with appropriate authority; 

5. Escalation where agreement cannot be reached; 

6. Use of mediation, independent expert determination or another agreed resolution mechanism where appropriate; and 

7. Recording and communication of the outcome. 

​

Where a dispute concerns contractual rights or obligations, the dispute resolution provisions of the applicable agreement MUST apply in accordance with that agreement. 

​

Use of the LDTF dispute resolution process MUST NOT prevent a Participant or the Governing Authority from exercising rights or remedies available under applicable contractual arrangements or law. 

​

Suspension and other enforcement measures MAY result in termination where the underlying matter cannot be satisfactorily remedied, where required conditions are not met, or where continued participation presents an unacceptable risk. 

​

Termination MUST be undertaken in accordance with the applicable Participant status and continuity requirements and any applicable contractual arrangements. 

​

Termination MUST NOT remove liabilities, obligations or responsibilities that are required to survive the end of participation. 

Relationship with other Trust Frameworks 

The LDTF MAY operate alongside, interact with or establish relationships with other trust frameworks, assurance schemes or equivalent governance arrangements that currently exist or are established in the future. 

​

Such relationships MAY enable the LDTF and other trust frameworks to recognise or rely upon relevant governance, compliance, assurance or certification activities undertaken within their respective frameworks. The purpose of such recognition is to support interoperability, reduce unnecessary duplication of assurance and enable existing evidence of trust and compliance to be reused where appropriate. 

​

The establishment of a relationship with another trust framework MUST NOT, by itself, alter the governance, authority, accountability or operation of the LDTF. Land Data MUST remain responsible for the governance of the LDTF and Participants MUST remain subject to all LDTF requirements applicable to their participation. 

​

Recognition of another trust framework MUST NOT, by itself, make that framework, its governing body or its participants part of the LDTF. 

​

Recognition of other Trust Frameworks 

​

The Governing Authority MAY recognise another trust framework, or specified elements of another trust framework, where it determines that the requirements, controls or assurance provided are relevant to requirements established under the LDTF. 

Recognition MAY include: 

​

1. Organisational identity, eligibility or status; 

2. Participant onboarding or due diligence; 

3. Compliance assessments; 

4. Certification, accreditation or other assurance; 

5. Technical, information security or operational requirements; 

6. Audit or periodic assessment or audit activities; 

7. Professional or regulatory requirements; and 

8. Other requirements or evidence considered relevant to establishing compliance with the LDTF. 

​

Recognition MAY apply to an entire trust framework, a defined Participant role, a particular service, a specified set of requirements or individual elements of compliance or assurance. 

​

Before recognising another trust framework, the Governing Authority MUST consider the relevance, scope, equivalence, currency and level of assurance provided by that framework in relation to the corresponding LDTF requirements. 

​

Where requirements are not equivalent, or the assurance provided is insufficient for the purposes of the LDTF, the Participant MUST satisfy any additional LDTF requirements applicable to its participation. 

​

Recognition of compliance and assurance 

​

Compliance, certification, assessment or other assurance obtained under a recognised trust framework MAY be accepted as evidence towards demonstrating compliance with corresponding LDTF requirements. 

​

Acceptance of such evidence MUST be limited to the requirements and scope for which the evidence provides appropriate assurance. 

​

Acceptance of evidence from another trust framework MUST NOT, by itself, constitute acceptance of an organisation as an LDTF Participant or demonstrate compliance with requirements that fall outside the scope of the recognised evidence. 

​

The LDTF MAY require additional evidence, assessment, certification or assurance where necessary to demonstrate compliance with requirements specific to the LDTF or the Participant's role. 

​

Participants MUST remain accountable for demonstrating their compliance with all requirements applicable to their participation in the LDTF, irrespective of whether evidence from another trust framework has been accepted. 

​

Mutual recognition 

​

The Governing Authority MAY establish mutual recognition arrangements with another trust framework under which each framework recognises specified compliance, assurance, certification, status or other outcomes established by the other. 

Mutual recognition MAY enable Participants to reuse relevant evidence of compliance or assurance between frameworks without unnecessarily repeating equivalent assessment or certification activities. 

​

A mutual recognition arrangement MUST define, as applicable: 

​

1. The trust frameworks and organisations to which the arrangement applies; 

2. The requirements, Participant roles, services or assurance outcomes that are recognised; 

3. Any requirements that remain specific to each trust framework; 

4. The basis and level of assurance upon which recognition is provided; 

5. Arrangements for establishing and periodically reviewing equivalence; 

6. Information sharing and notification requirements; 

7. The effect of material changes to either trust framework; 

8. The effect of non-compliance, suspension, withdrawal, termination or loss of assurance within either framework; and 

9. Arrangements for modifying, suspending or terminating the recognition arrangement. 

​

Mutual recognition MUST NOT, unless expressly provided for through an approved arrangement, transfer governance authority, responsibility or accountability between the respective trust frameworks. 

​

Governance and compliance independence 

​

The LDTF MUST retain its own governance, Participant management, compliance, assurance, enforcement and dispute resolution arrangements irrespective of any recognition or mutual recognition arrangement with another trust framework. 

Decisions concerning participation in, compliance with, suspension from or termination from the LDTF MUST remain subject to the governance and authority established under the LDTF. 

​

Another trust framework MAY provide evidence, assurance or other information upon which an LDTF decision is based, but recognition of that evidence MUST NOT transfer responsibility for the resulting LDTF decision to the other framework. 

Similarly, recognition by another trust framework of LDTF Participants, requirements or assurance outcomes MUST NOT alter Land Data's responsibilities for the governance and operation of the LDTF. 

​

Participants operating under more than one trust framework MUST remain independently responsible for satisfying the requirements applicable under each framework, except to the extent that requirements or evidence have been formally recognised. 

​

Changes to recognised Trust Frameworks 

​

Recognition of another trust framework MUST remain appropriate for the period during which the LDTF relies upon it. 

Where Land Data becomes aware of a material change to the governance, requirements, assurance arrangements, certification, scope or operation of a recognised trust framework, the Governing Authority MUST determine whether the basis for recognition remains valid. 

​

Recognition MAY be maintained, modified, restricted, suspended or withdrawn where the other trust framework no longer provides the scope or level of assurance upon which recognition was based. 

​

Where a change to, or loss of recognition of, another trust framework affects evidence relied upon to demonstrate a Participant's compliance with the LDTF, the Participant MAY be required to provide alternative evidence, undertake additional assurance or demonstrate compliance with the affected LDTF requirements directly. 

​

Federation with other Trust Frameworks 

​

The Governing Authority MAY establish formal federation arrangements with other trust frameworks where this supports trusted interoperability, participation, exchange of information or delivery of services across framework boundaries. 

​

A federation arrangement MUST clearly define the governance boundaries and respective responsibilities of each participating trust framework. 

​

The arrangement MUST define, as applicable, the trust relationships being established, requirements being recognised, Participant eligibility, assurance arrangements, information sharing, decision-making responsibilities, incident and compliance notification, dispute resolution and arrangements for suspension or termination of the federation. 

​

Participation in a federation MUST NOT diminish Land Data's accountability for the governance of the LDTF or a Participant's accountability for meeting the requirements applicable to its participation in the LDTF. 

​

Unless expressly provided for by an approved federation arrangement, each trust framework MUST remain independently governed and responsible for its own Participants, compliance decisions and enforcement actions.