20. Remove a trusted Claim Issuer

Removing a trusted Claim Issuer stops the asset from counting that issuer's attestations. The Issuer does it when it ends its relationship with a provider, or when a provider is compromised. The claims the issuer signed stay on the identities and stay valid. They no longer satisfy any required topic of this asset, from the next eligibility check.

At a glance

Triggered by	Issuer
Actors	Issuer, Claim Issuer, Investor, Platform
Contracts	TREXRegistry
Preconditions	The Claim Issuer is trusted for the asset (see 04); the caller holds OWNER in the asset's domain (see 25)
Result	TREXRegistry no longer lists the Claim Issuer, and its claims no longer count toward eligibility for the asset

Actors and roles

Actor	Role in this flow	What they hold
Issuer	Decides to stop relying on the Claim Issuer and submits the removal.	OWNER on the TREXRegistry
Claim Issuer	Stops being trusted for the asset. Does not transact.	Its ONCHAINID, unchanged
Investor	Is affected: an identity that relied on this issuer alone becomes ineligible to receive. Does not transact.	An ONCHAINID carrying claims, unchanged
Platform	Assesses the impact and submits with the Issuer's key.	The Issuer's signing key, or a key authorized for it

Sequence

Step by step

Step 1. Assess the impact

Who: Platform, on behalf of the Issuer

Call: Off-chain, using read calls

Before the call: The Issuer knows which Claim Issuer it removes and why.

What happens: The Platform reads TREXRegistry.getTrustedIssuerClaimTopics(claimIssuer) to list the topics the issuer covers. For each of those topics that is required, it reads TREXRegistry.getTrustedIssuersForClaimTopic(topic). If the issuer is the only one trusted for a required topic, every identity held to that topic becomes ineligible to receive as soon as the issuer is removed. For an orderly change, the Issuer first trusts another Claim Issuer for the topic and lets investors obtain claims from it. For a compromised issuer, the Issuer removes it at once.

What changes: Nothing on-chain.

Step 2. Remove the trusted issuer

Who: Issuer (OWNER)

Call: TREXRegistry.removeTrustedIssuer(trustedIssuer)

Before the call: Step 1 is done.

What the contract checks:

1. The caller holds OWNER in the asset's domain. Otherwise the call reverts with AccessManagedUnauthorized.

2. trustedIssuer is not the zero address. Otherwise ZeroAddress.

3. The issuer is trusted. Otherwise NotATrustedIssuer.

What changes: The registry removes the issuer and its entry under each topic it was trusted for. It emits TrustedIssuerRemoved(trustedIssuer). From the next eligibility check, no claim from this issuer satisfies a topic of the asset.

State after the flow

• TREXRegistry.isTrustedIssuer(claimIssuer) is false.

• TREXRegistry.getTrustedIssuersForClaimTopic(topic) no longer includes the issuer, for any topic.

• TREXRegistry.isVerified(address) is false for every address whose identity relied on this issuer alone for a required topic.

• No claim has been removed from any identity, and no balance has changed. Holders that became ineligible keep their positions and can no longer receive.

• The Claim Issuer's standing in the network is unchanged. Other assets that trust it still do.

Failure modes

Symptom	Cause	Fix
Reverts with AccessManagedUnauthorized	The caller does not hold OWNER in the asset's domain (step 2, check 1)	Grant the role: 25
Reverts with ZeroAddress	The address is zero (step 2, check 2)	Pass the Claim Issuer's address
Reverts with NotATrustedIssuer	The issuer is not in the registry (step 2, check 3)	Read isTrustedIssuer first. Nothing to remove
After the removal, transfers to many investors revert	Those investors relied on the removed issuer alone for a required topic	Trust another Claim Issuer for the topic (04) and have claims issued
The issuer was removed and its claims still count for another asset	Trust is per asset. Each asset has its own registry	Remove it from the registry of each asset concerned

Common misunderstandings

Wrong: "Removing the issuer revokes the claims it issued."

Right: The claims stay on the identities and still read as valid. Revoking a claim is the Claim Issuer's own act. Removing a trusted issuer changes what this asset counts, and nothing else.

Wrong: "Investors who lose eligibility lose their tokens."

Right: Eligibility is checked on the recipient of a movement. A holder that is no longer eligible keeps its position and cannot receive more. What happens to the position is the Issuer's decision, through the agent operations.

Wrong: "To narrow what an issuer is trusted for, remove it and add it again."

Right: updateIssuerClaimTopics replaces the list of topics in one call, with no interval in which the issuer is not trusted. See 04.

Wrong: "Lowering the issuer's reputation in the network has the same effect."

Right: Reputation decides whether an issuer can write claims onto identities without a key grant. It does not change what any asset counts. Only the asset's own registry does.

Integration notes

• Before removing, count the holders that depend on the issuer alone for a required topic. The registry does not do it.

• For an orderly change, the order is: add the replacement issuer, let claims be issued, then remove the old issuer.

• For a compromised issuer, remove first. An interval in which some holders cannot receive is preferable to counting forged claims.

• Index TrustedIssuerRemoved and re-evaluate isVerified for the addresses your application shows as eligible.

• An Issuer with several assets repeats the removal on each registry. Registries do not share their trusted issuers, even when they share an identity storage.

Related flows

• 04 Add a trusted Claim Issuer : the inverse operation, and narrowing an issuer's topics

• 03 Configure required claim topics : the other half of eligibility

• 19 Revoke a claim : what the Claim Issuer does on its side

• 05 Issue a claim to an investor : how investors regain eligibility through another issuer

• 13 Freeze and unfreeze an address or a partial balance : what the Issuer can do about a holder that became ineligible