CUSIP vs ISIN vs FIGI: which identifier to build on

Two data sources disagree about what a security is, and you are three tables into a schema that assumed a ticker was a key. This is where everybody finds out that the identifier question has an industry behind it.

Why the ticker fails

A ticker identifies a listing at a moment in time. Four things break it, all four verifiable in the SEC's own data.

It gets reused. Bed Bath & Beyond Inc. filed with the SEC under CIK 886158 until September 2023, when the registrant was renamed 20230930-DK-Butterfly-1, Inc. and stopped trading. The ticker BBBY now appears in EDGAR's company data against a different registrant entirely — CIK 1130713, which filed as Overstock.com until 2023, then as Beyond, Inc., then as Bed Bath & Beyond, Inc., and which EDGAR listed under another name again in August 2026. One ticker, two unrelated issuers, three years apart.

It differs per share class. Alphabet has one CIK, 1652044, and two listed classes: GOOGL for the Class A shares and GOOG for the Class C — different votes, different prices, different identifiers all the way down. Anything treating "Alphabet" as one row has already lost.

It differs per venue. The same instrument trades in several places under a different local symbol in most of them — the gap venue-level identifiers exist to fill.

It changes on corporate actions. EDGAR records Meta Platforms' former name, Facebook Inc., through 27 October 2021, and lists META as the ticker today. The CIK never moved: anything keyed on FB broke, anything keyed on 1326801 did not.

How it works

Five registries matter, and they are not the same kind of thing.

CUSIP — nine characters, United States and Canada. The American Bankers Association owns the system; CUSIP Global Services administers it and is, per its own page, "managed on behalf of the American Bankers Association by FactSet Research Systems Inc." FactSet announced the purchase of CGS from S&P Global in December 2021 and closed it on 1 March 2022 for approximately 1.925 billion dollars. CGS is also the national numbering agency for the United States.

ISIN — twelve characters, international, ISO 6166. Issued by national numbering agencies — over 120 of them, per CGS — coordinated by ANNA, which is the registration authority for the standard. Two rules from ANNA's own ISIN Uniform Guidelines (Version 25, December 2025) set the limits: an ISIN identifies "a financial instrument rather than the market a financial instrument trades on", except for options, futures and commodities, and "ISINs should never be re-used". So it survives a delisting and tells you nothing about where the thing traded. A US ISIN is also a CUSIP in a wrapper, sitting in positions 3 to 11: Apple's US ISIN is US0378331005, and the nine characters in the middle are the part with a licence on them.

SEDOL — seven characters, assigned by the London Stock Exchange, now part of LSEG (the market-data business formerly called Refinitiv — not Reuters, which is the news agency). LSEG says the SEDOL Masterfile covers over 100 million instruments. SEDOL is listing-level where ISIN is instrument-level — which is why European reference data carries both.

FIGI — twelve characters, and the interesting one. The specification is published by the Object Management Group, with Bloomberg as registration authority, and the identifiers are open data: OpenFIGI's own API page says the API is "free to use without daily, weekly or monthly limitations". It is also the only scheme here explicit about levels. Apple has an exchange-level FIGI per venue, a composite FIGI per country — BBG000B9XRY4 for the US — and one share class FIGI, BBG001S5N8V8, tying every listing of that share class together worldwide. A mapping request for the ticker AAPL returned 74 rows in September 2026; the same request for the US ISIN returned 272, which measures how much a single ISIN is hiding.

LEI — twenty characters, ISO 17442, run by GLEIF under a G20 and Financial Stability Board mandate, identifying the legal entity rather than the instrument. Post-2008 reporting rules are why it exists and why it has scale: GLEIF's Q2 2026 business report puts the active population past 3.1 million, with about 92,000 issued in that quarter alone.

Two more fill the gaps. PermID is LSEG's open identifier for organisations, instruments and quotes, free to query after registration — read its terms first, because it publishes no bulk redistribution licence this page could find. CIK is the SEC's registrant number: free, and the key to everything in EDGAR.

What it costs

The ticker costs nothing and is worth it. Allocating an ISIN is mostly free too: ANNA's guidelines say the majority of NNAs do not charge for allocation and levy nothing for maintenance, on a cost-recovery basis where they charge at all. The money is not in issuing the numbers. It is in using them.

SEDOL is the one scheme that publishes its rate card, so it is the one that shows the shape. From LSEG's 2026 pricing guidelines, a Limited User Licence runs £1,065 per year for up to 1,000 SEDOL codes within one legal entity, £3,335 for 1,001 to 5,000 and £10,930 for 5,001 to 10,000; higher education institutions pay £1,065 for any number; distribution licences start at £985 per year. Read the trigger rather than the prices: a "Licensable Event" is receiving, accessing, extracting, processing, adapting, reproducing or storing SEDOL codes, and it counts codes reachable through a third-party application as well as codes in your own database.

CGS publishes no equivalent document: its terms describe the numbers and standard descriptions as the ABA's intellectual property, licensed for defined internal use rather than redistribution, and the price is whatever the agreement you sign says. FIGI, LEI and CIK cost nothing at any volume. The OpenFIGI mapping API allows 25 requests a minute and 10 jobs per request unauthenticated, 25 requests per 6 seconds and 100 jobs with a free key; GLEIF's LEI Data Terms of Use place the LEI data under a CC0 licence.

What the regulator and the court actually said

Stated narrowly, because the narrow version is strong enough.

In Case COMP/39.592 — Standard & Poor's, the European Commission adopted a commitments decision on 15 November 2011 (C(2011) 8209 final). In its statement of objections the Commission took the preliminary view that S&P's licence fees for US ISINs were unfair: that charging indirect users — banks, brokers and fund managers who took US ISINs from information service providers rather than from S&P and held them in their own databases — did not follow the ISO cost recovery principle, and that S&P owned no copyright in US ISINs, as a database or as individual numbers. S&P committed to abolish all charges to indirect users within the EEA and to distribute US ISIN records separately from other data by daily FTP at an initial price of 15,000 US dollars a year. Three limits matter: an Article 9 decision does not conclude whether there was an infringement, and the decision says so; the commitments applied to the EEA only; and by their own terms they ran five years from the implementation date, which has long passed.

In the United States, Dinosaur Financial Group LLC v. S&P Global, Inc., American Bankers Association and FactSet Research Systems Inc., No. 22 Civ. 1860 (KPF) in the Southern District of New York, was filed on 4 March 2022. On 14 July 2023 the court granted the motion to dismiss in part, dismissing the Sherman Act Section 1, copyright and breach of contract claims and allowing the remainder to proceed. On 28 August 2026 the court resolved the parties' expert-exclusion motions and granted class certification in a sealed opinion — and on 10 September 2026 it vacated that opinion and struck it from the docket, directing briefing by 13 October 2026 on whether distributors belong in the certified class. Nothing has been decided on the merits, and class certification is unresolved as of the date on this page. Anyone telling you a court has ruled on CUSIP licensing is describing something that has not happened.

What to key your database on

Not a ticker, and not a licensed identifier either. Use an internal surrogate id as the primary key, and hold every external identifier in a child table of (scheme, value, source, as_of_date) rows you append to rather than overwrite. The as-of date is the part people skip and the part that saves the migration: when two vendors disagree, the question is usually which of them is a year behind a corporate action, and a row without a date cannot answer it.

Then pick the FIGI level deliberately: share class for "the asset", composite for "the asset in this country", exchange-level for "the thing that printed this trade".

What you can do about it

Building something public, open source, or that you might have to hand to somebody else: FIGI plus LEI plus CIK. All three are free, all three are redistributable, and none involves a licence conversation — which is what makes them the only set that survives a repository being cloned by a stranger, as anything in open source will be.

Working with US filings: CIK is your key, and it is free. The EDGAR APIs serve company submissions and XBRL company facts as JSON keyed on it, including every former name — which is how the ticker-reuse examples above were checked. If an assistant is doing the reading, SEC EDGAR MCP resolves a ticker to a CIK and works from filing data rather than scraped pages.

Mapping between two vendors: post your identifiers to the OpenFIGI mapping endpoint, https://api.openfigi.com/v3/mapping, which accepts tickers, ISINs, SEDOLs, CUSIPs and about thirty other types and returns FIGIs. Know the limit: it resolves into FIGI and does not return a CUSIP or an ISIN, so it is a bridge between systems, not a way around a licence. Dead tickers return nothing — BBBY resolved to "No identifier found" — which is correct, and a good test of your error path. If the pain is provider churn rather than symbology, OpenBB puts one interface over many providers, and Databento is worth reading for its symbology model alone.

A counterparty, custodian or regulator demands ISIN or CUSIP: then you licence. CUSIP and US ISIN come from CUSIP Global Services; SEDOL from LSEG. Expect a contract sized by how many codes you store or can reach rather than how many you query, with redistribution priced separately and reporting obligations attached. Ask for the trigger definition in writing before you ask for a price — LSEG's published one counts codes merely accessible through a third-party application.

Buying data rather than identifiers: most providers in market data APIs return an ISIN or a CUSIP on a plan that includes them, usually the cheapest lawful route to those numbers for a small shop — EODHD and its peers cover the exchanges where ticker collisions are a daily problem. Check what the vendor's terms let you store and pass on: the vendor's licence and the identifier's licence are two different documents.

The free identifiers are one part of a larger free layer — what regulators and central banks publish covers the rest — and the licensing that makes the others cost money is mapped in who owns the market data industry.