Article 7. Representation & Signatory Powers

(Swiss law; Zug-registered Verein; principal base Geneva. This Article sets who may bind GRF, how signatures (paper/electronic) are effected, what must be filed or published, and the internal controls that protect neutrality, security, and financial integrity. Cross-refs: Arts. 3 (Independence), 5 (Definitions), 6 (Governing Bodies; CB/CGS), 10 (Meetings & Voting), 12 (CB Clearance & Materiality), 13 (Finance; incl. 13.6 CB Financing Rule), 14–15 (Data/Privacy/Security), 18 (Disputes); Annex F (Delegation of Authority, DoA), G (Signatory Matrix & Templates), H (Treasury Policy), L (InfoSec & Identity).)

7.0 Scope, Principles & Sources of Authority

(a) Sources of authority. No person may bind GRF unless empowered by: (i) these Bylaws; (ii) the Trustees’ Delegation of Authority (DoA); and (iii) for any Material Action (Art. 12), a valid CB Clearance with a Clearance ID referenced in the instrument.
(b) Four pillars. All execution adheres to lawfulness, independence (Art. 3), four-eyes control, and auditability (register, provenance hash, evidence pack).
(c) Negative covenant. GRF shall not be bound by oral commitments, side letters, or implied agency. Deviations are voidable and subject to remedial actions under §7.11.

7.1 Signatory Classes, Roles & Competence

(a) Class A — Primary fiduciary signatories.
• Chair of the Board, Treasurer, Chief Global Steward (CGS) as Clerk of the Council, Executive Director/CEO (if appointed).
(b) Class B — Operational signatories.
• Deputy Clerk(s), CFO, Council Counsel, CISO, DPO, Records Officer, Protocol & Security Director, Program Directors expressly designated in the DoA.
(c) Class C — Local/Limited signatories.
• Regional Clerk Offices (RCOs) and designated NWG/NAC/Host Institution representatives operating under a Limited Power of Attorney (LPOA) issued by the CB.
(d) Incompatibility & recusal. CB personnel are non-executive (Art. 6.3). Any conflicted signatory must recuse; the CB enforces “paper walls” and records recusals in the Council Register.

7.2 Signature Combinations, Thresholds & Special Cases

(a) Default four-eyes rule.

1. Material Actions (Art. 12): A + A, or A + B if the DoA permits and CB Clearance is present.
2. Non-material/routine within budgeted limits: A + B or B + B per DoA.
3. Administrative certifications (true copy, register extracts, council notices): CGS (A) or Deputy Clerk (B) acting individually.
4. Employment letters (within approved headcount/band): B individually using CB templates (standing clearance).
   (b) Content-sensitive counter-signature (mandatory CB). The following also require a CB counter-signature (CGS/Deputy):
   • ECT instruments/schedules; • DRF structures & payout rails; • high-impact data/model licenses; • privacy/security undertakings with cross-border flows; • host-venue & security agreements for major convenings; • any grant/sponsorship with conditions; • treasury and custody instruments.
   (c) Borrowing, liens & negative pledge. Any borrowing, guarantee, lien, assignment of receivables, or negative pledge requires Trustees’ resolution, CB Clearance, and A + A execution.
   (d) Emergency execution (RAP). During an activated Rapid Activation Protocol, the CGS may sole-sign instruments strictly necessary for life/safety or continuity, up to limits in the RAP Order. Each act is logged, gazetted, and ratified by Trustees within 5 Business Days.
   (e) No implied amendments. No instrument may amend these Bylaws, dilute independence, or allocate editorial control unless expressly authorized by Trustees and CB-Cleared, with the exception noted in the instrument and in the Council Register.

7.3 Procuration (Prokura), LPOA & Delegations

(a) Granting rules. Procurations and LPOAs are: written, time-bound, scope-limited, and value-capped; they exclude powers to amend constitutional instruments, approve exceptions to independence, or dispose of core IP unless expressly granted and CB-Cleared.
(b) Register & filings. All procurations/LPOAs appear in the Signatory Ledger and are filed in the Commercial Register (Zug) where registrable (DE/FR filing; EN controls internally).
(c) Regional Clerk Offices (RCOs). RCO mandates are filing & liaison only unless extended by LPOA; authoritative entries remain domiciled in Switzerland.
(d) Revocation. The CB may suspend or revoke procurations/LPOAs immediately for integrity, risk, or non-compliance; revocations are notified to counterparties and published where material.

7.4 Registry Filings, Public Notices & Specimen Signatures

(a) Commercial Register (Zug). The CB prepares and files entries/changes on seat, purpose, articles, persons with signatory powers, and Prokura where required. Changes are filed within 10 Business Days of approval.
(b) Signatory Ledger (authoritative). Maintained by the CB as part of the Council Register, listing class, scope, limits, specimen signatures, start/end dates, and Clearance prerequisites. Council Register Extracts (CREs) are prima facie evidence of authority.
(c) Council Gazette. Material appointments, revocations, and exceptions are summarized in the Gazette with provenance hashes.
(d) Specimen & verification. Banks, custodians, and critical vendors receive CB Certificates with specimen signatures and device fingerprints for e-sign credentials.

7.5 Banking, Treasury & Payment Controls

(a) Mandate architecture. All accounts use dual authorization (A + A or A + B) above DoA thresholds; segregation of duties prohibits a single person from initiating and approving the same payment.
(b) Online banking & MFA. Access via hardware tokens or equivalent strong MFA; entitlements are role-based, quarterly reviewed by CB + Finance; emergency profiles expire automatically.
(c) Open/close & changes. Opening/closing accounts, adding/removing signatories, or altering limits requires a CB Certificate plus Chair or Treasurer co-signature.
(d) KYC/AML & sanctions. CB keeps banks’ KYC packs (statutes, CREs, UBO attestations, sanctions declarations) current; changes notified within 10 Business Days. Payments to/from sanctioned parties are prohibited absent a lawful license; hits trigger the Incident Protocol.
(e) Treasury instruments. Investment, custody, FX, escrow, guarantees, or collateral require CB counter-signature and compliance with Treasury Policy (Annex H).
(f) Local & project accounts. Where local accounts are needed (events, labs), mandates mirror four-eyes; balances sweep to central treasury per policy; monthly reconciliations are filed to the CB.
(g) Cards, petty cash & advances. Corporate cards require individual agreements and spend controls; petty cash is discouraged and capped per policy; advances reconciled within 10 Business Days post-event.
(h) Third-party platforms. Ticketing/marketplaces/payment processors must be CB-approved (privacy, security, export control). Crypto-assets are not used unless expressly authorized by Trustees with a CB risk opinion.

7.6 Third-Party Representation (Courts, Arbitration, Tax & Regulatory)

(a) Litigation & arbitration. Appointment of external counsel and powers of attorney for proceedings require A + B and CB Clearance; forum follows Art. 18 unless otherwise mandated.
(b) Mediation & settlements. Mediation agreements and settlements above DoA thresholds require A + A and CB counter-signature; settlements must not derogate from independence or data/privacy obligations.
(c) Tax/VAT & regulatory agents. Appointment of tax or regulatory representatives is by A + B with LPOA; filings use CB-provided identity and are logged in the Signatory Ledger.
(d) Apostille/legalisation. The CB coordinates notarization and Hague Apostille or consular legalization where required; certified translations (FR/DE) are issued for filings without altering EN control.

7.7 Electronic Signatures, Digital Identity & Evidence

(a) Legal effect (Swiss law). Qualified Electronic Signatures (QES) compliant with ZertES are equivalent to handwritten signatures for documents requiring signature. Advanced Electronic Signatures (AES) may be used where permitted by law and the DoA.
(b) Cross-border trust. QES under eIDAS or other vetted schemes may be accepted if CB-approved; mapping is recorded in a Council Certificate.
(c) Identity lifecycle. The CB operates a Digital Identity Service: identity proofing (KYC), credential issuance (smartcard/token/qualified certificate), MFA, annual re-proofing (or upon role change), and immediate revocation upon compromise or exit.
(d) Accepted formats & LTV. PAdES (PDF), XAdES, CAdES with trusted timestamps and long-term validation (LTV) only. Documents are stored in the Council Register with their provenance hash and validation chain (certificates, OCSP/CRL, timestamps).
(e) Organizational e-seal. The CB may apply an organizational e-seal in addition to personal signatures for high-impact releases, CREs, and certificates.
(f) Click-throughs & electronic assent. For low-risk standardized terms (training, events, toolkit access), click-through or email assent may be used if identity is verified, assent is logged (timestamp, device/IP where lawful), and the terms are archived. Material deviations require formal signature.
(g) Platform governance. Only CB-approved signature/identity platforms may be used; vendor changes require DPIA/PIA and CB approval (Arts. 14–15).
(h) Authoritative copy. In case of discrepancy, the CB-hosted digital copy with intact provenance hash prevails over any print.

7.8 Brand, Independence & Content Controls (Execution-Stage)

(a) No co-branding by signature. Instruments may not include third-party marks or language implying affiliation without a CB-Cleared license/MoU and Trustees’ approval where required (Art. 3.2).
(b) No donor editorial control. Donor/vendor clauses conferring editorial/technical control are voidable; any conditional funds require Trustees’ approval, CB Clearance, and public disclosure (Council Gazette).
(c) Open interfaces. No exclusivity may foreclose participation by states, communities, SMEs, or academia in GRF programs.

7.9 Records, Publication & Transparency

(a) Council Register entries. All executed instruments of record (and their evidence packs) are filed within 5 Business Days (or per SLA).
(b) Council Gazette. Material acts are summarized with provenance hashes and necessary redactions (privacy, trade secrets, sanctions law).
(c) Access & extracts. CREs and redacted extracts are provided to Members or authorities with a lawful basis; logs of access are retained.

7.10 Controls: Monitoring, Training & Reviews

(a) Monitoring. The CB and Audit & Risk Committee review quarterly: signatory lists, entitlements, bank mandates, exceptions, and breach logs.
(b) Training. All signatories must complete annual training on authority, independence, data/privacy/security, and records; completion is a condition of continued authority.
(c) Attestations. Class A/B signatories file semi-annual attestations that their authority, conflicts, and device custody are accurate.

7.11 Breaches, Remedies & Ratification

(a) Voidability. Acts performed without authority, without required CB Clearance, or in breach of this Article are voidable at GRF’s election. Counterparties acting in bad faith or with constructive notice may be held liable for loss.
(b) Ratification (strict). Trustees may ratify a defective act only if: (i) independence/conflicts are cured; (ii) no law is violated; (iii) the CB issues a Council Certificate noting cure and ratification; and (iv) the act is entered with a provenance note.
(c) Discipline & reporting. Misuse of signatory powers is grounds for immediate suspension, removal from office, clawback of benefits, and referral to authorities where appropriate. Whistleblowers are protected (Art. 16.4).
(d) Incident protocol. Suspected fraud, sanctions hits, or signature compromise triggers the Incident Protocol (containment in 24h, report in 72h; Arts. 14–15) and immediate credential revocation.

7.12 Language, Notarization & Translation

(a) Languages. Execution may occur in EN/FR/DE; EN controls internally (Art. 5.2). Where filings require FR/DE, CB-certified translations are used for that filing only.
(b) Notarization & apostille. Where host law requires notarization or apostille/legalization, the CB coordinates and records the chain (notary, apostille, consular).
(c) Plain-English schedules. For complex structures (DRF/ECT), CB requires an authoritative plain-English schedule summarizing obligations, signatory authority, and independence controls.

7.13 Illustrative Signatory Matrix (Annex G governs if different)

(Actual thresholds, tiers, and examples are maintained in Annex G and the DoA.)

7.14 Transitional & Housekeeping

(a) Standing up the regime. Within 30 days of adoption, the CB publishes: the Signatory Matrix, templates (signature blocks, LPOA/Prokura, CB Certificate, Clearance cover sheet), and the platform whitelist for e-sign and identity.
(b) Annual tidy-up. The CB conducts an annual refresh of signatory powers, bank mandates, and specimen signatures, reporting to Trustees and the Audit & Risk Committee.
(c) Conformance. Any legacy instruments are migrated to CB templates at next renewal; deviations require a Council Circular explaining lawful variance.

Design result: A state-of-the-art system—tight four-eyes, CB Clearance, digital trust, and auditable evidence—that makes GRF hard to capture, hard to spoof, and easy to verify, while keeping execution fast in both normal operations and crisis activation.