Who can create a PIN Reset CRI via the Token Management System (TMS)?

• A. Registration Authority (RA)
• B. Local Registration Authority (LRA)
• C. Trusted Agent (TA)
• D. A, B, and C

Answer: (D)

The ability to create a PIN Reset CRI in the Token Management System is governed by who is trusted to manage token lifecycles and recover access. The Registration Authority verifies identities and approves changes at a broad level, the Local Registration Authority handles local verification and registration tasks, and the Trusted Agent is the staff member who performs secure provisioning and PIN management on tokens. Because PIN resets are a sensitive operation that requires proper identity checks and secure provisioning, policy typically allows all three roles to initiate and authorize a PIN reset through the TMS. This provides the needed coverage and redundancy while maintaining governance, auditing, and enforcement of security controls.