The most consequential registry decision often begins as a piece of correspondence. It may not look like a market event. It may say that a transfer cannot be recorded, that a contact has failed validation, that a representative has not been accepted, that a resource review has produced an adverse finding, that a block is subject to a hold, or that a relationship may be terminated if a defect is not corrected. The tone is administrative. The effect is not.
For the recipient, the letter is quickly read twice. The first reading is legal: what rule is being invoked, what evidence has been cited, what deadline has been set? The second is commercial: will customers remain, will lenders wait, will a buyer close, will a lessor still collect, will upstreams and peers continue to rely on the records that attach to the resources? In a mature IPv4 market, registry recognition is not a clerical nicety. It is part of the infrastructure on which business continuity, transfer value and network reliance rest.
That is why due process in a regional internet registry is not a sentimental appeal to fairness. It is an economic institution. Notice gives the holder time to understand the claim. Reasons convert discretion into usable information. Cure periods separate a fixable defect from disqualification. Reviewability prevents the first decision from becoming the last decision merely because the registry has monopoly recognition. Appeal rights create a second look before high-consequence action becomes irreversible. A stay preserves the last verified operational state while error is tested. Together these devices create procedural option value: they keep the asset, the operating business and the evidence alive long enough for a decision to be examined.
The subject here is narrower than two neighbouring arguments. It is not mainly the identity-verification problem: who can bind the holder, whether a power of attorney is valid, whether an account contact is genuine, or whether a person purporting to speak for a company has authority. Those questions can trigger an adverse decision, and they matter. But this article is about what should happen after the registry has made, or proposes to make, an adverse decision against a recognised holder. Nor is this a full account of dispute resolution, settlement economics or forum design. Courts, arbitration, mediation and corporate litigation all have their place. The question here is more immediate: before the registry's decision destroys value, what procedural safeguards should exist inside the registry decision chain?
AFRINIC is the sharpest case because the abstract problem has already been made concrete. Public reporting has described historical address-record manipulation, a large dispute with Cloud Innovation over IPv4 resources, court orders affecting AFRINIC's finances and operating capacity, years of board and executive discontinuity, receivership in Mauritius, an annulled election amid power-of-attorney and voting concerns, and later attempts to restore normal governance. Those facts do not settle the merits of any particular resource dispute. They do show why a scarce-address registry cannot rely on institutional reassurance alone. When a registry with a troubled governance history controls recognition over economically embedded resources, procedure becomes part of the price of confidence.
The institutional choice is therefore stark. AFRINIC can be treated as infrastructure: a limited, auditable ledger that protects uniqueness, records control, corrects errors, isolates disputes and preserves live networks while hard questions are reviewed. Or it can act as a gatekeeper whose first-line decisions impose immediate economic consequences while reasons, cure, appeal and stays arrive too late, too narrowly or only through expensive litigation. The difference is not philosophical. It is priced into every transfer, lease, customer contract, financing and restructuring that depends on AFRINIC-administered resources.
The notice is the first market signal
The first mistake is to treat an adverse registry notice as a private message between a registry and a member. A registry record is read by many parties who are not inside the file: customers, lenders, buyers, auditors, lessors, lessees, security teams, upstream providers, peers, abuse desks and courts. A notice can therefore change the expected reliability of a resource before any formal revocation, transfer refusal or service interruption takes effect. In a scarce IPv4 environment, information itself moves value.
The mechanism is simple. The holder knows its own documents, customers, history and legal position. The registry knows the file it is assembling, the rule it believes applies and the remedy it is considering. Outsiders know less than both but must make decisions quickly. A buyer may not wait for a lawsuit to conclude. A lender may not accept an unsupported assurance that everything will be reversed. A customer may not distinguish between a narrow contact defect and a threat to resource recognition. If the registry's notice is broad, vague or menacing, the market fills the gap with a discount.
Content therefore matters. A notice that says "the abuse contact failed validation; correct it within 30 days; ordinary registry recognition, RPKI publication, reverse-DNS delegation and routine maintenance continue during the cure period" creates a limited risk. It tells the holder what to fix and tells counterparties what remains stable. A notice that says "the account is under review for policy breach and failure to satisfy the registry may result in termination or resource recovery" creates a cloud over the whole position. The same underlying problem may produce very different commercial consequences depending on how precisely the registry describes it.
AFRINIC's dispute history shows why this is not a drafting nicety. Reporting and analysis around the Cloud Innovation dispute described correspondence in which AFRINIC challenged alleged discrepancies between registered use and actual use, questioned consistency with earlier need representations, raised regional-service issues and warned of possible termination or resource recovery. The contractual merits can be debated elsewhere. The procedural economics are clearer. When a notice combines evidence demands, business-model review, regional-use theory and possible resource loss, it becomes a balance-sheet event.
The address-record scandals reported in 2019 point in the same direction. Allegations that valuable African IPv4 space had been manipulated through dormant or defunct entities and links to an insider gave AFRINIC every reason to investigate forged authority, false records and questionable changes. But the remedy for a corrupted ledger is not a general licence for vague enforcement. It is more exact notice. If the problem is suspected fraud, the notice should say so, preserve evidence and identify the protective hold. If the problem is stale contact data, the notice should define the correction path. If the problem is a regional-use interpretation, the notice should identify the rule, the relevant date, the affected resources and the reason the rule applies. If the problem is a contested transfer, the notice should specify which element failed.
Specificity also disciplines the choice of remedy. A registry has many levers: it can refuse a transfer, place a conflict flag, suspend a portal instruction, pause an RPKI change, deny a reverse-DNS update, reject a new representative, withhold an allocation, terminate membership, reclaim resources or record an adverse status. These levers are not substitutes. A deficient transfer file may justify pausing the transfer while routine maintenance continues. A possible forged representative may justify freezing the contested instruction while preserving the last verified account state. A fee dispute should not automatically contaminate routing-adjacent services unless a clear rule says so. A court restraint should be recorded against the action it restrains, not allowed to spread by implication.
Notice is thus the first safeguard against the registry becoming a gatekeeper. A vague notice gives the registry a wide option and gives the holder a collapsing position. A precise notice narrows the shock. It tells the holder what to cure, tells counterparties what is actually at stake, gives a reviewer a defined decision to examine and forces the registry itself to state which power it has claimed. In a scarce-address market, that narrowing is not mere politeness. It is a way of allocating risk at lower cost.
Reasons are the price of monopoly recognition
Reasons are often treated as legal housekeeping: the paragraph that explains why a decision was made. In a post-exhaustion IPv4 economy, reasons are price information. They tell the holder, the reviewer and the market whether the problem is factual, legal, procedural, technical, curable, disputed, severe or only uncertain. Without reasons, the decision is a black box. A black box controlled by the only registry that can recognise the resource is a risk premium.
A reasoned registry decision should answer practical questions. What fact did the registry find? What evidence supports that fact? What rule makes the fact material? What remedy follows from the rule? Why is that remedy proportionate? Which services or actions are affected? Which services or actions remain unaffected? What may the holder do next? What deadline applies? Who will review the decision if it is challenged? If the decision will take effect before review, why is immediate effect necessary?
These questions are not a lawyer's indulgence. They are how economic actors decide what to do. A buyer facing a transfer refusal needs to know whether the seller failed to prove control, whether the recipient failed an eligibility rule, whether a court order restrains the block, whether fees are unpaid, whether the registry objects to the proposed use, or whether the matter is under fraud review. A missing certificate can be cured. A rival claimant may require escrow changes. A court order may require litigation. A policy objection may require repricing or abandonment. A fraud finding may kill the deal. The market cannot distinguish those outcomes if the registry merely says no.
Reasons also constrain the registry's own incentives. An institution that must write reasons must decide whether it is protecting uniqueness, correcting records, preventing fraud, enforcing a contract, interpreting policy, preserving security or using institutional leverage. The act of explanation exposes category errors. If the stated reason is failed contact validation, revocation looks excessive. If the reason is unverified authority, the proper response may be targeted documentation, not an attack on unrelated services. If the reason is out-of-region customer geography, the holder can ask whether the relevant allocation was subject to that condition, whether the rule is being applied prospectively, and whether reliance formed under earlier expectations is being respected.
AFRINIC's legitimacy problem is not a single problem. Historical record manipulation raised doubts about ledger integrity. The Cloud Innovation dispute raised doubts about enforcement scope. Receivership raised doubts about institutional continuity. The disputed 2025 election process raised doubts about member authority and governance mechanics. A later board may restore formal capacity, but formal capacity is not the same as trust. In such a setting, "trust the registry" is not an economic argument. Reasons are a substitute for trust because they make the decision legible to people who do not control the file.
The appeal value of reasons is obvious. No meaningful appeal exists if the appellant does not know why it lost. But the business-continuity value is just as important. Suppose a holder receives a notice that an abuse contact failed periodic validation. If the reasons state that ordinary registry recognition, RPKI publication, reverse-DNS delegation and existing public records remain unaffected during a cure period, banks and customers can treat the matter as a compliance task. If the same notice says only that failure to satisfy the registry may lead to termination or recovery, the same defect now looks existential.
Reason-giving should be proportional to consequence. A minor ticket denial can be brief. A transfer refusal should identify the failed element. A revocation attempt, reclaim, refusal to recognise a successor, denial of a high-value transfer, suspension of publication services, or adverse decision affecting RPKI, reverse DNS, RDAP or membership rights should require a full decision letter. The higher the consequence, the more clearly the registry should state the rule, evidence, alternatives considered, continuity protection and review route. This is not paperwork for its own sake. It forces the institution to internalise the cost of its power.
Reasons also build institutional memory. Members learn what evidence is required. Staff learn how similar cases were handled. Reviewers can compare outcomes. Courts, if later involved, can see whether the registry acted within a narrow technical function or improvised a commercial policy. Public reporting can distinguish factual disputes from systemic problems. Without reasons, each dispute begins as rumour and ends as precedent only for those who can afford to litigate. That is a costly way to run infrastructure.
AFRINIC needs such memory because the recurring categories are already visible: old records, changing corporate authority, regional-use claims, leasing, transfer refusals, governance standing, account control and continuity. These are not isolated support tickets. They are repeatable sources of high-value conflict. A mature registry should not depend on oral assurances or unexplained refusals. It should turn reasons into a body of predictable practice while avoiding the pretence that the registry is a state. In institutional terms, reasons are the price of monopoly recognition.
Cure periods preserve the difference between defect and default
A cure period is a simple device with deep economics. It says that a defect has been identified, but that the holder has a defined opportunity to correct it before the severe consequence takes effect. That opportunity has option value. The holder can spend money on documents, counsel, technical changes, board approvals or customer communication because it knows what action is required and how long the option remains open. Counterparties can wait because the path is defined. The registry can obtain compliance without immediately destroying value.
Not every defect should be curable in the same way. A forged transfer instruction is different from a missing certificate. A duplicate claim is different from a stale phone number. A court restraint is different from a false-positive screening result. An abuse contact that bounces is different from an allegation that resources were obtained by fraud. A cure architecture must therefore classify defects and match the time and consequence to the harm.
The lowest tier is routine record correction: contact details, billing information, role updates, minor format defects and ordinary deliverability problems. The registry's objective here is accuracy, not punishment. If the holder fixes the record, the matter should end. If the holder does not respond, the consequence should escalate gradually and remain tied to the defect. A failed abuse contact may justify public flagging, restricted non-essential changes or closer scrutiny. It should not automatically become resource loss unless a separate severe rule is triggered.
The next tier is transactional deficiency. A transfer file may not prove the signatory's authority. A restructuring file may not connect the old holder to the successor. A power of attorney may be expired or too broad. A buyer may not have supplied required registry information. Such defects justify pausing the transaction, not contaminating unrelated operations. The cure period should run against the pending action. If the defect is cured, the transaction proceeds. If it is not cured, the transaction is refused with reasons. The last verified operational state remains in place.
The higher tier is serious ledger risk. Evidence of forged documents, account compromise, insider manipulation, duplicate claims, false application statements, court restraints or conflicted historical records may require immediate protective measures. But even here the remedy should be narrow. The registry can freeze disputed changes, record a conflict status, preserve evidence, require independent confirmation and direct the parties to a proper forum for questions it cannot decide. It does not need to revoke live resources before review unless a defined security-integrity emergency exists. A fraud allegation should protect the ledger; it should not become a device for inflicting avoidable collateral damage on customers while the facts are still being tested.
The highest tier is irreversible adverse action: revocation, reclaim, termination, withdrawal of core publication services, refusal to recognise an existing holder, or changes that would impair live routing-related reliance. These actions should almost always require notice, reasons, a meaningful cure opportunity where cure is possible, independent review and a stay. If the defect is genuinely incurable because a court has ordered a restraint or a holder is demonstrably fictitious, the registry should still preserve continuity for innocent downstream users where possible and explain why cure is unavailable.
Cure periods reduce litigation because they create a cooperative zone. If the holder thinks the registry is wrong but the requested cure is narrow, it may comply while reserving objections. If the registry's concern is genuine but not urgent, it can obtain evidence without threatening the entire resource position. If counterparties see a defined cure path, they do not immediately terminate contracts or demand discounts. The cure period becomes a negotiated pause inside the administrative system rather than a race to court.
The absence of cure has the opposite effect. A holder facing near-term resource loss has a rational incentive to seek urgent external relief. A notice threatening recovery of a large scarce-address position is not a routine compliance request; it is an existential event. The holder cannot wait politely if customers, revenue and asset value may be impaired before the merits are heard. It will use court process because the registry process has not provided a safe option. A registry that dislikes being sued should build cure and stay mechanisms before litigation becomes the rational response.
Cure periods are especially important for smaller operators. Large holders can mobilise lawyers and consultants. Small networks often cannot. They need notices that say exactly what to do, what will happen if they comply, what will happen if they do not, and what remains protected during the cure window. Without that clarity, small holders may overcomply, abandon transactions, accept discounts or avoid updating records. A regional registry serving resource-constrained operators should see cure periods as access to justice, not indulgence.
The cure concept also marks the boundary with identity verification. Whether a signer, account contact or proxy can bind the holder is an authority question. It may be the factual trigger for a refusal or hold. Once the registry has reached an adverse authority decision, however, the due-process question is different: does the recognised holder receive reasons, a targeted chance to supply evidence, a review route and a stay of broader consequences? The authority problem decides whether an instruction is valid. The due-process problem decides whether the registry's rejection can destroy value before the holder can correct or challenge it.
The stay is the option that keeps the asset alive
The most important safeguard in a high-consequence registry decision is the stay. A stay prevents the adverse action from taking irreversible effect while review is pending. In economic terms it preserves the option value of the resource and the operating business attached to it. It keeps the last verified state alive long enough to test whether the registry is right.
This matters because many registry harms are not easily reversible. If a block is reclaimed and reallocated, restoration is difficult. If customers renumber or leave, they may not return. If a buyer walks away, the deal may not be revived. If a lender calls a facility or refuses financing, later vindication may not repair the balance sheet. If RPKI, reverse-DNS or public registry changes create operational doubt, reputation can be damaged quickly. The legal record may later say the holder was correct, but the business may already have lost the value that the appeal was meant to preserve.
Option theory explains why a stay is not a mere delay. An appeal has value only if the subject of the appeal remains substantially intact. If the registry can execute first and review later, the holder owns a claim for possible correction, not a meaningful option to preserve value. The difference resembles the distinction between pausing the sale of disputed collateral and selling the collateral first while promising to discuss damages afterwards. The second course may be convenient for the decision-maker, but it destroys the thing under review.
The default stay in registry economics should be preservation of the last verified operational state. If the holder was recognised yesterday and the registry now disputes a transfer request, keep yesterday's recognition while the transfer dispute is reviewed. If a contact object is defective, preserve the resource while the contact is cured. If a power of attorney is challenged, block the proxy action but do not impair unrelated services. If a resource-use allegation is under review, freeze contested changes if necessary but do not revoke live resources before independent review. If a court order restrains a specific action, record the restraint and preserve everything else.
There must be exceptions. A narrow security-integrity emergency may require immediate action: a demonstrably forged update, active hijack, duplicate registration, compromised account, binding court restraint or technical change that would mislead relying parties. But emergency action should be temporary, explained and rapidly reviewable. The registry should state why immediate action was necessary, why lesser measures were insufficient, which services are affected, what evidence will be reviewed and when a reviewer will examine the action. "Emergency" should not become a magic word that converts discretion into execution.
AFRINIC's 2021 bank-account freeze, although a court measure rather than a registry stay decision, illustrates the systemic cost of high-consequence interim action before merits are fully tested. Some public analysis criticised the freeze as a measure that threatened operations before detailed evidence had been heard. Whether one focuses on the holder or on the registry, the economic principle is the same: interim measures can impose irreversible or system-wide costs. A well-designed registry stay regime should reduce the need for parties to seek extreme court remedies because the internal process already offers a safe pause.
The stay also corrects bargaining distortions created by monopoly recognition. Without a stay, the registry's first decision becomes leverage. The holder may settle, disclose excessive information, abandon claims or accept conditions because the cost of waiting is too high. With a stay, the holder can challenge without immediate business destruction. The registry can still prevail if its decision is correct, but it must prevail through reasons and review rather than through impending harm.
This is not anti-registry. In the long run it protects the registry. A registry whose severe decisions are automatically or presumptively stayed is less likely to trigger emergency litigation, damages claims, member panic and public legitimacy crises. Staff can make hard decisions knowing that a second look exists before the most consequential actions take effect. Boards can enforce rules without appearing to hold customers hostage. Courts can see that the institution preserved the subject matter rather than forcing urgent relief. The market can distinguish a contested decision from an executed loss.
For AFRINIC, a stay discipline is especially valuable because institutional trust has been fractured. A holder receiving an adverse notice from a stable registry may expect proportional treatment. A holder receiving one from an institution emerging from years of litigation, receivership, board discontinuity and election controversy may not. A formal stay rule substitutes architecture for trust. It says that, whatever one thinks of the institution, the last verified operational state will not be destroyed until a defined review process has run, unless a narrow emergency exception is proved.
Reviewability is the substitute for exit
Reviewability means that an adverse registry decision can be examined by someone other than the original decision-maker under defined standards. It is not enough that a staff member might reconsider informally, or that a board might someday hear a complaint, or that a court is theoretically available after damage has occurred. Reviewability must be timely, accessible, reasoned and capable of preserving continuity.
The economic reason is monopoly. AFRINIC is not an ordinary vendor for the resources it administers. A holder cannot move the same AFRINIC relationship to another regional registry because it dislikes a decision. A buyer cannot complete a clean AFRINIC-administered transfer by asking a different registry to ignore AFRINIC. A customer cannot make a public registry record trustworthy by contract alone. Where exit is weak, review must do more of the work that competition would otherwise perform.
A review system should begin with internal reconsideration but not end there. Internal review has advantages. It can be fast, technically informed and close to the file. It can correct mistakes without public escalation. It can separate staff error from policy issue. It can preserve working relationships. For routine matters, internal review may be enough: a rejected document, a misunderstood company name, a missing form, a stale contact, a billing classification or a minor eligibility point.
Internal appeal is not enough for severe adverse actions because the institution has its own incentives. A registry may want to defend staff, protect a policy theory, avoid admitting overreach, deter similar holders, preserve institutional authority or strengthen its position in litigation. A board may be conflicted if the decision implicates election politics, member factions, institutional survival or pending court strategy. Receivership changes the holder of authority but does not by itself create a standing appeal architecture. Severe decisions require review that is structurally separate enough to be credible.
The review body's role should be limited to registry-function disputes. It need not become a general court for every commercial quarrel. It should examine transfer denials, adverse resource-review findings, revocation attempts, refusal to recognise a holder or successor, conflict-status entries, account locks, RPKI or reverse-DNS interruptions, abuse-contact escalation, portability requests and emergency protective actions. It should be able to order reasons, require correction, impose interim continuity, narrow the scope of a hold, direct publication of conflict metadata, or refer a legal question to court while preserving the last verified state.
This is different from external litigation. Litigation asks a court to decide legal claims under public authority. It may involve damages, injunctions, corporate law, insolvency, contracts, defamation, winding-up petitions or judicial review. It is broader, slower and more expensive than registry administration. A registry-review mechanism should be faster and narrower. It should not decide who owns a company, whether damages are owed, or whether a corporate actor committed a tort. It should decide whether the registry may implement a specific adverse action now, whether its reasons and evidence satisfy the rule, whether the action is proportionate, and what continuity order should apply while broader legal rights are resolved.
AFRINIC's court history shows why the distinction matters. Court process can preserve rights, but it can also create system-wide risk: frozen accounts, delayed elections, receivership, appeals, winding-up applications, external interventions and uncertainty for ordinary members. Courts are necessary when legal rights are contested. They are a poor first-line substitute for every missing registry appeal. If every severe decision requires urgent litigation, the institution has exported its due-process deficit to the judiciary and to members who pay the costs.
Reviewability also improves policy quality before cases arise. If the registry knows that adverse actions will be reviewed for reasons, evidence, proportionality, continuity and consistency, it will draft clearer rules. It will train staff to classify defects. It will avoid mixing contact validation with revocation theory, authority review with business-model review, or transfer recording with regional capital control. Review does not merely catch errors after the fact. It changes incentives before the notice is sent.
The standard of review should be explicit. For facts, is there reliable evidence? For policy interpretation, is the interpretation reasonably within the text and applied prospectively where reliance is affected? For remedies, is the action necessary to protect uniqueness, accuracy, fraud prevention, security or legally binding restraint? For severe actions, were lesser measures considered? For emergencies, was immediate action necessary and time-limited? For continuity, has the registry preserved the last verified state to the maximum extent consistent with the ledger? These questions would not make AFRINIC weak. They would make its power more credible.
Internal appeal and litigation have different jobs
The division of labour between internal appeal and external litigation is central to due-process economics. Internal appeal is part of the registry's own governance. It tests whether the registry applied its rules correctly, gave adequate reasons, considered proportionate remedies and preserved continuity. Litigation is an external legal process. It tests legal rights, contractual obligations, corporate authority, injunction standards, damages, insolvency and public-law constraints. A functioning registry needs both, but one cannot replace the other.
Internal appeal is cheaper, faster and narrower. It can be built around registry time: days for emergency stays, weeks for document defects, defined periods for transfer refusals and short deadlines for high-consequence actions. It can be handled by people who understand number resources, routing dependencies, RPKI, reverse DNS, RDAP, transfer mechanics and member roles. It can order operational remedies that a court may not design easily: preserve a ROA, maintain reverse-DNS delegation, freeze only the contested transfer field, publish conflict metadata, allow routine contact updates while blocking a transfer, or separate a billing dispute from security publication.
Litigation has different strengths. It has coercive authority. It can bind parties beyond the registry. It can compel disclosure, issue injunctions, appoint receivers, interpret contracts, protect creditors, supervise winding-up and decide statutory questions. If there is a genuine dispute over company ownership, fraud, insolvency, damages or public power, courts may be unavoidable. A registry panel should not pretend to decide such questions conclusively.
The danger is using litigation as the only meaningful appeal. That is costly for everyone. The holder faces fees and delay. The registry faces operational distraction and member-funded expense. Small holders may be priced out entirely. Courts may impose interim measures that preserve one claim while disrupting the institution. Other members, who had no role in the dispute, bear the cost through slower services, higher fees or degraded confidence. AFRINIC's recent history shows how quickly a resource dispute can spill into institutional paralysis once courts become the primary review path for high-consequence decisions.
The Cloud Innovation dispute illustrates the problem without requiring a final view on the merits. AFRINIC believed it had grounds to challenge a large holder's compliance. Cloud Innovation believed AFRINIC threatened an existential resource position. Court action followed. Interim orders affected both the holder's resources and AFRINIC's financial capacity. Later litigation, receivership, appeals and governance fights affected the whole institution. A robust internal appeal with an automatic stay of resource loss would not necessarily have solved the underlying disagreement. It could, however, have reduced the need for extreme interim remedies by preserving the last verified state while reasons and evidence were tested.
Internal appeal also differs from settlement. It should not be a bargaining exercise in which the registry uses the threat of execution and the holder uses the threat of litigation to reach a compromise. That dynamic may occur, but it is not due process. A proper appeal produces a decision: affirmed, modified, reversed, stayed, remanded for reasons, narrowed to a specific defect, or referred to court with continuity preserved. Settlement incentives belong to the broader field of dispute resolution. The due-process point is narrower: before irreversible registry action, the holder should have a defined path to challenge the decision and preserve value.
Nor should internal appeal become a fig leaf where the registry is conflicted. A first-stage internal review can correct mistakes. A second-stage independent registry review should exist for severe actions. Courts remain available for legal rights that exceed the registry layer. The sequence matters. Internal reconsideration reduces errors quickly. Independent review supplies credibility and continuity. Court process decides matters that the registry should not decide. When the sequence is missing, every dispute jumps to the most expensive forum.
The market understands the distinction even when policy documents blur it. A buyer wants to know whether a transfer refusal can be reviewed before closing collapses. A bank wants to know whether resource recognition will be preserved while a dispute is tested. A customer wants to know whether operational services continue if the holder appeals. A lessor wants to know whether leases are impaired by a first-line decision. None of them wants to fund a corporate or constitutional lawsuit merely to learn whether a registry staff decision was overbroad.
Business continuity reaches beyond the holder
Registry due process is often described as a right of the member or resource holder. That is too narrow. The holder is the direct addressee, but the reliance chain extends further. Customers depend on services built on the addresses. Lessors and lessees depend on recognised continuity. Upstreams and peers depend on stable records and trust relationships. Security teams depend on public contacts, route-origin data, reverse DNS and reputation histories. Banks and buyers depend on expected availability. Employees and suppliers depend on business lines supported by the resource. A registry decision can impose costs on parties that had no chance to participate.
That is the strongest economic case for stays in high-consequence cases. The holder may be sophisticated, aggressive or unpopular. It may have exploited scarcity rents. It may have made enemies. It may have adopted a business model the registry dislikes. Customers are not automatically responsible for those facts. A registry action that abruptly impairs live resources can punish downstream users who neither caused nor understood the dispute. Due process protects them by preserving the last verified state while the registry and holder argue.
Consider leasing. A registry may dislike opaque leasing if it hides control, weakens abuse accountability or undermines policy. Those are legitimate concerns. But a lessee may have built customer services, security allowlists, routing arrangements and contracts around the numbers. If the registry decides the lessor is in breach, the remedy should consider continuity for lessees and their customers. That does not mean fraudulent or illegal arrangements must be honoured indefinitely. It means the transition should be reasoned, reviewed and staged where possible. A registry that destroys customer reliance to discipline a holder may win the file and damage the network.
The same is true of transfers. A buyer waiting for AFRINIC recognition may have customers ready to migrate, financing tied to closing and infrastructure scheduled around the block. If a transfer is denied because a document is missing, the buyer can wait or cure. If it is denied because of a broad policy objection, the buyer must reprice or abandon. If it is denied without reasons, the buyer sees region-wide risk. Reasons and appeal therefore protect the transfer market as much as the seller.
RPKI, reverse DNS, Whois and RDAP add a technical dimension to business continuity. A registry decision affecting these services may not "revoke" the resource in a formal sense, but it can change how other networks and security systems understand the holder. ROAs, manifests, repository continuity, reverse-DNS delegations and public contact records are not decorative records. They are part of the operating surface by which the internet interprets a resource. If an adverse decision touches any of them, the stay and review standard should be especially strong. The harm may be routing-adjacent even when the legal label is administrative.
Business continuity also includes financing. Scarce IPv4 resources can support revenue streams even if they are not property in the strongest legal sense. A lender may not take a classic mortgage over a prefix, but it can still consider the stability of address-dependent revenue. A buyer may not buy ownership as if buying land, but it buys an expectation that registry recognition will support continued use or transfer. A lessor may not own an unconditional commodity, but it relies on the registry not to impair recognition without process. Due process reduces the discount applied to these arrangements.
Distributional effects matter in a region served by many small and mid-sized operators. Large holders can absorb legal uncertainty. Small operators cannot. A culture of vague adverse decisions would push smaller members toward avoidance: do not transfer, do not finance, do not restructure, do not lease openly, do not update records unless forced, do not engage with the registry except to pay fees. That is bad for accuracy. The more dangerous registry process appears, the more operators hide reality or defer updates. Due process makes honesty cheaper.
There is also a public-interest dimension. African internet development does not benefit from a registry environment in which resources are legally uncertain, transfers are unpredictable and holders fear that cooperation will expand enforcement exposure. Nor does it benefit from a registry unable to act against fraud or false records. The right balance is neither laissez-faire nor administrative sovereignty. It is reliable procedure. A holder should know that false authority, forged documents and serious fraud will meet firm action. It should also know that good-faith defects can be cured, severe decisions can be reviewed and customers will not be used as leverage.
Business-continuity reliance is therefore the practical test of every procedural rule. Does the notice tell downstream parties what is actually at risk? Do reasons allow counterparties to classify the problem? Does the cure period keep the business alive while defects are corrected? Does the stay preserve customers and routing-adjacent services? Does review occur fast enough to matter? If the answer is no, the procedure is not adequate for a registry whose decisions affect live networks.
Scarcity turns procedure into capital-market infrastructure
A registry can deny that it is an economic regulator and still exercise economic power. The power comes from recognition. Once IPv4 is scarce, recognition affects liquidity, financeability, transfer value, leasing value and bargaining position. A discretionary adverse decision, especially one without timely reasons or appeal, becomes a capital-control event because it controls the movement or usability of scarce operational capital.
This does not require the registry to claim ownership. It is enough that buyers, lenders and customers rely on the registry record. A resource that can be transferred predictably is worth more than one trapped by opaque approvals. A resource protected from unilateral adverse action is worth more than one subject to open-ended review. A resource whose disputes are isolated is worth more than one whose status can contaminate related services. A region whose registry provides clear appeal rights attracts more confidence than one where every severe dispute must become a court fight.
AFRINIC's policy debates around transfers, regional classification, abuse contact, leasing and portability show how procedure and capital mobility intersect. A transfer rule may be written as administrative eligibility. In practice it determines exit value. An abuse-contact rule may be written as data quality. In practice it can create a path from a communication defect to contractual breach. A resource-review rule may be written as compliance. In practice it can reopen reliance formed years earlier. A non-portability assumption may be written as institutional structure. In practice it locks capital into one registry's risk profile.
Due process does not solve all substantive policy questions. It does something more modest and more necessary. It forces the registry to state when it is making a high-consequence decision, why it has authority, what fact triggers the authority, what lesser remedy was considered and how the holder can obtain review before value is destroyed. If the substantive rule is too broad, reasons and review expose it. If the holder is wrong, the process validates action. If the issue is curable, the process preserves value. If the issue belongs in court, the process isolates the dispute while the court acts.
Scarcity also changes moral hazard on both sides. A registry with limited financial liability may underappreciate the harm of overbroad decisions. A holder with a valuable block may over-litigate to preserve scarcity rents. Both behaviours are rational under weak procedure. The registry uses administrative leverage because it has it. The holder uses court leverage because it must. The result is an arms race whose costs spill onto members and customers. Procedural safeguards lower the payoff to both forms of overreach. The registry cannot execute severe action without review; the holder cannot claim every inquiry is existential if notice, cure and stay narrow the issue.
The economics resemble secured credit and settlement systems more than ordinary membership administration. In those systems, finality matters, but so do error correction and preservation. A securities depository cannot casually reverse settlement without rules. A land registry cannot change title without notice. A bank cannot freeze every related account indefinitely on a vague suspicion without legal and compliance structure. Internet number registries are not identical to those institutions, but post-exhaustion IPv4 makes the analogy useful. The more registry recognition resembles settlement infrastructure, the less acceptable discretionary opacity becomes.
AFRINIC's institutional fragility magnifies the capital-control effect. In a stable registry, parties may assume a bad decision is an exception. In AFRINIC, years of litigation and governance crisis make parties ask whether discretion is systemic. A single adverse notice can therefore have region-wide signalling effect. It tells the market how the recovering institution will treat scarcity, holders, transfers and appeals. If the first signals are opaque or severe, the discount spreads.
The solution is not to pretend IPv4 has no market value. That fiction is exhausted. Nor is the solution to declare number resources ordinary private property and strip registries of fraud-control authority. The workable approach is asset-neutral procedure. The registry need not concede property language to recognise reliance. It can say: whatever the ultimate legal character of the resource, our decisions affect operational and economic value; therefore adverse action requires notice, reasons, cure, stay and review. That statement would do more for market confidence than another abstract debate over ownership.
In this sense due process is capital-market infrastructure. It lowers the discount attached to AFRINIC-administered resources by making registry risk legible. It tells holders that cooperation will not automatically expose them to arbitrary loss. It tells buyers that transfer refusals can be understood and challenged. It tells lenders that severe action will not occur without preservation. It tells courts that the registry has an internal discipline worthy of deference. It tells the region that infrastructure is being protected without making the registry sovereign.
What a limited registry appeal system would look like
A due-process system for AFRINIC should be built around the registry's legitimate functions: uniqueness, accurate records, fraud prevention, security publication, transfer recording, contactability, dispute isolation and operational continuity. It should not be built around institutional prestige, regional industrial policy or a desire to turn every commercial disagreement into a compliance matter. The design can be practical without becoming a full dispute-resolution code.
The first requirement is classification. Routine corrections, transactional refusals, account-representation disputes, publication-service interruptions, transfer denials, conflict-status entries, emergency holds, revocation attempts and membership consequences should be separate categories. Each category should have default notice, reasons, cure, stay and review rules. Classification prevents the most common procedural abuse: using a small defect as the doorway to a large remedy.
Every high-consequence notice should include a concise decision card. It should identify the resources or services affected, the rule invoked, the facts found, the evidence category, the requested cure, the deadline, the consequence of cure, the consequence of non-cure, the services preserved during the period, the review route and whether a stay applies automatically. This is not template prose in place of judgment. It is structured risk disclosure for an infrastructure decision.
Cure should be the default where the defect can be corrected. Contact failures, missing documents, unclear authority, incomplete transfer submissions, ordinary payment disputes, ambiguous corporate succession and data-quality problems should usually be curable. The cure period should be long enough to obtain real documents across borders, translations, board approvals and professional certifications where necessary. Short emergency periods may apply to active compromise or fraud, but the emergency should be explained.
Severe action should be stayed automatically unless the registry establishes a narrow emergency. Revocation, reclaim, termination, refusal to recognise an existing holder, suspension of core publication services and irreversible changes to registry state should not take effect while internal and independent review are pending. The stay should preserve the last verified operational state and block only the contested change. If a transfer is disputed, freeze the transfer. If authority is disputed, freeze the instruction. If contactability is defective, preserve the resource while contact is cured. The aim is to protect the ledger without punishing the network.
Internal review should be fast and separate from the original decision. A holder should be able to request reconsideration by a different registry officer or panel with authority to reverse, modify, narrow or stay the decision. The reviewer should address the holder's evidence, not merely repeat the original conclusion. For time-sensitive matters, the reviewer should decide the stay first and the merits second.
Independent registry review should exist for severe cases. It need not be a global court or broad arbitration system. It can be a standing panel or contracted mechanism with technical, legal and operational competence. Its authority should be limited to registry-function decisions: whether AFRINIC may implement an adverse action, whether reasons and evidence are adequate, whether continuity must be preserved, whether a conflict flag should be published, whether the matter should be referred to court, and whether costs should follow overreach or bad-faith obstruction. The panel should not decide every private commercial claim.
Continuity services should be firewalled from disputes. RDAP, Whois, reverse DNS, RPKI, IRR-related services and ordinary contact maintenance should continue unless the specific service is the subject of the dispute or a technical emergency. Litigation over one holder should not impair unrelated holders. Governance disputes should not impair publication services. A board fight should not become a routing-security problem. Dispute isolation is a procedural rule, not a slogan.
The process should also publish aggregate guidance without exposing confidential files. Members should know how many transfer refusals occurred by category, how many abuse-contact matters were cured, how many emergency holds were used, how many revocation attempts were stayed, how long reviews took and what common defects appeared. Aggregate reporting converts rumour into institutional learning. AFRINIC's history of opaque crisis makes that conversion unusually valuable.
Finally, the architecture must be prospective and neutral. It should apply to AFRINIC, Cloud Innovation, small ISPs, public agencies, universities, hosting companies, operators, brokers and future large holders. A safeguard is credible only if it protects the disliked party before the institution knows who will need it. Due process that depends on sympathy is not due process. It is factional discretion with better language.
Such an architecture would not prevent all lawsuits, nor should it. Courts remain necessary for legal rights. But it would change the path to court. The record would contain reasons. The subject matter would be preserved. The disputed action would be narrowed. Cure opportunities would be documented. The registry's proportionality would be visible. Courts could then review a disciplined decision rather than rescue a business from an unexplained administrative threat or rescue a registry from maximalist retaliation.
Infrastructure or gatekeeper
The economics of due process and appeals return to a simple institutional question: what is AFRINIC for? If it is infrastructure, its authority should be narrow, auditable and continuity-preserving. It should keep the ledger accurate, prevent duplicate or fraudulent claims, maintain public registry and security services, record legitimate transfers, isolate disputes and provide review before severe action. If it is a gatekeeper, it will decide which commercial models deserve recognition, when historical reliance can be reopened, how regional scarcity should be trapped and whether a holder's operating asset may survive a first-line decision.
The infrastructure model requires discipline. It may feel less powerful, but it is more durable. Members can rely on it because it does not ask them to accept institutional discretion as fate. Buyers can price it because transfer risk is classified. Banks can understand it because severe action is stayed. Customers can trust it because live operations are not casually used as leverage. Courts can respect it because the registry has already preserved the subject matter and produced reasons. The board can govern without turning every adverse decision into a legitimacy referendum.
The gatekeeper model may feel protective in the short term. It lets the institution speak of stewardship, community, conservation and regional interest. It gives staff and directors tools to act against conduct they dislike or fear. It may satisfy those who see scarce IPv4 as something to be controlled by local policy rather than moved through markets. But it produces predictable costs: litigation, discounting, hidden transactions, reluctance to update records, member fear, court intervention and pressure for alternative continuity arrangements. A gatekeeper registry becomes less trusted precisely because it claims more power.
AFRINIC's recent history shows the cost of confusing the two models. A corruption scandal required stronger ledger controls. A large resource dispute turned enforcement into institutional exposure. Court process preserved some rights while threatening broader continuity. Receivership preserved the shell while governance legitimacy remained contested. Election disputes revealed how authority documents can become economic weapons. IPv4 scarcity made every procedural defect more expensive. The lesson is not that AFRINIC should be powerless. It is that power must be surrounded by notice, reasons, cure, review and stay before it touches live value.
The opening notice on the holder's desk is therefore a test of institutional design. If it gives reasons, a cure path, a preserved operational state and a credible review route, it tells the market that AFRINIC is acting as infrastructure. If it gives broad allegations, short deadlines, severe consequences and review only after damage, it tells the market that AFRINIC is acting as gatekeeper. The difference will be priced into transfers, leases, financings, customer contracts and member relationships.
Due process is often described as fairness. In the AFRINIC setting, that word is too soft. Due process is how scarce-address value survives long enough for truth to be tested. Appeal rights are not ornamental. They are real options over continuity. A stay is not obstruction. It is preservation of the asset under review. Reasons are not legal decoration. They are market information. Cure periods are not indulgence. They are the difference between a fixable defect and a destroyed business.
AFRINIC can still choose the infrastructure model. It would require admitting that legitimacy comes not from being sovereign over African number resources, but from being a reliable, limited and reviewable coordinator of a shared ledger. That is a smaller role than some institutions want. It is also the only role that can carry the economic weight IPv4 scarcity has placed on the registry.