AFRINIC and the economics of small operator dependency

The registry as a dependency surface

For a small network, a regional internet registry is not a distant constitutional layer. It is part of the cost of selling connectivity. A large cloud platform can treat registry procedure, legal review, waiting time, address reputation, routing paperwork and board politics as overhead. It can hire counsel, maintain spare address inventory, operate across regions and absorb delay into a global planning model. A small ISP, hosting firm, regional carrier, data-centre operator or managed-network business experiences the same layer differently. It is a dependency surface: a place where a request can slow down, a transfer can become harder, a record can become contested, a policy can shift, and a customer project can be postponed for reasons outside the operator's own engineering competence.

AFRINIC is formally the Regional Internet Registry for Africa and the Indian Ocean region. Its public materials describe a nonprofit, member-based organisation registered in Mauritius, responsible for IPv4, IPv6 and Autonomous System Number administration and for services such as WHOIS, RDAP, reverse DNS, Internet Routing Registry functions, DNSSEC support and RPKI-related resource certification. That description is useful, but only as a starting exhibit. It explains what the institution does; it does not settle the economics of dependence. A registry sits at the recognition layer of resources that networks use to route traffic, identify services, satisfy customers, configure firewalls, publish abuse contacts and maintain continuity.

The revealing unit of analysis is not the RIR insider, the multinational platform or the litigant with the deepest pockets. It is the ordinary operator with limited capital, a thin staff, imperfect documentation and customers who expect service now. AFRINIC's long governance crisis, IPv4 scarcity, contested transfer rules and public disputes around leasing are often narrated as struggles among institutions, personalities and legal theories. For smaller operators, the same events are more prosaic. They change the cost of expansion, the credibility of delivery promises, the price of address capacity, the effort required to satisfy counterparties and the risk premium attached to every plan using AFRINIC-recognised resources.

Heng Lu's public notes are useful here because they frame the matter as institutional economics rather than ceremonial governance. They argue that a needs-based registry system inside an unequal market does not cancel inequality; it formalises existing scale, documentation capacity and procedural familiarity. They also argue that registry power became more consequential once IPv4 scarcity turned number resources from administrative entries into scarce operational capital. Those notes come from a market participant and AFRINIC antagonist, so their claims should not be read as neutral findings. But the mechanism they identify is not hard to test. Fixed administrative burdens are regressive. Discretion is easier for large actors to absorb than for small ones. A recognition layer with limited financial downside can impose very large continuity costs on operators below it.

The official RIR, NRO, AFRINIC and ICANN materials are therefore best used as factual exhibits: dates, functions, statements, court-adjacent developments and policy descriptions. They should not be treated as the authoritative frame for the cost borne by small operators. The frame is the operator's balance sheet. The question is how a small network prices a system in which its ability to serve customers depends on scarce IPv4, registry records, policy interpretation, court continuity, board stability, transfer approval and the credibility of other parties in the chain. In that setting, the real cost is not only the fee schedule or the price per address. It is the trust tax.

Scarcity turns procedure into a regressive fixed cost

IPv4 scarcity is usually explained with totals: a 32-bit address space, depleted free pools, final-pool rules, rising market prices and the long-delayed transition to IPv6. Totals matter, but they hide the distributional effect. Scarcity is not merely a shortage of numbers. It is a system that makes every administrative decision more valuable. When a registry ticket is slow, when a transfer rule is unclear, when an allocation is capped or when a policy phrase is contested, the cost is not evenly spread. The small operator pays a higher share of its balance sheet for the same unit of institutional friction.

AFRINIC's own exhaustion page records the broad timeline. IANA's remaining IPv4 pool was distributed to the five RIRs in 2011. By September 2015, APNIC, ARIN, LACNIC and the RIPE NCC had exhausted their free pools in the relevant sense and were allocating under special final-pool rules. AFRINIC entered Soft-landing Phase 1 in March 2017 and Phase 2 in January 2020. In Phase 2, the public page describes a minimum allocation or assignment of /24 and a maximum of /22 per request, subject to evaluation and efficient-use requirements.

Those details are often presented as stewardship. For a small operator, they are rationing rules with operating consequences. A /24 is 256 addresses, enough for some entry-level uses but not for a fast-growing access network, hosting platform or regional service business with multiple sites. A /22 is 1,024 addresses, still modest relative to many customer-acquisition plans. If the operator needs more, it must return to process, prove efficient use, consider transfers, lease capacity, deploy more address-sharing mechanisms, push IPv6 where customers and applications permit, or postpone sales. Scarcity moves from policy text into the sales funnel.

The poverty-penalty argument in Lu's notes makes the fixed-cost point directly. A needs-based allocator reads documented demand. Documented demand is easier to produce when an organisation already has customers, engineers, accountants, counsel and experience with registry procedure. The rule does not need to intend inequality to reproduce it. A larger incumbent can package demand, survive waiting time and spread compliance cost over many subscribers. A small network may have the market opportunity but not the administrative surplus. The same gate becomes a lighter burden for those who already have scale.

This is why a nominally low registry fee can mislead. A small operator does not pay only the invoice. It pays for staff time, document preparation, repeated clarification, uncertainty during customer negotiation, slower deployment, routing changes if it receives non-contiguous prefixes and the possibility that the next request will be judged differently from the last one. It also pays for scarcity in the market, because a capped administrative allocation pushes unmet demand into leasing or transfers.

The more valuable IPv4 becomes, the more expensive it is to wait. Internet Governance Project reported in 2021 that transfer-market prices had risen from about USD 8 per address in 2017 to about USD 30 by 2021, making a /16 worth roughly USD 2 million. At that price, even a /22 represents more than USD 30,000 in address value before legal, routing and transaction costs. For a national incumbent or global platform, that can be a line item. For a smaller hoster or access network, it may be the difference between launching a location and deferring it.

Scarcity therefore has two prices. One is the visible price of addresses. The other is the fixed cost of navigating institutions that ration, recognise or restrict them. The second price is less visible, but it is often the one that makes small operators dependent.

Non-property still creates balance-sheet exposure

Internet number resources are not ordinary inventory. A carrier cannot manufacture them. A hosting firm cannot substitute a new identifier at will if its customers, counterparties and security systems still require stable IPv4 reachability. A regional access network cannot assume every application, bank, public agency, firewall, supplier and customer device is ready for an IPv6-only world. Addresses are technical identifiers, but in an operating business they become economic memory. They appear in allowlists, abuse histories, geolocation records, customer contracts, firewall rules, monitoring systems, reverse DNS, routing policies and compliance paperwork.

That is why the legal phrase "not property" does not end the analysis. The orthodox registry view is that IP addresses are public number resources allocated or assigned under policy, not property owned like land or machinery. ICANN made a related point in 2026 when, according to The Register, it intervened in Cloud Innovation's winding-up application and said numbering resources allocated through AFRINIC should not be treated as AFRINIC assets available for distribution in a winding-up. That principle protects the numbering system from being divided like a corporate estate.

But non-property does not mean non-reliance. A licence, concession, service entitlement or recognised registration can carry economic value even if it is not a property deed. The small operator's bank does not care only about legal theory. It cares whether a customer contract can be served, whether a prefix will remain usable, whether the registry record is stable, whether the address history is clean enough for mail and hosting, whether the business can pledge predictable revenue and whether renumbering risk is manageable. The registry record is not a balance-sheet asset in the simple property sense, but the business built around it certainly has balance-sheet consequences.

Lu's public criticism of the RIR model emphasises the gap between practical control and contractual exposure. His notes point to liability caps and administrative-scale budgets as evidence that registries may exercise high-consequence recognition power without balance-sheet responsibility matching the damage an operator might suffer. That argument is adversarial, and readers should remember that Lu is connected to Cloud Innovation and LARUS. Yet the dependency mechanism is real. If a registry decision, delay or dispute can affect address recognition, transferability or continuity, the operator must price that risk even when legal recovery would be small or uncertain.

For small operators, the problem is acute because they cannot diversify registry exposure easily. A global platform can hold addresses across regions, buy secondary-market blocks, maintain legal teams, lease in different markets, build internal address-planning systems and negotiate with many counterparties. A regional ISP may have one registry relationship, one counsel, a modest operations team and limited cash. If a request is delayed, if a transfer seller loses confidence, if policy changes reduce mobility or if a dispute makes a prefix harder to finance, the operator cannot simply optimise around the problem at global scale.

This is the quiet dependency. Operators are told that the registry is a neutral coordinator. In daily engineering, that can be true enough. In scarcity, litigation or policy conflict, the same institution becomes part of working capital. The small operator's problem is not that AFRINIC charges too much in ordinary fees. It is that AFRINIC's recognition layer can condition resources whose business value is far larger than the fee model suggests.

Delay and opacity are financing costs

Delay is often treated as inconvenience. For small operators it is a financing cost. A delayed address request can defer a customer installation, a data-centre rack, a broadband expansion, a managed-firewall rollout, a cloud-hosting cluster or a migration away from an unreliable upstream. It can also turn a signed letter of intent into lost revenue if the customer chooses a competitor with capacity already in hand. The larger the operator, the easier it is to keep spare inventory. The smaller the operator, the more likely it is that addresses are acquired close to the moment of need.

AFRINIC's exhaustion procedure shows how delay becomes institutionalised even when a rule is designed for fairness. Complete applications proceed to evaluation; incomplete applications require case-by-case interaction; approval in Phase 1 was grouped; a reserved prefix could be held while payment and the Registration Service Agreement were completed; additional requests required efficient use of already delegated space. These controls are understandable in a scarce pool. They are also a reminder that access is not immediate. The address is not simply bought from a shelf.

In ordinary times, such process may be predictable enough. During institutional stress, the same process becomes harder to price. The Register reported that AFRINIC's complex legal matters left it unable to elect a board or carry out many functions from 2022 to 2025. Its February 2026 reporting described signs of recovery, including improved morale, interim management appointments, a pending budget and action plan and work on a 2027-2030 strategy. The positive news matters, but so does the admission contained inside it: for years, the registry's ordinary institutional rhythm was impaired.

The cost of that impairment does not fall mainly on those who follow internet governance as a profession. It falls on operators who need routine services to be boring. They need updates processed, contacts maintained, reverse DNS functioning, transfer status clear, tickets answered, invoices handled, RPKI repositories reliable and public records trusted by counterparties. When the institution becomes a news story, every routine dependency becomes harder to explain to a customer, lender or board.

Opacity then compounds delay. Policy opacity is not only a problem of unclear text. It is a market structure. If rules require specialist interpretation, the people who understand them acquire power. If participation occurs on mailing lists, committees, elections and procedural channels that most operators do not follow closely, the active minority becomes more influential than the passive majority. If the consequences of a rule are economic but the debate is conducted in governance vocabulary, operators who sell connectivity for a living may find themselves priced out of attention before they are priced out of address space.

Lu's first AFRINIC governance note argues that "community ownership" can become a phrase under which a small circle of insiders exercises practical control. That claim should be treated as a viewpoint from a party to the wider struggle, not as a neutral court record. But the general agency problem is familiar. In member organisations, those who attend meetings, write proposals, understand bylaws, manage proxies and cultivate procedural memory can dominate outcomes when ordinary members are busy running businesses. Low participation does not mean consent; it often means the cost of participation exceeds the perceived benefit until a crisis arrives.

AFRINIC's recent election history illustrates the fragility of legitimacy under low-trust conditions. The Register reported that a receiver scheduled elections after years without a board, appointed senior legal figures to oversee nominations and cited concerns about potential interference. It later reported allegations involving powers of attorney, the suspension and annulment of the June 2025 vote, ICANN questions and a continuing lack of full public clarity around what happened. Those allegations should not be treated as final findings against every named party. The small-operator point is simpler: when the machinery of representation itself becomes uncertain, governance risk becomes an operating input.

Opacity changes bargaining power because it makes exit harder. A small operator considering whether to acquire, lease or transfer IPv4 must ask not only what the rule says today but how the rule may be read tomorrow. It must ask whether a transfer will be reviewed narrowly or broadly, whether regional-use concepts will be enforced prospectively or retroactively, whether member status is secure, whether a board has the legitimacy to ratify policy, whether a court order affects the parties and whether counterparties will accept the registry's record without discount. These are not engineering questions, yet they determine engineering plans.

The official language of openness can miss this. An open meeting is not the same as usable governance. A public archive is not the same as low-cost comprehension. A member vote is not the same as informed consent by all affected operators. The economic question is whether a busy ISP with modest staff can predict the rules that affect its customers. If not, openness has not solved dependency. It has merely documented it.

Court and board instability create a risk premium

AFRINIC's court and board troubles matter to small operators because they convert institutional uncertainty into market pricing. A registry in litigation is not just an organisation defending itself. It is a recognition layer whose continuity, authority and future policy choices are being discounted by everyone who depends on its records. The discount may not appear as a line item. It appears in slower contracts, more cautious transfers, higher legal spend, customer questions, hesitant investors and suppliers who prefer cleaner jurisdictions.

The public chronology is extensive. Internet Governance Project reported in 2021 that AFRINIC's dispute with Cloud Innovation led to a court-ordered freeze affecting up to USD 50 million of AFRINIC funds. IGP criticised both AFRINIC's enforcement approach and Cloud Innovation's legal tactics, arguing that the dispute had become disproportionate to the stakes. The Number Resource Organization later welcomed the appointment of an official receiver in Mauritius to preserve AFRINIC's business, oversee elections and move the registry back toward functional governance. The Register has since reported election planning, annulled voting, proxy allegations, ICANN warnings, a later recovery effort and renewed litigation.

These events should not be compressed into a single conclusion about who is right. Some allegations remain allegations. Some court orders are interim. Some public statements are strategic. AFRINIC has accused Cloud Innovation, LARUS and associated campaigns of trying to paralyse it. Lu has replied that the deeper issue is registry power over economically critical resources without commensurate liability. ICANN has intervened to explain AFRINIC's systemic role and the non-asset status of number resources. Each actor has incentives. The small operator's problem is not to choose a slogan; it is to operate while the slogans affect the market.

Risk premiums are rational under such conditions. If AFRINIC's board is stable, its policies clear, its resource reviews predictable and its services routine, a small operator can plan. If board authority, member status, bylaw reform, transfer policy or litigation exposure remains contested, the operator must add a margin of safety. That margin can take the form of leased backup space, more conservative customer commitments, extra legal review, shorter contracts, delayed expansion or a preference for resources from another region. All of these choices cost money.

The premium is asymmetric. A large holder can litigate. A small ISP may not even have standing in the dispute that disrupts its plans. A large lessor can employ counsel and public-relations advisers. A small hosting firm may simply find that a customer asks uncomfortable questions about where its addresses come from. A global platform can route around a region. A national access network cannot easily route around its local registry. The party least able to influence the institutional fight may be one of the parties most exposed to its consequences.

Board instability also matters because policy in scarcity markets changes asset value. The Register reported in March 2026 that AFRINIC had adopted a transfer policy that in many circumstances prevents members from transferring assigned IPv4 assets outside the region it administers, and that supporters saw the policy as frustrating business models based on treating African-issued resources as liquid inventory for global leasing or export. Supporters may see regional protection; critics may see lock-in. Small operators must price both possibilities. A rule that protects local supply may also reduce liquidity, restrict collateral value, narrow exit options and make financing harder.

The most damaging feature of instability is that it contaminates ordinary transactions. A routine address plan becomes a governance question. A customer contract becomes a legal-risk conversation. A transfer becomes a test of policy legitimacy. That is how court and board instability move from headlines into small-operator economics.

Capital rationing is the daily form of dependency

Small operators live with capital rationing. They cannot fund every fibre route, base station, peering upgrade, data-centre rack, router refresh, support hire, security tool and customer acquisition plan at once. IPv4 scarcity adds another claim on scarce cash. Worse, it adds a claim whose legal and operational nature is hard to explain to non-specialists. A lender understands equipment. A landlord understands a data-centre lease. A customer understands bandwidth. IPv4 is harder: not exactly property, not exactly a commodity, not optional in many environments and surrounded by registry rules.

Buying addresses in the secondary market ties up capital before revenue arrives. Leasing preserves cash but creates recurring expense and counterparty dependence. Waiting for registry allocation may preserve cash but creates delay and uncertainty. Using carrier-grade NAT, shared hosting, address conservation and IPv6 can reduce demand but may impose engineering complexity or customer limitations. There is no free choice. Scarcity makes address planning a capital-allocation problem.

The smaller the operator, the harsher the trade-off. At the 2021 prices cited by IGP, a /22 implied roughly USD 30,000 of address value. Prices have varied since, and exact quotes depend on block size, registry region, reputation and transaction structure. But the order of magnitude is enough. A small operator choosing between IPv4 and equipment may delay infrastructure. A hosting firm choosing between owned addresses and leased addresses may accept a recurring cost that narrows margins. An ISP that cannot obtain enough addresses may turn away customers or use architectures that reduce service quality for some applications.

Lu's notes on IPv4 assetisation argue that scarcity should strengthen operators by giving them access to a scarce base-layer asset. His critics would say that treating addresses as assets encourages hoarding and extraction. The small operator sits between the arguments. If addresses are fully commoditised, rich actors can buy more. If addresses remain rationed through discretionary process, rich actors still have advantages because they can document, wait, lobby and litigate. The poorer operator does not escape inequality merely because the price is hidden inside procedure.

IPv6 does not remove the near-term problem. The long-run technical case for IPv6 is strong; the short-run business case is uneven. Many customers, applications, monitoring systems, payment systems, security processes and counterparties still require IPv4 reachability. Dual-stack operation can mean two protocol environments, two sets of troubleshooting practices, address translation, customer education and equipment constraints. For a small operator, IPv6 is not a magic escape from IPv4 scarcity. It is another project competing for capital, staff and customer tolerance.

The result is a capital-rationing trap. The operator needs IPv4 to grow revenue, but acquiring IPv4 consumes cash or adds recurring cost. It needs registry predictability to plan, but registry uncertainty increases the cash buffer required. It needs scale to lower the per-customer cost of compliance, but compliance costs slow the path to scale. Large operators can use size to break the loop. Small operators often cannot.

That is why AFRINIC's remaining pool matters even when it is small by global standards. The Register reported a February 2026 figure of 773,376 unallocated IPv4 addresses. Against global demand, this is not enough to transform African connectivity. For a small operator, however, access to even a modest block may affect a concrete project. Scarcity at the macro level becomes rationing at the micro level.

Transfer friction and the price of being local

The politics of regional stewardship become most concrete in transfer rules. AFRINIC exists to serve Africa and the Indian Ocean region. It is therefore unsurprising that many actors want African-issued number resources to support regional development rather than flow outward to richer markets. The concern is intuitive. If scarce resources allocated under a regional framework can be exported or monetised globally, local operators may face higher prices and reduced availability. But the economic answer is not as simple as keeping addresses inside a border drawn by registry service regions.

IPv4 is globally routable. Customers, hosting firms, CDNs, VPN networks, security services, cloud platforms and multinational operators do not always fit clean regional categories. A business registered in Africa may serve customers abroad. A hosting company may announce prefixes from data centres outside the region. An access network may use global upstreams and remote infrastructure. A small operator may need to import addresses because local supply is insufficient. A regional transfer rule that ignores this complexity can raise costs even when it is designed to protect the region.

The market effect depends on liquidity. If a resource can move to the highest-valued use under clear rules, it attracts more counterparties and potentially more capital. If movement is restricted, holders may accept a regional discount, buyers may face a narrower supply set and lenders may discount the resource because exit is harder. Supporters of lock-in may view that discount as a necessary cost of regional protection. Critics see it as value destruction imposed on resource holders. Small operators need a narrower answer: does the rule lower their actual cost of usable addresses, or does it merely move scarcity into another procedural channel?

If transfer friction keeps some addresses in the region but makes every transaction slower, more uncertain and more legalistic, small operators may still lose. A large incumbent with staff and counsel can navigate friction. A smaller ISP may face higher transaction costs, fewer sellers willing to engage and counterparties that demand more due diligence. The resource may be nominally local but practically inaccessible. That is a familiar development problem: a policy protects supply in theory while administrative complexity keeps supply away from the weakest buyers.

IGP's 2021 analysis was sceptical of strong regional-use enforcement in the Cloud Innovation dispute, arguing that Africa's future growth could not be sustained by AFRINIC's remaining IPv4 alone and that the region would need imports from the market or greater IPv6 reliance. That conclusion is contested, but it captures the arithmetic. Africa's internet growth is not waiting politely for residual IPv4. Operators need addresses from somewhere, and if import channels are difficult, the cost of growth rises.

Transfer friction also affects trust in title. A buyer or lessee must know whether a block can be transferred, leased, routed, financed or reassigned without later challenge. If the policy boundary is unclear, due diligence expands. The parties ask whether the original allocation date matters, whether regional use is required, whether the current holder remains in good standing, whether customer geography matters, whether leasing counts as use or evasion and whether a future board might reinterpret the rule. Each question adds cost. Some deals fail because the expected margin cannot support the uncertainty.

The price of being local should not be romanticised. Local operators are not strengthened by a regional slogan if they cannot obtain capacity on predictable terms. They are strengthened by rules that make usable supply visible, transfers predictable, abuse and record checks reliable and remedies proportionate. A regional policy can serve small operators only if it reduces their dependency cost. If it merely lowers liquidity while leaving discretion high, it protects the idea of regional resources more than the businesses trying to use them.

Leasing transfers risk, but it does not remove it

Leasing exists because operators need a way to convert scarce IPv4 from a capital purchase into an operating input. For a small hosting firm or ISP, that can be rational. It avoids a large upfront purchase, reduces the need to become the direct registry-facing holder and can match address cost to customer revenue. In a market with uncertain registry rules and high address prices, leasing is not just a cheaper substitute for buying. It is a way to place risk elsewhere.

LARUS's public materials state this logic openly. Its first-party leasing pitch says customers can lease production IPv4 directly from LARUS's own pool, avoid broker chains, keep registry-layer contract exposure upstream and buy continuity controls around routing validity, reverse DNS, abuse handling, geolocation support, service levels and renewal certainty. The marketing is plainly interested. LARUS and Cloud Innovation share leadership with Heng Lu, and AFRINIC has disputed some public representations connected to LARUS and Cloud Innovation. The Register reported in May 2026 that AFRINIC challenged claims around a "Court-Ordered Shareholder-Position Continuity Structure" and that Cloud Innovation and LARUS rejected AFRINIC's characterisation, saying the order did not decide leasing, ownership or their business model.

Those caveats matter. Small operators should not treat any lessor's continuity claim as self-proving. A lease can reduce one risk while adding another. The operator must understand who controls the block, whether the lessor is the legitimate holder, what the registry record says, what happens if the lessor is in dispute, how abuse reports are handled, whether RPKI and routing objects are maintained, whether reverse DNS is delegated, whether geolocation can be corrected and what renewal rights exist. Leasing is not magic. It is a contract stack.

Yet the existence of leasing demand reveals something about registry dependency. If direct holding were inexpensive, clear, portable and legally robust, fewer operators would pay a premium for someone else to absorb the registry interface. Leasing grows when operators prefer predictable use over formal proximity to the registry. That preference is especially strong for small firms that cannot afford to become test cases in policy disputes.

Leasing also changes the meaning of "capacity". In Lu's public note on network identity, he argues that some addresses become external memory: customers trust them, banks recognise them, suppliers whitelist them, firewalls encode them and compliance records depend on them. For those addresses, the cost of change is not the price of the IP. It is the cost of renumbering a business relationship. Small operators understand this because they field the support calls when a customer's mail reputation fails, a geolocation database is wrong, a payment platform blocks access or a firewall rule breaks after migration.

That is why continuity has become a product category. The customer does not merely need 256 numbers. It needs addresses that remain usable long enough to justify customer onboarding. A small operator leasing addresses for a production service must care about renewal terms, notice periods, abuse-handling discipline, routing security and whether the block could be pulled into someone else's dispute. A cheap lease without continuity may be more expensive than a costly lease with credible controls.

Leasing can therefore mitigate capital rationing while deepening due diligence. It lets a small operator grow without buying a block, but only if the chain is clear enough that customers will trust the service. If the chain is opaque, leasing simply moves shadow allocation into the commercial layer. The dependency remains; it has been rearranged.

Due diligence is the trust tax in operational form

In a thin-trust IPv4 market, due diligence becomes part of network operations. A small operator acquiring or leasing addresses must evaluate technical quality, legal status, registry risk and counterparty reliability. Each category contains traps. The address may be routable but polluted by abuse history. It may have clean reputation but uncertain transfer status. It may be available quickly but lack usable reverse DNS. It may have a good price but be tied to a holder in litigation. It may be offered by a broker who cannot explain the full chain.

The technical checklist is already long. The operator must review BGP visibility, route-origin authorisations, IRR objects, route filtering, RPKI status, geolocation databases, spam and malware reputation, blacklists, reverse DNS delegation, abuse contacts, WHOIS or RDAP accuracy and compatibility with upstreams. For a large network, these tasks may be distributed across teams. For a small firm, they may fall to one engineer who is also responsible for customer support and deployment.

The legal and institutional checklist is harder. The operator must know which registry recognises the resource, whether the holder is current on obligations, whether a transfer is allowed, whether regional restrictions apply, whether the address block was originally allocated under conditions that still matter, whether a lease is permitted or merely tolerated, whether the lessor can renew and whether any court order or public dispute affects confidence. These questions are not answered by a ping test.

KrebsOnSecurity's 2019 report on alleged AFRINIC address-record manipulation is a warning about why diligence cannot be skipped. Krebs reported allegations arising from Ron Guilmette's investigation that address blocks associated with African entities had been commandeered or sold through companies linked to an AFRINIC insider, with estimated market value above USD 50 million, and that AFRINIC said it was investigating. Those allegations should be attributed as allegations unless adjudicated. But they show why historical record integrity matters. A block can look usable in routing while carrying a disputed past.

The cost of diligence is again regressive. A global buyer can pay for specialist review. A small hosting firm may rely on the seller's statements, a broker's reputation or a quick public lookup. The result is a trust gap. Good counterparties suffer because buyers cannot easily distinguish them from risky ones. Bad counterparties exploit the same confusion. The market charges everyone through higher caution, slower closing and more expensive warranties.

This is the trust tax at its most practical. A small operator may pay less per address through an obscure channel but more later in support cost, customer churn or legal exposure. It may choose a better-known lessor at a higher recurring price because the due-diligence burden is lower. It may avoid transfers entirely because the process is too complex. It may stay dependent on an upstream carrier's addresses and accept carrier lock-in. Each choice is shaped by the cost of verifying trust.

AFRINIC could lower this cost by making risk categories clearer without pretending that every commercial detail belongs in the public registry. A block that is internally used, customer-assigned, leased first-party, brokered, pending transfer, under dispute or subject to remedial review does not have the same risk profile. Current registry records often do not expose those categories in a way that helps downstream operators. The absence of visible categories forces each buyer or lessee to reconstruct the story privately.

The goal is not to publish confidential customer contracts. It is to reduce avoidable ambiguity. Small operators benefit when the record tells them enough to price risk without hiring a legal department. A registry that wants to serve the regional network economy should treat due-diligence cost as part of the access problem.

Hidden prices do not help poorer operators

The strongest rhetorical defence of strict regional control is that markets may move resources away from poorer operators. The concern is legitimate. Richer buyers can outbid poorer ones. Large cloud platforms and global telecoms can absorb prices that small African networks cannot. But the comparison is incomplete if it treats pre-market registry allocation as an egalitarian baseline. The historical system did not distribute IPv4 according to poverty. It distributed according to documented need, timing, institutional readiness and network scale.

Lu's public notes stress this point with uncomfortable arithmetic. They cite global distribution patterns in which the United States and China hold more than half of allocated IPv4, while the AFRINIC region accounts for a small share of the global total. They also highlight concentration within Africa, with South Africa, Egypt and Morocco holding a large share of African sovereign-state allocations while many smaller states hold very little. The exact figures should be read as a cited public-data argument, not as a substitute for a fresh statistical audit here. The direction is unsurprising. Networks with earlier development, more capital and larger customer bases documented more need.

The policy lesson is that hiding price inside procedure does not make access pro-poor. It may make access less legible. A small operator can see a market quote and decide whether a customer project supports it. It can seek financing, lease instead of buy, pass cost through, delay expansion or pursue IPv6-heavy designs. A discretionary gate is harder to manage. The operator may not know how long approval will take, whether documentation is enough, whether policy interpretation will change or whether a future resource review will question its use. Uncertainty is not a subsidy.

Indeed, hidden prices often favour incumbents. A large operator can maintain policy staff, attend meetings, build relationships, keep spare inventory and wait out delay. A small operator pays in founder time, lost customer confidence and deferred revenue. The result can be less competitive entry, not more regional development. The incumbent may not need to oppose the small operator directly; the institution's fixed costs do some of the work.

This is not an argument for laissez-faire address markets without fraud controls. IPv4 markets can be distorted. Address reputation can be laundered. Leasing chains can hide responsibility. Transfers can create abuse windows. Historical records can be stale or manipulated. A purely private market with weak verification could harm small operators by making them buyers of last resort for bad blocks. The answer is not to choose between mythology and anarchy. It is to build transparent mechanisms that lower the cost of trustworthy access.

For poor or capital-constrained operators, the most valuable reform is predictability. They need published service expectations, clear transfer criteria, narrow documentation requests, current public status, reliable abuse and routing data, proportionate enforcement and dispute processes that do not destroy innocent downstream users. They need to know what facts matter and what remedies follow from which failures. They do not need a sermon about stewardship that leaves them waiting in a queue or paying consultants to decode a mailing-list argument.

Development policy should be honest about what helps connectivity. Subsidised backhaul, power reliability, competitive wholesale markets, local peering, capable IXPs, access to finance, equipment supply, training and customer affordability all matter. IPv4 governance is one input among many. Treating residual IPv4 control as the main instrument of justice can distract from those larger costs while still making address access harder for small firms.

The poor do not benefit from prices that are invisible. They benefit when prices, risks and rules are visible enough to plan around.

What would lower the dependency cost

The first requirement is a narrower and more predictable registry role. AFRINIC's essential function is to preserve uniqueness, maintain accurate records, publish reliable registry services, process legitimate updates, support routing-security functions and enforce clear rules against fraud or serious breach. The more the registry becomes a broad business-model supervisor, the more small operators must treat it as a discretionary risk. A thinner role does not mean weak record integrity. It means discipline about what the registry is competent and legitimate to decide.

The second requirement is procedural clarity. Operators need published expectations for ticket handling, transfer review, reverse DNS changes, RPKI support, contact updates, invoice issues and dispute flags. Regional objectives, if enforced, should state which resources are affected, which dates matter, what counts as regional connection, how multinational networks are treated, what facts must be updated and what remedy follows if use changes. Ambiguity may preserve institutional flexibility, but it shifts risk to operators.

The third requirement is a beneficial-use vocabulary. Formal registration and economic use are not always identical. A registered holder may use space internally, assign it to access customers, lease it first-party, work through brokers, provide managed hosting, operate anycast infrastructure or support customers across borders. These categories do not require publication of sensitive customer contracts. They require enough classification to distinguish low-risk commercial use from suspicious record drift or concealed control.

The fourth requirement is proportional remedy. Fraud, forged records, nonpayment, abandonment and deliberate deception require strong tools. Incorrect contact data, unclear customer use, missing abuse information or good-faith policy disagreement should not automatically point toward resource destruction. Intermediate remedies such as correction orders, compliance plans, transfer pauses, independent review and customer-protection windows would protect both the registry and downstream users.

The fifth requirement is governance hygiene and service continuity. Member status, proxy rules, voting authority, board minutes, financial statements and legal exposures must be boringly clear. WHOIS, RDAP, reverse DNS, IRR and RPKI should have continuity plans that survive receivership, board dispute or court action. Small operators need failover of function, not theatre around institutional rank.

Finally, the system should measure the right outcome. The metric is not whether the registry can assert control. It is whether operators can obtain, maintain, transfer, lease and use number resources with enough predictability to serve customers. Control that raises dependency cost is not development. Predictability that lowers small-operator risk is.

Uncertainty and watchpoints

The legal picture remains unsettled. Cloud Innovation's disputes with AFRINIC, the winding-up application, ICANN's intervention, public-statement disputes around leasing claims and bylaw or member-status questions should be followed through court records and primary orders where possible. A public claim about a court order is not the same as the order. An interim order is not a final ruling on IPv4 leasing. An intervention to explain non-asset status is not a complete answer to operator reliance. Small operators should watch decisions, not slogans.

The second watchpoint is AFRINIC's operational recovery. The February 2026 signs reported by The Register were encouraging: a board in place, interim management, a budget and action plan in prospect, strategy work under way and improved morale. The test is whether recovery becomes routine. Are tickets handled predictably? Are meetings held? Are accounts and legal exposures clear? Are resource requests, transfer reviews and member communications timely? A stable board matters only if it makes service boring again.

The third watchpoint is the remaining IPv4 pool. A figure of 773,376 unallocated IPv4 addresses, reported in February 2026, is small relative to continental need but meaningful for individual projects. How AFRINIC handles that pool will reveal whether scarcity becomes a predictable phase-out or a source of continuing dispute. If allocations are slow, opaque or politicised, small operators will continue to seek alternatives in leasing and transfer markets. If the process is clear, some dependency cost can be reduced even under scarcity.

The fourth watchpoint is transfer and regional-use implementation. Rules that restrict outbound movement may be defensible if they actually improve local access and are applied clearly. They will damage small operators if they reduce liquidity, increase legal uncertainty and leave ordinary buyers unable to obtain usable space. The practical question is not whether "regional" sounds fair. It is whether the rule lowers the cost of trustworthy address supply for networks that serve customers.

The fifth watchpoint is record integrity. The 2019 KrebsOnSecurity allegations remain relevant because they concern the credibility of the registry database itself. AFRINIC and the wider community should want visible closure, remediation and controls, not because every allegation is already proven, but because unresolved record doubts raise the diligence cost for everyone. A registry whose records are trusted lowers market friction. A registry whose records require detective work raises it.

The sixth watchpoint is leasing maturity. First-party leasing, brokered leasing, managed hosting and customer assignments should not be treated as one undifferentiated shadow. The market will mature if contracts become clearer about renewal, routing support, abuse handling, geolocation, RPKI, reverse DNS and dispute contingencies. It will become more dangerous if address use moves into opaque chains precisely because official channels remain costly or uncertain. AFRINIC can reduce shadow behaviour by making legitimate categories visible.

The final watchpoint is the behaviour of small operators themselves. If they increasingly avoid direct holding, prefer leases, demand portability, insist on registry-risk warranties or delay expansion because address access is too uncertain, that is market evidence. It says the cost of dependency is too high. If they participate more actively in governance because the benefits finally justify the time, that is also evidence. It says the institution is becoming relevant to those it claims to serve.

AFRINIC's small-operator problem is therefore not a side issue. It is the clearest test of whether registry governance serves the networks below it. Large actors can absorb uncertainty, fight it or profit from it. Small operators must turn it into monthly prices and customer promises. When registry delay, policy opacity, board instability, IPv4 scarcity and transfer friction converge, they pay through capital rationing, due diligence and lost optionality. The cost is not only addresses. It is trust. A registry that lowers that tax will strengthen the region. A registry that keeps it hidden inside procedure will make dependency look like stewardship while small operators carry the bill.