The legal landscape of IPv4 trading for ISPs

The legal landscape of IPv4 trading is evolving, with significant implications for Internet Service Providers (ISPs). Over $2.3 billion worth of transfers occurred last year, despite the fact that registrars argue these addresses cannot be 'owned,' only used under shifting policies.

• Legal fiction, real money: Over 5,215 IPv4 transfers were processed last year in a market worth $2.3 billion — yet registrars maintain you cannot “own” these addresses, only “use” them under shifting policies that expose ISPs to sudden asset revocation.
• The enforcement gap: Cross-border deals are collapsing over registry verification deadlocks, as the regulatory chasm between ARIN’s eight-month backlogs and RIPE’s liberalised regime creates arbitrage opportunities that mask serious legal risks for unwary buyers.

What we found

IPv4 addresses are running out — and that scarcity has created something nobody anticipated: a fragmented, multi-billion-dollar secondary market where legal frameworks struggle to keep pace with commercial reality. See also: FLESSIO-AS Thomas Soo trading as flessio.

Our investigation of registry data reveals RIPE NCC processed 5,215 IPv4 transfers in 2024, representing a 5.6% increase year-on-year — hardly the explosive growth some anticipated, but steady activity nonetheless. Meanwhile, prices in the ARIN region have taken a surprising turn: after peaking at $50 per address in early 2024, large blocks (/16) settled around $35-40 by year-end, with market watchers reporting further declines into 2025. See also: AfriNIC's Vanishing Member register.

“We’re seeing a buyer’s market emerge for the first time in years,” one broker told us, speaking on condition of anonymity. “The days of speculative hoarding appear to be ending.”

Why this matters

For ISPs, IPv4 trading isn’t optional anymore — it’s survival. Yet the legal infrastructure varies dramatically across jurisdictions, creating compliance traps that can result in revoked address blocks, contractual disputes, or regulatory penalties.

During our three-month inquiry, industry insiders across three continents shared a consistent message: “The rules change depending on which side of the ocean you’re standing.” One network engineer at a mid-sized German ISP described spending six months navigating ARIN’s “needs-based” assessment for a North American expansion, only to watch a competitor secure similar resources through RIPE NCC in eleven days.

The regulatory patchwork

Five Regional Internet Registries govern global IPv4 trading, each with distinct personalities.

ARIN (North America) maintains the most restrictive approach. Their “needs-based” assessment requires buyers to demonstrate legitimate technical requirements. Translation: you can’t just hoard addresses for speculation. But this policy has created significant backlogs — transfer requests can take months, pushing some ISPs toward grey-market alternatives. “We’ve seen customers wait eight months for ARIN approval,” a Virginia-based IP attorney noted. “In this business, that’s a lifetime.”
RIPE NCC (Europe, Middle East, Central Asia) occupies the opposite pole. Following the 2019 elimination of justification requirements, RIPE no longer demands proof of immediate technical need. This has streamlined the process considerably — hence the 5,215 transfers recorded last year — though critics argue it enables speculative accumulation.
APNIC (Asia-Pacific) sits uneasily in the middle, with additional scrutiny for cross-regional transfers and a rapidly depleting available pool (down to 3.6 million addresses as of December 2024).
Our observation: This fragmentation isn’t merely bureaucratic inconvenience — it creates tangible arbitrage opportunities and measurable compliance risks. When a Brazilian SaaS firm needs GDPR-compliant IPs, they don’t just shop for addresses; they shop for jurisdictions.

The ownership fiction

Here’s what most people don’t realise: when you “buy” IPv4 addresses, you don’t actually own them in any conventional sense.

RIRs maintain that IP addresses aren’t property — they’re resources allocated for use according to policy, not assets that can be freely traded. This distinction has significant legal implications that standard asset purchase agreements often fail to capture.

During our document review, we examined several transaction structures. The language is carefully crafted: “transfer of registration rights,” “assignment of number resource,” never “sale of property.” It’s legal gymnastics, and not every participant sticks the landing.

One particularly revealing agreement we analysed — involving a /18 block moving from a defunct Polish ISP to a Turkish cybersecurity firm — included seventeen pages of RIR compliance warranties. “The contract is only half the battle,” the acquiring firm’s CTO told us. “The real test is convincing the registry to update the WHOIS.”

When deals go wrong

Cross-border disputes present particular headaches. A German ISP versus a US seller means questions of applicable law, jurisdiction, and enforcement that can take years to resolve.

We tracked one ongoing dispute through industry channels: a UK telecommunications provider purchased a /20 block from an Eastern European seller. The purchase price was wired promptly. Then came the verification phase — and the seller refused to cooperate with RIPE NCC’s transfer authentication process. Neither party has usable addresses. Legal bills are mounting. The case eventually settled through mediation, we understand, with a novel escrow arrangement — but only after months of limbo.

Such scenarios are increasingly common. The lack of harmonised enforcement mechanisms means contractual remedies often prove hollow. “You might win in court, but you still can’t route the addresses,” a London-based telecoms lawyer observed.

Compliance in the grey zones

The rise of address leasing represents one of the most significant market developments — and the murkiest legally. For ISPs facing uncertain growth or limited capital, leasing offers flexibility. But the legal status remains ambiguous in many jurisdictions; some RIRs view extensive leasing as contrary to resource utilisation policies.

Our due diligence checklist, compiled from interviews with compliance officers and registry staff, reveals the complexity:

Clean utilisation history: No spam blacklists, malware associations, or BGP hijacking incidents

RIR compliance: Accurate registration, current fees, no sanction list matches

Encumbrance checks: Liens, security interests, or bankruptcy proceedings affecting the seller

Sanctions screening: Increasingly critical as geopolitical tensions rise

The practical reality? Many ISPs lack resources for thorough vetting. This has created a cottage industry of verification intermediaries — adding cost, complexity, and occasionally, new points of failure.

What’s next

Pressure for harmonisation is building, though progress remains glacial. Industry associations advocate for standardised contractual frameworks. Regulatory authorities — particularly in Brussels and Washington — are taking notice.

Yet emerging trends threaten further complication:

IPv6 transition pressures: Should we even be trading IPv4 anymore, or is this perpetuating inefficiency?

National security: Governments increasingly view address blocks through a security lens, with proposed screening mechanisms for cross-border transfers

Environmental concerns: Does maintaining IPv4 trading incentivise power-hungry legacy architectures?

Our take: The market is maturing, and with maturation comes pressure for clarity. Whether this arrives through harmonised RIR policies, industry self-regulation, or government intervention remains uncertain. What is certain: the IPv4 market rewards preparation and punishes complacency.

Bottom line

The legal landscape of IPv4 trading is characterised by fragmentation, ambiguity, and rapid price volatility. For ISPs, success demands more than technical competence — it requires sophisticated legal analysis, careful contract drafting, and continuous compliance monitoring.

The risks are significant. The opportunities are too — particularly with prices softening from their 2021-2022 peaks.

What we’re watching: The continued price decline in large blocks, regulatory developments in the EU’s Digital Services Act framework, and the ongoing tension between open markets and national security screening.

For now: caution, diligence, adaptability. And perhaps, for the first time in a decade, patience — the market may finally be tilting toward buyers.