ARIN and the economics of escrow and settlement trust

Summary

• ARIN-region IPv4 transfers depend on a sequence in which buyer funds, seller cooperation, registry review, public record movement and network cleanup do not happen at the same moment.
• Registry finality is the strongest public event for private escrow instructions, but it does not certify payment quality, corporate authority, routing usability, address reputation or every post-closing obligation.
• Settlement trust works best when authority evidence, recipient qualification, bank review, ticket sequencing, record completion, refunds, disputes and technical holdbacks are assigned to the parties that control them.
• The institutional boundary is the conclusion: ARIN should not hold purchase funds, and private escrow providers should not become hidden registries for scarce Internet number resources.

Settlement trust begins with non-simultaneity

On closing day, the easiest part of an IPv4 transfer may be proving that the buyer has money. The funds can be wired to a neutral custodian and sit ready for release. The seller can produce a signed agreement, a board approval, a notarized officer letter and a promise to cooperate with the registry request. Counsel can agree that the bargain is real. A broker, if one is present, can say that counterparties have found one another and that the commercial spread has narrowed enough for a transaction. Yet the deal is still not final in the only sense that matters to outsiders. ARIN has not completed the registry update. The public record has not moved. The route-security and reverse-DNS tail has not been cleaned. The buyer has paid for a future state that private documents can describe but cannot create by themselves.

That gap is the settlement problem. An ARIN ticket is not a bank wire. A bank wire is not registry recognition. Registry recognition is not by itself a routing handover. A working route does not clean reputation, update every customer dependency or eliminate the risk that an old authority dispute appears after money has moved. IPv4 transfers close across institutions that are necessary, mutually dependent and not simultaneous: private contract, payment custody, corporate authority, registry review, public registration, routing security, reverse DNS, reputation remediation, customer migration and post-closing dispute handling. The economic question is not whether participants can trust one another in the abstract. It is how they can write private conditions around a public event that neither party can produce alone.

In the ARIN region, that public event is registry finality. For a specified-recipient transfer, both sides may need to submit requests; ARIN staff review and link the tickets; source and recipient conditions must be satisfied; applicable fees and registration agreements must be dealt with; and only then can ARIN complete the transfer in its records. For an inter-regional transfer, the timing becomes more complex because another RIR's compatible policy and validation sequence may be involved. For a merger, acquisition or reorganization, the decisive issue may be documentary evidence that assets using the number resources have moved. In every case, the private bargain leans on a public registry act.

Escrow exists because that public act cannot be collapsed into the private bargain. The seller wants certainty that cooperation will be paid for. The buyer wants certainty that payment will not leave before the registry result exists. The bank wants a clean instruction. Counsel wants conditions that can be proved. Network engineers want a routable and maintainable prefix, not merely a record that looks correct for a few hours. Every actor has a different definition of "done." The institutional purpose of escrow is to keep those definitions from destroying one another while the transaction moves from intention to public finality.

This is why settlement trust deserves attention as infrastructure rather than as deal plumbing. IPv4 scarcity is often discussed through price, leasing, brokers, address reputation and policy compliance. Those topics matter, but a market for scarce network identifiers also needs a settlement grammar. Who bears the risk between buyer funding and registry completion? Which event releases funds? What happens if approval is communicated but the public record has not moved? What happens if the record changes but RPKI, IRR entries, reverse DNS or abuse contacts lag behind? What if a dispute, bankruptcy filing, compliance review, authority challenge or cross-RIR mismatch interrupts the sequence? The answers determine whether scarce address space can be transferred without turning every closing into an act of faith.

The starting point is simple and awkward: the parties cannot deliver everything at the same instant. A conventional closing tries to create simultaneity. Funds move against documents; title moves against payment; possession moves against release. Even in ordinary asset sales this is partly theater, because banking rails, corporate records and public filings can lag. In IPv4 transfers the lag is structural. The asset is not a physical thing that can be handed over. Its value lies in a recognized registry position and in a set of technical and commercial controls that allow the new holder to use the numbers.

That value must be assembled in stages. First the parties reach a commercial agreement. Then they prove who they are and who may sign. Then the buyer funds or commits funds. Then the registry-facing request is submitted. Then ARIN evaluates the source and recipient against the applicable transfer path. Then the registry record is changed. Then the buyer updates the operational surfaces that make the block usable: route origin authorizations where appropriate, IRR entries, reverse DNS delegation, abuse contacts, provider notices, routing policies and customer-facing records. After that, the buyer discovers whether old reputation, stale filters or mistaken counterparties impose additional costs.

None of those events is trivial. A signed contract without funds leaves the seller exposed. Funded escrow without registry approval leaves the buyer's capital idle. Registry approval without a completed record update is not public finality. A public record update without operational handover may leave the buyer unable to use the block safely. A working route without clean reverse DNS or route-security state may impair service. A quiet first week without reputation remediation may still hide later deliverability or filtering problems. Settlement trust is the art of deciding which risks are large enough to condition payment and which must be priced as residual risk.

Registry finality is the public settlement event

Every mature settlement system needs a public or externally verifiable event. In securities markets, that may be the book entry. In real estate, it may be recording. In commodities, it may be warehouse release. In payment systems, it may be final settlement across a recognized rail. In IPv4 transfers, the closest equivalent is the registry record update. The analogy is imperfect, because ARIN does not administer number resources as ordinary property and its policy language distinguishes registration and assignment from sale. Yet the economic function is clear: public registration is the event that lets the rest of the market treat the transfer as having happened for registry purposes.

Before that event, the private bargain remains conditional. A buyer may have funded escrow, but it has not received the public registry position it seeks. A seller may have signed and submitted documents, but it has not delivered the final registry result. A lender may believe the buyer will receive the block, but it cannot yet point to the registry. A network team may prepare routes, but it should not assume that the final record will match the planned state until ARIN completes the change. Private confidence can be rational; it still lacks the public quality that settlement needs.

This is why escrow instructions should be built around registry finality rather than vague commercial milestones. "The parties have agreed" is not enough. "The seller has submitted papers" is not enough. "ARIN has opened or linked tickets" is not enough. "ARIN has asked for fees or an agreement" may be an important stage, but it is not necessarily the public final event. The event with the greatest settlement value is the completed registry update, because it gives outsiders a single public state from which they can judge whom ARIN recognizes for the relevant resources.

That does not mean all money must wait until every operational tail is complete. A sophisticated transaction may release most funds on registry finality and keep a smaller holdback for post-closing cleanup. The seller should not be forced to finance the buyer's entire operational integration if ARIN has completed the transfer and the remaining tasks are under the buyer's control. Conversely, the buyer should not bear all risk if the public record changed but the seller failed to remove stale route objects, coordinate reverse DNS or cooperate with agreed transition steps. Registry finality is the anchor, not the whole vessel.

ARIN's transfer mechanics illustrate the point. For specified-recipient transfers within the region, the source must be the current registered holder and not be involved in a resource-status dispute, while the recipient must satisfy relevant recipient requirements. The requests are ticketed and may be reviewed independently before being linked. Upon approval, fees and registration agreements can still matter before completion. For inter-regional transfers, compatible needs-based policy and coordination with another RIR can extend the sequence. Each step is important, but only the completed record change gives escrow a public fact that is both narrow and powerful.

The narrowness matters. Registry finality says that ARIN has recorded the transfer. It does not certify that the buyer will never face a routing problem, that the block has no prior reputation, that every private warranty is true, that a court will never hear a later claim or that customers will accept the migration. Overstating registry finality would load ARIN's record with claims it is not designed to carry. Understating it would deprive the market of its best public settlement event. The correct view is disciplined: registry finality is not everything, but it is the central observable event around which private risk allocation can be written.

Because the event is public, it also reduces room for opportunism. A buyer cannot reasonably say finality never occurred if the registry record has moved and the contract defined that movement as the release event. A seller cannot reasonably demand full release if the defined public event has not occurred. A custodian of funds does not need to adjudicate the whole commercial relationship if it has a precise condition tied to the record. The public record turns private settlement from a character contest into a question of state.

Escrow can hold money, not authority

Escrow is often described as if it were trust in a bottle. That is too generous. A custodian of funds can hold money, receive instructions, release against conditions, pause during disputes and return funds if specified events fail. It can reduce the danger that either party must perform entirely first. It cannot make ARIN approve a transfer. It cannot prove that a signatory had corporate authority. It cannot clean a bad route history. It cannot force a bank's compliance team to accept a payment. It cannot make another RIR move faster. It cannot convert a weak registry story into a strong one.

The distinction is important because escrow can become a false comfort. A buyer may believe that funding a neutral account makes the transaction safe. It does not, if the release condition is too early or if the seller's authority evidence is defective. A seller may believe that the existence of escrow proves payment certainty. It does not, if the buyer can trigger dispute without a clear standard or if a bank review freezes the money. A broker may believe that escrow validates the deal. It does not, if the registry later rejects the file. Escrow lowers one category of risk and sometimes reveals others.

The first thing escrow can hold is payment risk. Cleared funds give the seller confidence that the buyer has economic capacity and that release will not depend on a last-minute financing promise. The second is timing risk. Funds can be released in tranches, matching the stages from signature to registry finality to operational handover. The third is dispute risk. A defined reserve can remain in place during a short post-closing period while known cleanup obligations are completed. The fourth is failure risk. If a condition fails for a specified reason, the instructions can return funds without forcing the parties into immediate litigation over the entire contract.

What escrow should not hold is registry sovereignty. A private custodian should not decide that a transfer is final for the Internet if ARIN has not made the record change. It should not treat private assurances as substitutes for the registry's action. It should not maintain its own hidden ledger of who really controls a block. It should not become a long-term controller of credentials or technical records after closing. The moment private escrow becomes the place where market participants look for final authority, it is drifting toward a shadow registry.

Nor should escrow be asked to decide technical quality unless the instructions define objective evidence. "The buyer can route the prefix" is too vague if the parties do not specify route visibility, origin, monitoring window and exception handling. "Reverse DNS is complete" is too vague if the parties use different nameservers, delegation levels or timing assumptions. "Reputation is clean" is especially dangerous because reputation is not a single record; it is a collection of lists, private filters, customer policies and historical signals. Escrow conditions must be objective enough for release. Subjective comfort belongs in warranties, indemnities or price.

This limitation is not a weakness. It is the reason escrow works. A custodian of funds should not become an Internet governance body, a routing referee or a credit-rating service. It should enforce a narrow settlement script. The more it is asked to decide broad technical and commercial disputes, the less predictable it becomes and the more expensive the market's confidence layer grows. Good escrow design is modest. It holds money while the institutions that can create the relevant facts create them.

In the ARIN setting, that modesty points back to the record. The custodian can be told to release a main tranche upon evidence that ARIN has completed the transfer in the public registration record, subject to any agreed holdback for defined post-closing tasks. It can be told to refund if ARIN rejects the transfer for reasons attributable to the seller's lack of authority, or to allow termination if the buyer fails to satisfy recipient requirements by a deadline. It can be told to pause on a formal dispute notice. Those instructions do not make escrow all-powerful. They make it useful.

Conditions precedent turn confidence into sequence

Conditions precedent are often written as legal machinery, but in this market they are really the grammar of trust. They define what must happen before money moves, before a party must continue, before a deadline extends and before a failure becomes a termination rather than a delay. In an IPv4 transfer, conditions should reflect the sequence of trust creation rather than imitate a conventional asset sale.

The first condition is identity and authority. The seller must be the current registered holder or must show a chain of recognized succession under the applicable transfer path. For an ARIN-region specified-recipient transfer, the source must be the current holder and not in a dispute over the resource status. For merger, acquisition or reorganization transfers, documentary evidence of the asset transaction may be required. If the record points to an entity that no longer exists, the transaction may need a prior or parallel reorganization transfer before a market transfer can proceed. Escrow should not become fully at risk until authority risk has been narrowed.

The second condition is recipient capacity. The buyer must be able to satisfy the relevant ARIN requirements, including any need, operational-use or agreement conditions. Commercial appetite is not enough. If the recipient cannot qualify for the block size, cannot sign the relevant agreement, cannot pay applicable fees or cannot demonstrate the required connection and use, the seller should not remain trapped indefinitely. Pre-approval can reduce this risk for some buyers, but it does not replace the full closing sequence once a transfer is arranged.

The third condition is registry engagement. Both sides must submit the necessary requests, answer questions, provide documents, pay required processing fees and coordinate ticket references without expecting ARIN to disclose one party's confidential file to the other. This is a recurring settlement tension. A buyer may not know whether the seller is slow or whether ARIN is asking legitimate questions. A seller may not know whether the buyer's recipient file is complete. The conditions should require timely cooperation and create remedies for silence without demanding that ARIN violate confidentiality.

The fourth condition is approval and completion. Approval is important, but the safest main release trigger is usually completion in the registry record, because completion is the public event that private parties can observe. If the agreement uses an earlier event, it should price the residual risk. If it uses record completion, it should identify how evidence of completion will be shown: a registry message, a public lookup state, an account notification or a defined combination. Ambiguity around this point is expensive because it appears at the moment money wants to move.

The fifth condition is technical transition. ARIN's public transfer materials make clear that source organizations should prepare for clean transition by addressing ROAs, maxLength values, IRR objects and reverse-DNS coordination, and that recipients have responsibilities after transfer to create or update their own routing-security and reverse-DNS state. Settlement documents can convert that background into private obligations. They should not ask the seller to guarantee the entire Internet's route acceptance, but they can require the seller to remove or modify its own stale objects and cooperate with known handover steps.

The sixth condition is adverse-event handling. If a formal claim, court order, bankruptcy filing, sanctions problem, suspected compromise or authority challenge appears before closing, the instructions should say whether the parties pause, terminate, extend or move into a defined reserve. The absence of such language shifts power to whoever can delay most effectively. Conditions precedent are not only about what must go right. They are also about what happens when a narrow thing goes wrong.

Good conditions are neither maximalist nor casual. If every conceivable operational discomfort blocks release, sellers will demand higher prices or refuse. If release occurs before the central public event, buyers will demand discounts or heavy indemnities. The balanced grammar is staged: authority first, recipient qualification next, registry engagement and approval, public record completion, then bounded technical and reputation cleanup. Trust is not a mood. It is a sequence of conditions matched to who controls each risk.

The ARIN ticket is a clock, not a closing bell

The creation of an ARIN ticket is psychologically important. It tells the parties that the registry-facing phase has begun. It creates a reference point. It gives counsel and finance teams a date. It may satisfy an internal milestone. But a ticket is not a closing bell. It is closer to the start of the settlement clock.

That distinction matters because ARIN transfer requests can move through several states. Both source and recipient may submit requests separately. Staff may link ticketed requests once counterparties are identified and reviewed. Processing fees may be invoiced and paid. Each side may be asked for more information. The recipient may need to demonstrate qualification under the applicable policy. The source may need to prove current registered-holder status, absence of resource-status dispute and officer acknowledgement. Approval may precede final completion, and final completion may depend on fees and any required agreement. Treating the first ticket as closing collapses these states and misprices risk.

For escrow, the ticket is useful as a timing marker. The instructions can require the parties to submit within a specified number of business days after funding or signature. They can extend closing deadlines if ARIN asks for information within a reasonable review period. They can allocate responsibility if one side fails to respond. They can require periodic status representations without forcing disclosure of confidential registry correspondence. They can define a long-stop date after which funds return or a new agreement is needed. These terms make the ticket a clock with consequences.

The ticket also affects bargaining power. Once the source has submitted documents and the buyer has funded escrow, both sides may feel locked in. Limited visibility into each party's ARIN correspondence can then breed suspicion. The remedy is not to demand that ARIN reveal confidential file details. It is to write cooperation duties, status certifications and outside dates into the private arrangement, so review time does not become a private hold-up device.

The ticket is also different from pre-approval. A recipient that has obtained pre-approval based on projected need has reduced one kind of uncertainty. It has not completed a specific transfer. Once a counterparty is found, both sides still need to submit the relevant transfer request, and the source file still matters. Pre-approval can be useful because it tells sellers and custodians that the buyer has already passed a meaningful need review. It should not be mistaken for registry finality.

Inter-regional transfers add a second clock. ARIN may need compatible policy coordination with another RIR, and documentation from the other side can matter. A transaction that is routine inside one registry can become slow when two registries, two sets of expectations and two legal environments must align. Escrow instructions should not pretend that ARIN alone controls that timing. They should distinguish delay caused by the buyer, seller, ARIN, the other RIR, a bank or an external legal event. Without that distinction, the party least responsible for delay may bear the cost.

The economic lesson is that a registry ticket has settlement value but not finality value. It starts measurement. It evidences engagement. It creates deadlines. It may support staged deposits. It does not justify full release unless the parties have knowingly priced the risk that the public event has not yet occurred. The closing bell is the record change, not the first ticket number.

Approval is not the same as record movement

One of the most dangerous moments in settlement is the interval between approval and record movement. Approval sounds final to a commercial ear. It suggests that the hard decision has been made. Yet in registry practice, approval can still leave remaining steps: fees, signatures, agreement coverage, account actions, final staff action and publication of the changed record. The private contract should not rely on a word that the parties understand differently.

If the escrow release condition is "approval," the agreement must define approval. Does it mean that ARIN has approved both source and recipient requests? Does it mean that all fees and the registration agreement have been completed? Does it mean the public record has changed? Does it mean that no further action is required from either party? A bank or custodian cannot answer those questions from ordinary commercial intuition. The instructions must supply the meaning.

For many transactions, the cleaner condition is record completion. Public record completion is easier for outsiders to verify and aligns with the market's reliance point. The buyer can point to ARIN's record. The seller can point to the same record as delivery of the registry result. A lender or auditor can see the recognized holder. The custodian can release without deciding whether a pre-completion approval was enough. If a holdback is needed for later tasks, it can be stated separately.

There are cases where parties may release some money on approval before record movement. A seller may have done nearly all that it can do, and remaining completion may depend on the buyer's agreement signature or fee payment. A buyer may accept that risk if the discount or holdback is sufficient. The important point is not that early release is always wrong. It is that early release should be conscious. It should identify what remains undone, who controls it, what deadline applies and what remedy follows if completion fails after partial release.

The approval-record distinction also helps with refunds. If ARIN rejects a transfer because the seller is not the current registered holder, the logic differs from a rejection because the buyer cannot qualify for the requested block size. If ARIN cannot complete because a required agreement is not signed, responsibility may depend on which party had to sign. If ARIN cannot proceed because a resource-status dispute appears, the contract must ask whether the dispute was known, disclosed, attributable or unforeseeable. Refund rights should follow fault and control where possible, not simply disappointment.

Record movement also creates its own risks. Once the public record changes, the seller's leverage declines and the buyer's operational responsibilities expand. The source may need to ensure that old ROAs are removed or adjusted. The recipient may need to create new ROAs, publish authoritative IRR entries and verify reverse DNS delegation. Customers and upstreams may need to be notified. If the contract releases all funds at record movement with no post-closing duties, the buyer may carry avoidable cleanup risk. If it holds too much money after record movement, the seller carries avoidable payment risk. A modest holdback can be more efficient than a binary release.

The institutional point is that finality is not a single word. It is a sequence in which each stage has a different evidentiary quality. Approval is an internal or account-facing result. Record movement is public registry finality. Operational cleanup is practical usability. Settlement trust improves when the contract names each stage instead of letting one word carry all of them.

Authority evidence brings old corporate history into the room

IPv4 addresses carry history. Many valuable blocks were issued when no one expected a large secondary market. Corporate groups reorganized. Divisions were sold. Network units spun out services. Hosting businesses changed names. Telecom assets moved. Start-ups disappeared into larger enterprises. Some records stayed current; others remained attached to names, contacts or legal structures that no longer reflected operating reality. Settlement becomes difficult when that old history must support a present transfer.

In ARIN-region transfers, authority is not cosmetic. For specified-recipient transfers, the source must be the current registered holder and must not be in a dispute over the resource status. A signed and notarized officer acknowledgement may be required from the source. If the current registrant no longer exists, a merger, acquisition or reorganization path may be necessary before the market transfer can proceed. For reorganization transfers, evidence such as asset-purchase documents, bills of sale, merger agreements, court orders, public filings or name-change records may be relevant. If multiple transactions connect old and new organizations, evidence may be required for each link. That is not paperwork fetishism. It is the chain of recognition on which settlement depends.

Escrow should treat authority evidence as a condition, not as a warranty discovered too late. A buyer can be refunded after a failed transfer, but time, opportunity cost and deployment plans may already be damaged. A seller can apologize for weak documents, but a block with uncertain authority is not the same economic product as a block that can be transferred quickly. A custodian can return money, but it cannot give the buyer back a missed customer migration. The best settlement design moves authority review as early as possible.

Weak evidence can be priced only if the risk is understood. A buyer may rationally accept a lower price for a complicated chain, but a discount is not a substitute for registry acceptance. A cheaper block that cannot be recognized is not a bargain; it is an option on a dispute. Settlement terms should distinguish an agreed evidence risk from an undisclosed authority defect. The former can be priced. The latter should trigger remedies.

Bankruptcy and restructuring magnify authority complexity. If the source enters bankruptcy, sells assets through a court-supervised transaction, reorganizes under a plan or transfers a business unit as part of insolvency administration, the question is not merely whether buyer and seller agree. The estate, trustee, debtor-in-possession, secured lenders, court orders and asset descriptions may matter. A registry needs evidence that the entity requesting the change has authority to do so. Escrow must account for the possibility that a court order or restructuring document names network assets imprecisely or leaves number resources in a grey zone.

The market sometimes calls this "title" risk, though the legal label around number resources is more delicate than real estate. The practical meaning is less controversial. The buyer needs confidence that the seller can cause ARIN to recognize the transfer. The seller needs confidence that once it has produced the required evidence and the record moves, payment will release. ARIN needs enough documentary support to maintain the integrity of the registry. Authority evidence is therefore not a back-office legal appendix. It is a central settlement asset.

Staged closings price time

A single release event is elegant but often too crude. It suits clean transactions: clear current holder, qualified buyer, no cross-registry complication, current contacts, no known dispute and modest operational tail. Many IPv4 transfers are not so tidy. The resource may be large, the seller may need to unwind old routing objects, the buyer may depend on financing, compliance review may be slow, or inter-regional coordination may be required. Staged closing is the market's way of pricing the time between trust states.

The first stage can be a deposit after signature and initial authority screening. This compensates the seller for taking the block off the market and beginning registry cooperation, while limiting buyer exposure before the most important conditions are met. The deposit may be refundable or partly non-refundable depending on who fails and why. If the seller's authority is defective, refund logic should protect the buyer. If the buyer simply walks away after the seller has performed, the seller may be entitled to compensation. The economic goal is to prevent cheap options disguised as purchase agreements.

The second stage can be funding of the main price before registry submission or before linked tickets proceed. This gives the seller confidence that the buyer can close. It also gives ARIN-facing cooperation a financial foundation. The release condition should still be tied to public finality or a carefully defined earlier event. Funding is a signal of capacity, not a transfer of value to the seller. The buyer should know that funds are safely held while ARIN does what only ARIN can do.

The third stage is main release on registry record completion. This is the anchor. Once ARIN has completed the transfer and the public record reflects the new holder, the seller has delivered the central registry result. In many transactions, most of the price should release here. Holding back too much after public finality can unfairly make the seller finance risks now controlled by the buyer. Releasing everything can unfairly leave the buyer exposed to known cleanup obligations. The right answer depends on the operational tail.

The fourth stage is a holdback for defined post-closing tasks. These may include removal or modification of source ROAs where applicable, cooperation on reverse-DNS delegation, removal of obsolete IRR objects controlled by the seller, correction of public contact records, transition support for upstream notices or limited assistance with reputation remediation where the seller made specific representations. The holdback should be time-limited and objective. It should not make the seller guarantor of all future routing acceptance or every private filter in the world.

The fifth stage is release or claim after a short survival period. If no defined dispute, missed task or breach notice appears, the remaining funds release. If a problem appears, the parties follow a specified path: cure, partial release, reserve, arbitration, court order or refund. The settlement design should favor fast resolution of narrow problems and avoid converting minor operational issues into full-price hostage situations.

Staging also helps with cross-RIR transfers. A buyer or seller may accept that another registry's timing is outside ARIN's control. Funds can be held while both registries coordinate, with deadlines extended for documented review rather than unbounded delay. A tranche may release when the sending registry completes its removal and another when the receiving registry publishes the new state. The contract should not assume that two registries' acts are simultaneous.

Staged closing is sometimes criticized as complexity. But unpriced time is complexity of another kind. If the parties use one all-or-nothing release, every intermediate delay becomes a fight over leverage. A staged structure turns time into priced risk. It says which facts have enough settlement value to move money and which facts remain protected by holdback or warranty. That is the difference between trust as goodwill and trust as infrastructure.

Refunds and disputes need rules before stress

Refund provisions are most useful before they are needed. Once a transfer stalls, each party's interpretation of fairness changes. The buyer sees idle capital and delayed deployment. The seller sees a block off the market and cooperation already provided. The custodian sees competing instructions. If the refund logic was not written in advance, the settlement system becomes a bargaining contest under stress.

The first refund category is seller-side authority failure. If ARIN cannot approve or complete because the seller is not the current holder, cannot provide required officer acknowledgement, cannot prove a necessary chain of succession, is involved in a resource-status dispute or cannot remove a blocking claim that should have been disclosed, the buyer should not carry the price risk. The seller may object that some authority problems are surprises. That may be true, but the risk belongs naturally with the party presenting the resource for transfer unless the buyer knowingly accepted a defined evidence risk.

The second category is buyer-side qualification failure. If the buyer cannot meet recipient requirements, cannot sign a required agreement, cannot pay fees, cannot demonstrate need or operational use where required, or loses internal approval after the seller has performed, the seller should not be left with an indefinite escrow hold. A refund may still occur, but the seller may retain a deposit or recover specified costs. This allocation encourages buyers to secure pre-approval or equivalent confidence before tying up a seller's asset.

The third category is registry or cross-registry delay without party fault. If ARIN or another RIR requests more information, experiences an ordinary review delay or needs coordination time, neither party may be at fault. The instructions should include extension periods and a long-stop date. At the long-stop, the parties can extend, terminate with refund or renegotiate. Without a long-stop, the buyer's funds and the seller's resource can both become trapped.

The fourth category is adverse legal or compliance event. A court order, bankruptcy stay, sanctions-screening problem, law-enforcement notice or fraud concern can interrupt settlement. The contract should avoid automatic release during such events. It should also avoid letting vague allegations freeze funds indefinitely. A formal notice standard, evidence threshold and time limit can separate real legal constraints from tactical obstruction. Escrow is useful because it can pause without deciding merits, but the pause must have a path.

The fifth category is post-record operational failure. If the public record moves and then the buyer discovers a technical tail, refund should not be automatic. The question is who controlled the failed task and whether it was defined as a condition or holdback obligation. A seller's failure to remove a known ROA or stale IRR object may support a holdback claim. A buyer's failure to create its own ROAs after transfer should not. A reputation problem that was specifically warranted may be compensable; a generic complaint that some platform dislikes the block may not.

Dispute triggers should be objective where possible. A registry rejection notice, a public record state, a documented bank hold, a formal legal order, an unanswered information request past a stated deadline, a failed delegation verification or a defined route-security artifact can be observed. "The buyer is uncomfortable" or "the seller believes it has done enough" cannot. The more objective the trigger, the less the custodian is pulled into judging the entire relationship.

The settlement system should also encourage cure. Many failures are fixable: a missing document, stale contact, unpaid fee, incomplete agreement, old route object or misunderstood reverse-DNS step. Immediate termination may waste a transaction that could close. Indefinite cure may reward delay. The efficient middle is notice, a short cure period, documented status and then the specified remedy. Refund design is not pessimism. It is what lets parties take risk because they know how failure will be handled.

Bank and compliance review has its own clock

IPv4 transfers are not only registry events. They are payments between legal entities, often across jurisdictions, sometimes involving large sums, older corporate histories, beneficial-ownership questions, tax review, sanctions screening and fraud controls. The bank's settlement clock can run independently of ARIN's. A transfer can be ready in the registry while funds are held for compliance review. Funds can be ready while the registry file is incomplete. A transaction can fail because a bank dislikes the payment path even though ARIN has no objection to the resource transfer.

This matters because the ARIN region is commercially sophisticated but legally diverse. Buyers and sellers may be in different countries within the region or connected to parent companies elsewhere. Payments may move through U.S. dollar accounts, foreign subsidiaries, acquisition vehicles, debt facilities or escrow providers with their own compliance obligations. A seller may be a legacy holder with sparse public information. A buyer may be newly formed for an acquisition. A block may have moved through prior reorganizations. None of this proves wrongdoing. It proves that bank review is a real settlement layer.

Escrow instructions should therefore require funds to be cleared, not merely initiated. A wire confirmation can be reversed, delayed or questioned. A bank can request additional information about counterparties, beneficial owners, purpose of payment or contractual documents. If the closing deadline assumes instant payment finality, the parties may blame each other for a delay caused by financial-system review. A better design distinguishes initiated payment, received funds, cleared funds and releasable funds.

Compliance review also affects refunds. If a bank freezes or rejects funds before registry completion, the seller should not be forced to continue indefinitely. If a bank freezes funds after registry completion but before release, the seller may face the worst risk: public record moved, payment not received. To prevent that outcome, many transactions should require cleared escrow funding before registry actions that expose the seller to irreversible delivery risk. Where a seller chooses to proceed before cleared funding, the discount or guarantees should reflect that risk.

The same logic applies to sanctions and prohibited-party review. ARIN itself may have legal obligations and may operate in a U.S. legal environment, but private payment screening is not identical to registry review. A bank may ask questions that ARIN does not. A custodian may decline a transaction that a registry could otherwise process. A buyer's lender may impose conditions unrelated to ARIN policy. Settlement trust depends on recognizing these parallel controls rather than treating the registry as the only gate.

The market's efficient response is sequencing. Verify counterparties and beneficial ownership early. Clear payment rails before asking the seller to make irreversible registry commitments. Ensure that the custodian has instructions it can apply without legal improvisation. Tie ARIN-facing steps to funding milestones. Keep a reserve for defined post-closing risks but do not let bank uncertainty sit on the seller after delivery. Treat financial compliance as a settlement layer with its own clock.

This is another reason ARIN should not hold escrow. The registry has its own mandate, confidentiality duties, policy constraints and service obligations. It should not become the party deciding whether a private bank's concerns justify release or refund. Payment compliance belongs with banks, counsel and escrow providers. Registry finality belongs with ARIN. Settlement trust improves when those functions are connected but not merged.

Cross-RIR transfers split public finality

Inter-regional transfers make non-simultaneity visible because two registry systems must coordinate. ARIN's policy permits inter-RIR transfers of IPv4 addresses or ASNs only through RIRs that agree to the transfer and share reciprocal, compatible needs-based policies. ARIN's public materials identify which RIRs currently have compatible transfer policies and note that coordination among multiple RIRs and organizations can affect timing. When a network record moves out of ARIN, it can be removed from ARIN's Whois service and replaced with a placeholder pointing to the new RIR. When resources move into ARIN, the recipient must meet ARIN's current requirements.

For settlement, this means registry finality may be split. The sending side may approve release. The receiving side may still need to publish or complete its recognition. A record may disappear from one public service and appear in another. The buyer's comfort depends not only on ARIN's action but on the receiving registry's state. The seller's comfort depends on knowing when it has done all that its registry and contract require. Escrow instructions must map the two-registry sequence rather than pretending it is a single click.

The risk is not merely delay. A cross-registry transfer can produce mismatched expectations about need evaluation, documentation, minimum size, agreement terms, fees, public-record timing, reverse-DNS arrangements and route-security services. ARIN may require evidence that the other RIR has validated compatible policy requirements. The other RIR may have its own communications and internal timing. A party that has only operated within one registry can underestimate this institutional distance.

Escrow can help by defining paired events. Funds may remain held until both the sending and receiving registry states satisfy defined criteria. A smaller tranche may release when the source registry confirms transfer-out approval, with the main release only when the recipient registry publishes the new holder. Or the parties may release on the sending registry's completion if the buyer, as recipient, controls the remaining receiving-side steps. The correct answer depends on who controls the final risk and which registry action creates the public state the buyer paid for.

The contract should also address currency, banking and jurisdictional friction without letting those issues dominate the registry analysis. Cross-border payment review, tax treatment and documentary translations can be expensive, but they are not the core subject here. The settlement point is narrower: when two registries are involved, private escrow needs a public finality definition that recognizes both. The buyer should not release against a half-moved record unless it knowingly accepts the remaining half. The seller should not be unpaid indefinitely for delays after it has completed the part it controls.

Cross-RIR timing also raises operational questions. Reverse DNS may be delegated differently after the move. RPKI participation may not carry over automatically across systems. IRR entries may need to be recreated under a different authority. Abuse contacts and public records may change format or fields. These tasks can occur after the public holder state changes, but they should be anticipated before closing. A buyer acquiring space across registry boundaries is buying not just numbers but a migration burden.

The institutional lesson is modest. Cross-RIR transfers do not require the registry to become a financial intermediary or the escrow provider to become a registry. They require private contracts to acknowledge institutional distance. ARIN's public act has settlement value, but in an inter-regional transfer that value may be one part of a larger public sequence. Settlement trust comes from naming both parts.

Operational quiet comes after the record changes

The public record can change before the Internet becomes quiet. A buyer may be recognized as the new holder while old route objects still exist, old ROAs require adjustment, reverse DNS points to old nameservers, abuse contacts need revision, geolocation vendors lag, email reputation systems remember prior traffic, security filters distrust historical patterns and customer allowlists have not been updated. Settlement is not complete in the operational sense until these tails are controlled.

ARIN's transfer guidance gives the factual spine. Source organizations involved in specified-recipient or inter-RIR transfers should review ROAs, remove transferring prefixes from source ROAs where needed, review maxLength values, update or remove IRR objects that will not apply after the transfer, coordinate a reverse-DNS delegation plan and ensure the recipient understands its responsibilities. Upon completion, recipients should review, update or create associated ROAs, IRR objects and reverse-DNS settings. ARIN RPKI certificates may be re-rolled at transfer, and recipients may need to create new ROAs or sign up for RPKI services. These are not decorative best practices. They are post-closing settlement facts.

The hard question is which of these facts should affect payment. If the seller controls an old IRR object or ROA and fails to remove it, the buyer may face route-validation or filtering problems. A holdback tied to that obligation is sensible. If the buyer fails to create its own ROAs after transfer, that is not the seller's payment risk. If reverse DNS delegation requires both sides to coordinate before and after the record change, the holdback can be tied to cooperation and verification rather than a guarantee of every resolver's behavior. Settlement documents should follow control.

Operational quiet also includes customer and provider reliance. A buyer may need upstream providers to accept route announcements, customers to update allowlists, data-center teams to change filters, cloud platforms to onboard space or internal systems to renumber. These steps are largely under the buyer's control, though the seller may need to provide transition notices or authorizations. A settlement system that makes seller payment contingent on the buyer's entire operational integration will be too heavy. A system that ignores seller-controlled dependencies will be too light.

The right phrase is "bounded operational tail." Registry finality should release the main price. A bounded holdback can protect tasks the seller still controls or specifically warranted. The buyer then owns the ordinary work of making the block productive. This division keeps private escrow from becoming an indefinite performance court while acknowledging that a registry update alone does not make the block operationally quiet.

The same logic applies to evidence. A route collector view can show a narrow form of visibility, but it does not prove every network accepts the route. A DNS check can show delegation, but it does not prove every dependent application has been updated. A route-security artifact can show that a particular authorization exists, but it does not prove every stale artifact has disappeared. Operational evidence is useful when the condition is precise. It becomes dangerous when it is asked to prove a general mood of cleanliness.

The buyer should therefore enter closing with a transition plan, not merely a payment plan. It should know which upstreams will accept the space, which ROAs need to be created, which IRR entries will be authoritative, which reverse-DNS delegation steps are needed, which customer systems depend on the prefix and which reputation checks are material to the intended use. The seller should know which artifacts it controls and which assistance it has promised. Escrow should hold money only for the defined portion of that plan that remains seller-controlled or expressly warranted.

This is not operational detail masquerading as economics. It is economics because a block that cannot be used quickly is worth less than a block whose registry, routing, reputation and customer-dependency surfaces settle cleanly. The market does not need the registry to certify all those surfaces. It needs contracts that recognize their value and allocate them without confusing them with the public record.

Bankruptcy and restructuring test the settlement design

Bankruptcy and restructuring are where settlement trust meets adverse claims. A seller may enter insolvency proceedings before closing. A buyer may acquire network assets from a debtor. A secured lender may claim proceeds. A court may approve an asset sale that includes network equipment but describes number resources poorly. A trustee may question whether a transfer was authorized or whether the estate received fair value. A seller's creditors may argue that a pre-bankruptcy disposition should be unwound. These are not everyday transfer facts, but the market must price them because IPv4 value is large enough to attract creditor attention.

The first issue is authority. Who can sign for the source if the company is in bankruptcy or restructuring? Is it management, a debtor-in-possession, a trustee, a receiver, a liquidator or a buyer under a court-approved sale? What evidence will ARIN accept? Does the transfer path require proof that the assets using the number resources moved? Are there objections, stays or court restrictions? Private escrow should not release against ordinary officer signatures if legal control has shifted. The condition must match the legal state of the source.

The second issue is timing. Bankruptcy can impose automatic stays, notice periods, court hearings, creditor objections and closing conditions that move on a legal calendar rather than a registry calendar. A seller may be unable to complete until a court order is final. A buyer may have funds ready but not have court authority. ARIN may need documentary evidence after the court acts. Escrow instructions should include extensions for defined court events and termination rights if approval does not arrive by a long-stop date.

The third issue is proceeds. If funds are held for a debtor or insolvent entity, release may require compliance with the sale order, secured-creditor payoff instructions or estate administration rules. A custodian must know whom to pay and under what evidence. The buyer should not be asked to decide creditor priority. The seller's estate should not lose proceeds because the escrow instructions were written as if the company were solvent. Financial finality and registry finality must both be respected.

The fourth issue is avoidance or later challenge. A transfer completed before insolvency may later be questioned as a preference, fraudulent transfer or unauthorized disposition under applicable law. The registry record may be public, but a court can still hear claims about the private transaction. Settlement documents cannot eliminate all clawback risk. They can require authority evidence, fair-value support, board approvals, solvency representations, court approval where appropriate and reserve structures for identified risks. The contract should not ask ARIN to certify what belongs to insolvency law.

The fifth issue is operational continuity. Networks do not pause for restructuring. Customers may rely on the address space. Reverse DNS, route security and abuse contacts must remain functional even while ownership and control are disputed. A bankruptcy sale that transfers a business without coordinated number-resource settlement can leave the buyer operating under stale records or leave the estate exposed to complaints for traffic it no longer controls. The settlement architecture should preserve continuity while the legal state changes.

Restructuring also shows why ARIN should not hold escrow. If the registry held money, it could be pulled into creditor disputes, competing court orders, proceeds allocation and allegations about release timing. That would distort its role. ARIN should evaluate registry authority and record changes under policy and applicable law. Banks, custodians, courts and counsel should handle money. Keeping those roles separate protects both registry neutrality and creditor confidence.

ARIN should not hold the money

It is tempting to imagine that settlement would be simpler if ARIN held the money. The registry controls the public event. It knows when tickets are approved and when records change. It already receives fees and agreements. Why not let the registry hold buyer funds and release them when the transfer is complete? The answer is that the same fact that makes ARIN central to registry finality makes it ill-suited to private payment custody.

First, payment custody would expand ARIN's mandate. ARIN's legitimate role is to administer number-resource registration, apply community-developed policy, maintain public records and related services, and protect the integrity of the registry. Holding private purchase funds would move it into commercial settlement, bank compliance, refund adjudication, counterparty credit risk and potentially tax or insolvency disputes. Those functions have different skills, liabilities and incentives.

Second, payment custody would threaten neutrality. If ARIN holds buyer funds, every registry timing decision could be viewed through a payment lens. A request for more information might be alleged to delay release. A rejection might be alleged to favor one commercial party. A public-record correction might trigger claims about who should be paid. Even if ARIN acted properly, the appearance of commercial involvement could weaken confidence in its recordkeeping role.

Third, escrow creates confidentiality problems. Registry review involves documents that may be sensitive but relevant to policy: corporate authority, asset transactions, need justification, account credentials and legal status. Payment custody involves different sensitive material: bank information, purchase price, beneficial ownership, tax forms, sanctions checks, financing arrangements and release instructions. Combining the two would increase the amount of sensitive commercial information held by the registry without improving the public record.

Fourth, ARIN would become a dispute target. If funds are held privately by a custodian, disputes about release can be handled under the escrow agreement, court order or dispute-resolution clause. If ARIN holds the funds, every payment fight becomes a potential registry fight. A seller unpaid after record movement may accuse the registry of causing loss; creditors may seek orders against it; buyers may treat registry timing as payment timing. The registry would become a more attractive battlefield.

Fifth, holding escrow would encourage false reliance. Market participants might treat ARIN's payment custody as a warranty of the whole transaction: authority, reputation, routing cleanliness, bank compliance and post-closing usability. ARIN cannot and should not warrant those things. The registry record can be reliable without becoming a guarantee of commercial quality. Keeping escrow private forces parties to allocate non-registry risks themselves.

The better role for ARIN is to make its registry states clear enough that private escrow can reference them. The registry can publish transfer mechanics, define policy requirements, maintain reliable ticket communication with each party, complete record changes quickly after requirements are met, and provide public records that reflect finality. It can explain that routing-security and reverse-DNS tasks remain with the parties. It does not need to hold purchase money to make settlement work.

This boundary is not anti-market. It is pro-market because it lets the market build payment trust without converting the registry into a commercial counterparty. Settlement trust improves when ARIN supplies the public event and private institutions supply payment custody. Merging them would create more conflicts than confidence.

Private escrow must not become a shadow registry

If ARIN should not hold escrow, the opposite danger is that private escrow becomes too authoritative. A custodian, broker, platform or settlement adviser may accumulate information about prices, counterparties, authority files, failed transfers, reputation issues and preferred release terms. That knowledge is useful. It can also become market power. If participants begin to believe that a private intermediary's records define who controls scarce address space, the intermediary has become a shadow registry.

The shadow-registry risk appears in several forms. The first is private finality. Parties may treat the escrow provider's statement that a deal has closed as more important than the public registry record. That is backwards. Private closing can allocate rights between parties, but for the Internet-facing settlement event, ARIN's record is the anchor. A private provider that releases funds before registry finality may have followed instructions, but it has not made the transfer public.

The second form is private eligibility. An intermediary may tell buyers that a seller is transferable or sellers that a buyer is approved. Those statements may reflect experience, but they are not ARIN's decision. A buyer's pre-approval, source-holder status, officer acknowledgement and absence of dispute are registry matters under policy. Private screening can reduce risk; it cannot substitute for the registry.

The third form is technical custody. Some intermediaries may help coordinate credentials, DNS, route-security artifacts or transition letters. That can be useful for closing. It becomes dangerous if the intermediary remains a persistent controller after the buyer should control the resource. Long-term private custody of technical levers blurs responsibility, creates security risk and makes the public record less meaningful. After closing, operational authority should move to the recognized holder or its chosen service providers, not remain trapped in the settlement layer.

The fourth form is private dispute adjudication. Escrow instructions can allow a custodian to hold funds during disputes and release on joint instruction, court order or defined evidence. They should not require a private settlement provider to decide who deserves the address block in a broad sense. That authority belongs to the registry for registry recognition and to courts or agreed dispute forums for private rights. A custodian of funds should not become a low-visibility court for scarce Internet resources.

Preventing shadow registry power requires clear boundaries. Private escrow can hold and release money. Brokers can introduce parties and help coordinate documents. Counsel can draft conditions. Technical advisers can map cleanup tasks. ARIN can determine registry record changes. Public records can provide finality. Each function should inform the others without replacing them. Settlement trust is a federation of roles, not a hidden private sovereign.

Settlement trust is infrastructure

A well-designed ARIN-region settlement model should start from a modest proposition: no single institution should be asked to absorb all trust. The buyer should not have to trust the seller's promise without registry finality. The seller should not have to trust the buyer's promise without funded payment. The custodian should not have to trust vague narratives without objective instructions. ARIN should not have to trust private commercial representations beyond the evidence required for registry action. Banks should not have to rely on registry approval as a substitute for payment compliance. Network operators should not have to infer routing authority from private purchase documents.

The institutional design should therefore allocate trust by function. ARIN supplies public registry recognition. The custodian supplies payment custody. Counsel supplies contract conditions, warranties and remedies. Banks supply cleared payment and compliance review. Technical teams supply route-security, IRR, reverse-DNS and operational transition. Brokers, where present, supply matching and coordination but not public finality. Courts or agreed dispute forums supply dispute adjudication when private rights are contested. Each role has a boundary.

The design principles follow from that division. The main release should ordinarily be tied to the completed registry record, not to private optimism. Source authority and recipient qualification should be tested before the parties create large sunk costs. Deposit, main funding, registry-finality release and post-closing holdback should correspond to different risk states. Registry rejection, public record state, documented bank hold, formal legal restraint, missed response deadlines and verifiable technical artifacts are better dispute triggers than subjective dissatisfaction.

The same model applies after closing. Route-security, reverse-DNS, IRR and abuse-contact tasks should be assigned to the party that controls them. Sellers should not guarantee the buyer's entire future operation. Buyers should not inherit avoidable seller-controlled obstacles without remedy. Time limits, response windows, extension rules and long-stop dates turn uncertainty into managed risk. The settlement system works because each institution is limited.

Return to the closing room. The buyer's money is ready. The seller wants certainty. The registry ticket has moved through review. The parties know that an ARIN ticket was never a wire, that a wire was never registry finality and that registry finality was never complete operational peace. The instructions are precise enough to avoid theater. Most funds release when ARIN's public record changes. A smaller holdback remains for defined seller-controlled technical tasks. Refund rights are tied to specific failure states. Bank review was cleared before irreversible registry action. Cross-registry timing, if any, was named. Disputes pause release only under objective triggers. The buyer accepts ordinary post-closing integration risk. The seller exits once it has delivered the public registry result and the agreed transition cooperation.

This is what settlement trust looks like when it becomes infrastructure. It is not dramatic. It does not require ARIN to police prices, bless brokers, guarantee reputation or hold funds. It does not require private escrow to decide who controls the Internet. It requires a disciplined division between public finality and private risk allocation. The public event is the registry record. The private conditions decide how money waits for that event and what residual risks survive after it.

The alternative is a market that settles by improvisation. Buyers fund too early and sue later. Sellers submit too much before payment and then discover leverage has vanished. Custodians receive instructions they cannot apply. Banks freeze funds after the registry state has changed. Brokers become informal authorities because no one else can translate the sequence. ARIN receives pressure to do things that belong to private contracts. Operational teams inherit stale ROAs, route objects, reverse DNS and reputation problems as if they were surprises. Every avoidable ambiguity becomes a risk premium.

IPv6 deployment will not make this question disappear soon. IPv4 remains embedded in access networks, hosting, cloud services, enterprise systems, mobile translation layers, security products and customer expectations. As long as scarce IPv4 blocks retain economic value, the market will need a settlement architecture that can move them without confusing payment with recognition or recognition with operation. The more valuable the blocks, the less tolerable vague closing language becomes.

The cleanest principle is also the most limited. ARIN should make registry finality reliable and legible. Private escrow should condition funds on that public finality and on narrow, objective post-closing obligations. Buyers and sellers should price the time between those states. Banks should clear funds before irreversible registry action. Technical teams should treat route security, reverse DNS and reputation as part of closing economics rather than as afterthoughts. Brokers can help coordinate, but they should not become the authority.

Settlement trust is the quiet infrastructure of the IPv4 market. It is where scarcity becomes finance without becoming chaos, where private bargains become publicly recognizable without making the registry a bank, and where operational cleanup is acknowledged without turning every custodian of funds into a routing court. The finality that matters most is public, but the risk around it is private. A healthy market knows the difference and writes its closings accordingly.