ARIN and the economics of reserve policy discipline

Summary

• ARIN's reserve account is not only a financial cushion; it is a discipline test for a post-exhaustion registry whose members fund continuity but cannot easily buy substitute registry authority.
• The difficult moment in reserve policy does not begin with an invoice or a public dispute.

The reserve account is a continuity meeting, not a comfort line

The difficult moment in reserve policy does not begin with an invoice or a public dispute. It begins in a quiet finance review where the numbers look reassuring. The investment balance is stable. The operating plan shows a deficit that can be absorbed. Technology renewal is scheduled. Security work has to continue. Staff costs are predictable enough to model. Payment delays are not yet a crisis. A data-centre or vendor problem would be inconvenient rather than fatal. The finance team can point to a cushion large enough to keep the registry open if revenue, markets or operations misbehave.

That is exactly why the question is hard. A thin reserve would be reckless for a critical registry. A regional Internet registry is not an ordinary nonprofit that can suspend activity for a quarter while it searches for donations. Its records support uniqueness. Its public services support due diligence, abuse handling, reverse DNS and routing-security operations. Its account systems support holder authority. Its transfer process supports market settlement. If ARIN could not meet payroll for critical staff, keep essential systems alive, pay vendors, respond to incidents, preserve data and maintain public publication services through a shock, the cost would not remain inside ARIN. It would move into networks, transactions, customers and security operations that rely on the registry layer.

The reserve account therefore looks prudent. It is prudent. But prudence is not the whole story. A reserve large enough to protect the ledger can also protect the institution from member discipline. It can let management and trustees run operating deficits while avoiding immediate cuts or sharper fee debates. It can give the office time to preserve programs that captive payers may not value as much as staff or insiders do. It can fund contested choices long enough for dissent to tire. It can soften the pressure to distinguish the cost of indispensable registry functions from the cost of institutional scope.

For ARIN, that distinction matters because the public mechanics of the reserve are large enough to shape incentives. Public budget and investment materials record investment reserves around the scale of one year's operating expense. ARIN separates an Operating Reserve Fund from a Long Term Reserve Fund. The long-term target is tied to the previous year's operating and capital budgets on a cash basis. Operating reserves are invested conservatively. Long-term reserves are invested with diversified return and risk controls. Larger withdrawals require Finance Committee involvement. The policy also recognises conflict concerns around direct investment in some sectors whose firms overlap with the registry's member base.

Those are not signs of amateur finance. They show that ARIN treats reserves as real institutional infrastructure. The economic question is whether that infrastructure is aimed first at continuity of registry function or continuity of organisational breadth. A reserve account can protect RDAP, Whois, reverse DNS, RPKI repositories, transfer records, account authority, security response and critical staff. It can also protect travel, meetings, communications, broad programs, legal posture, governance comfort and administrative habits from the shock that would otherwise force narrower choices.

The reserve-policy problem is therefore not "prudence or no prudence." It is which continuity is being insured, who decides when the insurance is used, how members can see the use, and what prevents a continuity buffer from becoming institutional immunity. After IPv4 exhaustion, this is not a housekeeping question. It is one of the central disciplines of a registry whose funding base is captive, whose services are hard to substitute and whose records sit beneath scarce resources with real economic value.

Reserves insure functions, but they also insulate institutions

A reserve policy for a regional Internet registry has two honest sides. The first is continuity insurance. The second is governance insulation. Both are real, and pretending that only one exists weakens the policy.

Continuity insurance is easy to defend. A registry should survive a security incident that raises incident-response and remediation costs. It should survive a vendor failure that requires emergency migration. It should survive delayed fee collection from a large group of holders. It should survive a market downturn that lowers investment earnings. It should survive technology renewal that cannot be delayed without increasing operational risk. It should survive legal surprises, data-centre trouble, staff transition, banking disruption, public-service outages and emergency operations. If the registry's cash buffer is too thin, continuity becomes hostage to ordinary volatility.

For a number registry, the continuity claim is stronger than for many membership bodies. The system is not selling an optional conference ticket or a discretionary publication. It is maintaining a shared reference layer for Internet number resources. If account authority fails, a legitimate holder may be unable to make changes. If publication services fail, counterparties lose visibility. If reverse-DNS changes fail, mail, security and operational systems can suffer. If RPKI publication fails or becomes inconsistent, routing decisions may be affected. If transfer processing stops, transactions stall and scarcity becomes harder to manage. A continuity reserve protects users precisely because the registry function is not easily replaceable.

Governance insulation is less comfortable to discuss, but it is just as real. Cash buys time. Time changes discipline. A registry that can cover a deficit from reserves need not immediately persuade members that every expense is necessary. It can keep salaries, programs, offices, meetings, outreach and systems moving while raising fees gradually or postponing cuts. It can absorb criticism without changing course. It can undertake projects whose benefits are diffuse and hard to measure because the immediate budget constraint is softer. It can defend institutional choices with its own accumulated funds rather than asking payers for fresh approval in the same moment.

This is not unique to ARIN. Reserves change behaviour in any nonprofit. The difference is the funding bargain. Many nonprofits collect voluntary donations or earned revenue in markets where customers can leave. A registry serving a defined region is different. Resource holders cannot take the same ARIN-region resources to a rival regional registry and buy an alternative authoritative record. Their fees and service dependence are tied to a shared uniqueness system. That captive feature does not make reserves improper. It raises the burden of explanation.

The most important distinction is between a reserve that protects essential functions and a reserve that protects the existing institutional perimeter. Essential functions are narrow: accurate records, unique registration, public data, reverse DNS, routing-security publication, secure account authority, transfer processing, critical support, incident response, backups, disaster recovery and payroll for the people who keep those systems alive. The institutional perimeter is wider: broad engagement work, preferred meeting formats, reputation programs, expansive communications, nonessential travel, discretionary initiatives, legal strategy beyond immediate record protection and the comfort of avoiding hard prioritisation.

A well-designed reserve policy does not deny the second category. Some broader activities may be useful. Meetings can improve accountability. Outreach can help neglected constituencies. Communications can lower confusion. Governance costs can discipline power. Legal readiness can deter bad claims. But usefulness is not enough. When the funding base is unavoidable in practice, the highest reserve protection should attach to functions that users cannot replace, not to every activity that ARIN has historically performed.

That is why reserve policy is a constitutional discipline in miniature. It answers a question that budgets alone often avoid: what must continue even if revenue falls, what may continue only if members support it, and what should shrink before the ledger is asked to fund another year of institutional comfort?

IPv4 exhaustion made the cushion politically sharper

Reserves became more politically important after IPv4 exhaustion because the registry's revenue bargain changed. In the allocation era, a registry could be understood mainly as a body distributing new resources from a regional pool, maintaining records and supporting policy around fair use. Fees paid for a function that looked closely tied to access to a public technical input. There were still governance questions, but the economic position of the registry was easier to explain.

After exhaustion, the pool is no longer the centre of the system. ARIN's free IPv4 pool depleted years ago. Address demand now moves through transfers, corporate restructuring, legacy holdings, residual waiting-list distributions, leasing, customer architecture, IPv6 transition and private planning around scarce capacity. The registry still matters, but it matters differently. It recognises already-deployed resources, processes changes of control, maintains public records, supports routing-security services and applies policy to assets that businesses may have bought, inherited, financed or built into customer commitments.

That shift makes the reserve account more than a financial safeguard. It becomes part of the political economy of a post-exhaustion registry. If revenue falls short of spending, reserves decide how quickly ARIN must raise fees, cut programs or narrow scope. If members resist cost growth, reserves decide how long the office can wait before making concessions. If a technology project overruns, reserves decide whether the cost immediately changes member pricing or disappears temporarily into accumulated funds. If litigation, security work or emergency operations appear, reserves decide whether essential services can continue without panic.

The funding source behind the reserve is important. Reserves are not magic capital. They are accumulated from the same ecosystem that pays annual registry charges, transfer-related fees, investment returns on earlier surpluses and related operating income. In plain terms, standing resource holders and registry users finance the cushion. That gives them a legitimate interest in its purpose. The reserve is not management's private insurance against inconvenience. It is member-funded continuity capacity.

IPv4 scarcity also raises the value of time. A registry that can run a deficit for a period can smooth shocks, and smoothing can be good. Abrupt fee increases can hurt small operators. Abrupt cuts can weaken security or public services. Abrupt staff reductions can damage service knowledge. Abrupt cancellation of technology renewal can increase future risk. A reserve lets ARIN avoid panic.

But the same smoothing can postpone necessary adjustment. In a scarce-address economy, members need to know whether deficits reflect temporary investment in essential service, delayed revenue correction, cost inflation, legal contingency, software renewal, broader institutional ambition or reluctance to make choices. A reserve-funded deficit is not self-explanatory. It may be wise countercyclical management. It may also be a way to preserve the current shape of the organization while the fee base is prepared for the next increase.

The political sharpness comes from limited exit. A company dissatisfied with a normal supplier can move business away. A resource holder dissatisfied with ARIN's reserve use cannot move its ARIN-region address records to a substitute registry. The relevant discipline is therefore voice, transparency, voting, consultation and evidence. Reserves reduce the immediacy of cash pressure; they should increase the quality of public explanation.

After exhaustion, a registry's legitimacy depends less on its ability to allocate new space and more on whether it reduces risk around existing scarce resources. Reserve policy should be judged by that standard. If the cushion makes records safer, services more resilient and shocks less damaging to live networks, it strengthens legitimacy. If it mainly lets the institution keep spending before proving that the spending lowers reliance cost, it weakens the discipline that captive fees are supposed to create.

Continuity reserves should protect the live registry layer

The strongest reserve claim is the live registry layer. That layer is narrower than the whole organisation and more important than any single program. It is the set of functions that must keep working even if a shock arrives tomorrow.

The first function is record accuracy. ARIN must preserve the authoritative history of which organization is recognised for which number resources, what changes were authorised, which accounts control updates, which contacts are valid, and which records are under dispute or restriction. The reserve should protect the systems, people, controls and backups that keep those records from being lost, corrupted or improvised under pressure.

The second function is public publication. RDAP and Whois are not decorative. They let networks, investigators, counterparties, lawyers, buyers, abuse desks and operators understand basic registration facts. Publication quality matters during normal operations and even more during stress. If a security event, vendor outage or staffing disruption makes public data unreliable, the market buys uncertainty. A continuity reserve should therefore fund availability, redundancy, monitoring, incident response and recovery for these services.

The third function is reverse DNS. Many business processes still rely on reverse-DNS coherence for mail reputation, security procedures, network diagnostics and operational hygiene. Reverse-DNS administration may look small beside larger governance debates, but failure is felt by operators and customers. A reserve that protects reverse-DNS continuity protects live networks rather than institutional symbolism.

The fourth function is routing-security publication. RPKI has become part of the trust surface around routing. Hosted services, repository integrity, manifests, revocation information, ROAs, change logs and support all require stable operations. A reserve should protect RPKI continuity, key material, emergency procedures, recovery capacity and the staff knowledge needed to avoid turning a finance shock into a routing-security shock.

The fifth function is account authority. The registry must know who can speak for a holder. Account compromise, stale contact records, corporate reorganisations, staff turnover and fraud attempts all create risk. A reserve should protect authentication systems, account recovery, fraud controls, secure audit trails and support queues that prevent an administrative failure from becoming a resource-control failure.

The sixth function is transfer processing. IPv4 scarcity makes transfer recognition economically important. A reserve should keep transfers moving during shocks when no fraud, dispute or clear policy problem exists. It should preserve staff capacity, systems, documentation review and escalation paths so that market settlement does not freeze merely because the organisation is under financial stress.

The seventh function is critical payroll and vendor continuity. People run the registry. Vendors host, secure, audit and support parts of it. A reserve should make sure critical staff and essential suppliers can be paid while revenue disruption is solved. The purpose is not to guarantee every role or every vendor relationship forever. It is to prevent an avoidable break in functions that users cannot replace.

When reserve policy is written from these functions outward, it becomes easier to defend. Members may disagree about the ideal size of the office, the value of a meeting format or the reach of a program. They are less likely to disagree that the live registry layer must survive. The discipline is to define that layer explicitly and to report reserve use against it. A dollar used to preserve RPKI continuity is different from a dollar used to avoid reducing travel. A dollar used to restore a data service after a breach is different from a dollar used to prolong a discretionary initiative. Both may be authorised. They should not be hidden under the same word: continuity.

Institutional reserves protect a different perimeter

The more difficult category is institutional reserve use. This is spending that preserves ARIN as it currently understands itself: its full organisational scope, program portfolio, governance rhythm, meeting culture, communications posture, legal comfort and strategic ambitions. Some of that perimeter may be valuable. The point is not to ridicule it. The point is to keep it separate from the live registry layer.

Institutional continuity can be beneficial. Public policy meetings can expose costs that staff might otherwise miss. Fellowships and outreach can lower barriers for smaller or peripheral operators. Communications can explain complex changes in service, membership or policy. Governance work can keep the board and Advisory Council connected to the community. Training and support can reduce errors that would otherwise hit the registry systems. Legal advice can clarify obligations before mistakes are made. These activities may reduce future risk.

But they do not all deserve the same reserve priority. A meeting can be postponed. A communications campaign can be narrowed. A discretionary program can be paused. A travel-heavy model can be redesigned. A broad strategic project can wait while the registry restores core services. A reserve policy that treats every existing activity as part of continuity turns the reserve into a shield for the office's preferred shape.

The danger is subtle because institutional programs often borrow the language of public service. A program is described as community support, security improvement, outreach, governance, inclusion or strategic resilience. Those words may be sincere. They may also blur the test that matters for compulsory funding: what risk to live users is reduced, and could the same risk be reduced through a narrower or voluntary mechanism?

This is where member discipline belongs. Members do not need to approve every operational drawdown in real time. Emergencies require speed. They do need to see a classification system after the fact. Was the withdrawal used for critical service continuity, technology renewal, security remediation, legal contingency, revenue smoothing, staffing continuity, governance activity, public communication, broad program funding or reserve rebalancing? Was the drawdown one-time or recurring? Was it tied to a board-approved stress scenario? Did it preserve a function that users cannot replace, or preserve a program whose value should be debated in the ordinary budget?

Without that classification, reserve use can become politically weightless. A deficit is described as planned. A withdrawal is described as prudent. A reserve remains near target after investment earnings. Members are told the organisation is stable. Stability is good, but it is not analysis. The relevant question is what stability protected.

The distinction also matters for future fee restoration. If reserves are drawn down because a critical system required emergency security work, members may accept future fees needed to restore the buffer. If reserves are drawn down because the organisation wanted to maintain broad activities while running an operating deficit, members may ask why the same reserve restoration should fall on the mandatory fee base. The future payer needs to know the past use.

ARIN's reserve policy is strongest when it recognises that not all institutional continuity is equal. The registry should be hard to kill as a function and easier to discipline as an organisation. It should be robust where users need it and contestable where members fund choices that could be made differently.

Deficits are smoother when the cushion is thick

Deficit tolerance is where reserve policy becomes visible in institutional behaviour. A reserve allows ARIN to run an operating deficit without immediate operational pain. That can be responsible. It can also become a habit.

The responsible version is straightforward. A registry may choose to spend more than current-year revenue during a defined transition. It may be modernising systems, replacing infrastructure, addressing security debt, investing in disaster recovery, absorbing a temporary revenue mismatch or responding to an event that should not trigger an abrupt fee shock. If reserves exist precisely to prevent panic, using them in such moments is rational.

The less disciplined version looks similar from a distance. Expenses exceed revenue. The difference is covered by reserves or investment earnings. Fee increases are phased. Programs continue. Staff levels remain. Members are told that the reserve policy is within target or that withdrawals are planned. The registry stays calm. The hard choices move into the future.

The economic question is whether deficit tolerance is linked to a return path and a purpose. A one-year deficit for a defined security project is different from a recurring operating gap. A planned drawdown for data-centre migration is different from using the cushion to avoid prioritising between core services and broad programs. A reserve can buy time to make a better decision. It should not buy time to avoid making one.

Deficits also change the politics of fees. If current fees do not cover current spending, the gap must eventually close through some combination of higher fees, lower spending, more investment income, slower reserve restoration, reduced service scope or changed program design. Because the registry relationship has limited exit, members deserve a candid explanation of which path is being chosen. A reserve-funded deficit without that explanation is a deferred fee debate.

The temptation is to present reserve use as financial management rather than governance. That understates its importance. In a scarce-resource registry, the decision to tolerate a deficit is a decision about whose discipline counts. If members push back on spending but the reserve can carry spending for another year, member pressure loses immediacy. If the board believes a project is necessary but has not persuaded payers, the reserve lets it proceed. If staff prefer continuity of program scope, the reserve lets scope survive until a later budget cycle. These are governance effects, not mere accounting entries.

There is also an information problem. Members may see annual budgets, audited results and reserve balances, but they may not see enough of the operational classification behind the deficit. Was the deficit driven by salaries, software, security, professional services, facilities, travel, outreach, legal contingency, depreciation, capital work or timing? Which part was avoidable? Which part protected non-substitutable services? Which part should recur? Which part should be recovered through future fees? Which part should be allowed to reduce the long-term reserve target temporarily?

Deficit tolerance should therefore come with a deficit label. A registry could classify deficits as emergency continuity, strategic renewal, revenue smoothing, legal contingency, scope maintenance or structural imbalance. The labels would not decide the merits. They would force the institution to say what kind of discipline it is asking members to defer.

A reserve is healthiest when it makes shocks boring. It is less healthy when it makes structural imbalance look like normality. The difference is not the presence of a deficit. It is whether members can see why the deficit exists, how long it should last, what will stop it and how restoring the reserve will affect future fees.

A budget-based target can reward institutional size

Reserve target design is more than a technical formula. It encodes a theory of what must be protected. ARIN's long-term reserve target is tied to the previous year's operating and capital budgets on a cash basis. The attraction is obvious. It is administratively simple. It scales with the organisation's current obligations. It avoids false precision. It gives trustees and members a visible benchmark: the reserve should be at least large enough to cover roughly a defined period of planned spending.

The weakness is also obvious. A target linked to the prior-year budget can anchor reserves to the size of the institution rather than to the cost of the indispensable registry function. If the organisation grows, the reserve target grows. If programs expand, the reserve target follows. If capital plans become larger, the target reflects them. The formula may then insure the current institutional footprint, not only the minimum continuity layer that live users require.

This does not mean the formula is wrong. It means it should be supplemented. A critical registry has more than one reserve need. It needs emergency liquidity for immediate shocks. It needs continuity funding for core services. It needs technology-renewal capacity. It may need legal-contingency capacity. It may need long-term stability to avoid abrupt fee changes. A single target based on total prior spending does not explain how much of the cushion belongs to each need.

The better discipline is a layered target. The first layer would be emergency liquidity: cash or near-cash sufficient to pay critical staff, essential vendors, incident response, security work and public-service operations for a defined period under stress. The second layer would be core-service continuity: funds tied to keeping registration records, public data, reverse DNS, RPKI, account authority, transfer processing and support alive through severe disruption. The third layer would be planned renewal: funds for unavoidable technology, security and resilience work that cannot responsibly be delayed. The fourth layer would be institutional smoothing: funds that allow gradual adjustment in fees or spending. The fifth, if retained, would be legal-contingency capacity, classified and capped by approval rules.

Such a design would still permit a target around one year of spending if that is what stress tests justify. But the number would be easier to trust because it would be built from functions rather than inherited from the total size of the office. Members could see whether the reserve protects essential service continuity or simply mirrors institutional ambition.

Stress testing would improve the target further. What happens if a major payer group delays payment? What happens if investment returns are negative while a security incident requires emergency spending? What happens if a vendor fails during a technology migration? What happens if outside counsel is needed while operating revenue is below plan? What happens if a data-centre problem coincides with staff turnover? What happens if a routing-security incident requires urgent expert help? Each scenario points to a different liquidity and reserve need. The target should be the result of those scenarios, not only a budget multiple.

The political advantage of a budget-based target is that it is easy to communicate. The political risk is that it becomes self-justifying. If the institution broadens scope, a larger reserve appears necessary because the budget is larger. A larger reserve then makes the broader scope easier to maintain. The loop may be prudent in form and expansive in effect.

The antidote is to ask a narrower question every year: what would it cost to keep the indispensable registry function alive under stress if broader activities had to pause? The answer will not be the whole reserve target, but it should be published beside it. Without that comparison, members cannot tell whether they are funding continuity of the ledger or continuity of the institution's existing size.

Liquidity and investment policy are governance choices

Reserve funds are not just a balance. They are an investment and liquidity policy. That makes them a governance issue.

The operating reserve should be boring by design. Its job is to be available when the current budget year misbehaves. Conservative investment is appropriate because the cost of chasing yield with emergency money is too high. If a security event, payment delay, vendor problem or urgent legal matter requires cash, the registry should not be forced to sell volatile assets at the wrong moment. Liquidity is part of continuity.

The long-term reserve has a different role. It can accept more diversification because its purpose is stability over a longer horizon. Diversified assets may protect against inflation and preserve purchasing power. They may also introduce market volatility, manager selection questions, governance risk, valuation swings and member-trust concerns. A long-term reserve is still member-funded capacity, not an endowment detached from the registry's public function.

The conflict-aware investment rule is therefore significant. A registry serving telecom operators, cloud providers, hosting firms, enterprises, universities and public networks should be careful about direct investments that could be perceived as taking positions in member-adjacent sectors. Even if portfolio exposure is financially small, trust can be damaged if the registry appears to benefit from the fortunes of firms whose competitors, suppliers or customers rely on its records. Avoiding direct investment in some publicly traded telecommunications or technology companies is a recognition that investment policy can create perceived conflicts.

That recognition should be extended into a broader member-trust standard. Members should understand who manages the funds, what liquidity buckets exist, what risk limits apply, how conflicts are screened, how performance is evaluated, how fees are controlled, how withdrawals are prioritised and how investment losses would affect reserve restoration. They do not need to vote on every allocation. They do need enough information to know whether the reserve is being managed for registry continuity rather than for institutional self-confidence.

Liquidity should match obligations. Emergency payroll, incident response and critical vendor payments require cash or near-cash. Security remediation may require immediate spending. Technology renewal may have scheduled outflows. Legal contingency may be uncertain but potentially sudden. Long-term program smoothing can tolerate less liquidity. A reserve policy that states target size without mapping liquidity to these needs leaves a hidden risk: the registry may have assets but not the right assets at the right time.

Investment losses also have distributional consequences. If the long-term reserve suffers a material decline, restoration may require future fee pressure or spending cuts. Members should therefore see whether the investment strategy could create fee volatility. A reserve designed to protect members from abrupt shocks should not quietly create a new shock through excessive risk.

The larger point is that investment policy expresses institutional temperament. A highly liquid but low-yield reserve favours safety and fee predictability. A more growth-oriented reserve favours purchasing-power preservation but accepts volatility. Conflict-aware restrictions favour trust over maximum flexibility. Finance Committee approval for larger withdrawals favours control but should not become opacity. Each choice is defensible only if the rationale is public enough for members to evaluate.

For a registry, finance is not separate from legitimacy. The reserve is built from a captive service relationship. Its investment policy should therefore be conservative not only in the portfolio sense, but in the governance sense: clear purpose, limited conflicts, matched liquidity, explainable risk and visible consequences for future fees.

Member discipline weakens when the account buys time

Member discipline depends on timing. If spending choices quickly produce fee pressure, service changes or public trade-offs, members have reason to pay attention. If reserves absorb the pressure, the feedback loop becomes slower. A slower feedback loop can be good in a crisis and bad in normal governance.

ARIN has real member mechanisms. General Members can vote. Members and others can participate in policy discussions and consultations. Public materials make many corporate and operational facts visible. These mechanisms are stronger than pure staff rule. But reserve capacity changes how much those mechanisms bite. A registry that can continue comfortably through a period of member concern is less exposed to immediate correction.

This is not a call for financial fragility. A registry that must beg members for emergency fees every time costs rise would be dangerous. The correct discipline is not starvation. It is visibility. If the reserve buys time, members should know what time was bought for.

There are at least four types of time. The first is emergency time: time to keep systems alive while a shock is resolved. This is the easiest to justify. The second is renewal time: time to finish a necessary technology, security or resilience project before cost recovery catches up. This can also be justified if the project is well defined. The third is adjustment time: time to phase in fee changes or spending reductions so that operators are not hit abruptly. This requires a clear restoration path. The fourth is avoidance time: time that lets the institution postpone a hard conversation about scope, staff, programs or legal posture. This is the risk.

Member reporting should distinguish the four. A withdrawal for emergency time should name the service risk avoided. A withdrawal for renewal time should name the project, milestone and expected effect on continuity. A withdrawal for adjustment time should state how fees or spending will return the fund to target. A withdrawal that effectively preserves current scope should say so plainly and invite a budget debate.

The same discipline should apply to reserve inflows. Members should see when annual fees, transfer-related revenue, investment earnings or spending undershoots increase reserves. If the reserve is above target, what happens? Are fees moderated? Are funds held for a stress scenario? Are broader programs added? Are capital projects accelerated? Does the excess lower future fee pressure or simply widen institutional comfort? The question matters because accumulation can reduce discipline as much as withdrawal.

Member oversight should also see reserve use by category rather than only by total. The categories should be stable across years: core-service continuity, security incident, technology renewal, legal contingency, revenue smoothing, operating deficit, program support, governance and communications, and reserve restoration. If some categories are confidential in detail, the aggregate still belongs in public reporting. A member does not need privileged documents to know that a drawdown was legal-contingency spending rather than service recovery.

Such reporting would protect ARIN as well as members. It would let the institution defend reserve use with evidence. It would reduce suspicion that every deficit is mission creep or that every withdrawal is a hidden war chest. It would help members distinguish real prudence from institutional insulation.

The deeper standard is simple: reserves should make the registry more resilient, not less answerable. If members can see reserve inflows, target rationale, drawdowns, stress tests, category use and restoration plans, the cushion strengthens trust. If the reserve only appears as a reassuring total, it may strengthen the office while weakening discipline from the people who finance it.

Legal resilience needs category limits

Legal-contingency capacity belongs in reserve policy, but it should not dominate the story. A registry needs staying power. It must resist fraudulent claims, bad documentation, inappropriate pressure and meritless challenges. It must enforce policies when record integrity is at stake. It must respond to court orders, contract disputes, bankruptcy questions, corporate authority problems and security incidents with legal consequences. A reserve that cannot support significant outside counsel during a true continuity threat would be incomplete.

The risk is that legal resilience can become discretionary staying power. If the institution can fund a legal posture from reserves built by the fee base, the balance between the office and an individual holder changes. The registry may be able to continue a contested position longer than a smaller member can sustain a challenge. That does not mean the registry is wrong in any given dispute. It means the reserve changes bargaining power.

The distinction should be categorical. Legal spending that protects the ledger is strongest: fraud prevention, duplicate claims, unauthorised transfers, account compromise, preservation of records, compliance with valid court orders, essential service continuity and clear contractual administration. Legal spending that protects general institutional discretion is weaker: broad policy positioning, aggressive defence of questionable scope, reputation management through legal channels, or prolonged conflict over matters that could be solved through clearer process, narrower rules or independent review.

A reserve policy can manage this without exposing privileged detail. It can define legal categories. It can require higher approval thresholds for policy-enforcement litigation or other significant outside-counsel matters. It can cap certain categories unless the board renews authority after public category disclosure. It can report aggregate spending by class. It can require post-matter summaries that state the registry function protected, the member or market cost considered, and any policy lessons learned. It can separate immediate emergency authority from longer-term litigation posture.

Finance Committee involvement for larger withdrawals is useful, but committee approval is not a full public discipline. A committee can ask whether spending is authorised, affordable and prudent. Members still need to know whether legal-contingency capacity is mostly defending core records or defending institutional latitude. The committee's role should therefore be paired with category reporting after the fact.

Legal capacity also interacts with deficits. If ordinary legal costs are modest but reserves can support major counsel when needed, annual budgets may understate legal power. That is not improper. It is precisely why the reserve policy should explain stress capacity. Members should not discover the scale of legal staying power only after a conflict consumes it.

The legal question should always return to continuity. Would the spending protect uniqueness, record accuracy, account authority, public data, routing-security integrity or transfer certainty? Would it prevent fraud or preserve valid dispute isolation? Or would it mainly preserve the office's interpretation of its own power? The first category deserves strong funding. The second requires stronger member-visible justification.

This is how ARIN can retain legal resilience without turning the reserve into a legal shield against discipline. A registry should not be easy to intimidate. It should also not be able to use member-funded reserves to make every challenge a test of endurance. The proper reserve design gives the institution enough staying power to protect the ledger and enough transparency to prevent that staying power from becoming a substitute for accountability.

A reserve test for a scarce-resource registry

A strong reserve policy for ARIN would not begin with a single balance target. It would begin with a function map.

The first test is protected core-service continuity. ARIN should define the services that reserves must protect first: registration records, public data, account authority, reverse DNS, RPKI and routing-security publication, transfer processing, critical support, security response, backup and recovery, and payroll for indispensable staff. The definition should be operational enough to guide an emergency. If a shock arrives, everyone should know what is protected before discretionary activity.

The second test is separation of liquidity. Emergency liquidity should be distinct from long-term stability funds. Money needed within days should not be invested like money needed across years. Technology renewal funds should be distinguished from legal-contingency funds. Program-smoothing funds should not be disguised as core continuity. The balance sheet can be aggregated for accounting purposes, but governance should see the layers.

The third test is a published target rationale. A target linked to prior-year budgets may be a useful benchmark, but it should be explained beside stress-test results. How many months of core-service continuity are covered? What shock scenarios were modelled? What assumptions were made about fee collection, investment loss, vendor failure, security incident, counsel need and system recovery? Why is the target enough, and why is it not excessive?

The fourth test is classified withdrawals. Every material reserve use should be reported by category. Core continuity, emergency incident, technology renewal, legal contingency, revenue smoothing, operating deficit, program preservation and reserve rebalancing should not be mixed into one story. Confidential details can remain confidential. The public category should not.

The fifth test is deficit disclosure. If an operating deficit is funded by reserves, ARIN should state whether the deficit is temporary, structural, project-driven, emergency-driven or scope-driven. It should state how long reserve funding is expected to continue and what action will restore balance. Members can tolerate deficits more easily when they know what problem the deficit solves.

The sixth test is fee restoration logic. If reserves fall below target, future fee increases may be justified. But members should know what they are restoring. A fee increase to rebuild an emergency buffer after a security incident has a different legitimacy than a fee increase to restore funds used for broad program maintenance. The restoration plan should connect past reserve use to future member burden.

The seventh test is investment and conflict discipline. The reserve policy should match liquidity to obligations, publish risk limits, explain conflict-aware restrictions and state how investment losses would be handled. A registry that asks members to trust its reserve should make the risk visible enough for trust to be rational.

The eighth test is legal-category governance. Significant outside-counsel spending should be classified, approved under a clear threshold system and reported in aggregate. Legal resilience should be available for ledger protection, fraud prevention, continuity and valid obligations. It should not become an unclassified pool for defending every discretionary choice.

The ninth test is member-facing evidence. Reserve reporting should be readable by the operator that pays but does not live inside ARIN governance. It should answer ordinary questions: what is the reserve for, how large is it, what was used, why was it used, what remains, what risks were tested, and how will fees be affected?

None of these tests requires ARIN to weaken itself. They would make it stronger by narrowing the claim it asks members to support. A registry with a visible reserve map can say, credibly, that the cushion protects the ledger and live users first. A registry without that map asks members to accept a more ambiguous proposition: that institutional stability is the same thing as registry continuity.

In a post-exhaustion environment, ambiguity is costly. Scarce IPv4 resources, transfer markets, legacy reliance, routing-security dependence and member fee pressure all make the reserve account part of the registry's accountability system. The best reserve policy would not hide that fact. It would build discipline around it.

The question in the account review

The reserve-account review returns at the end because it is where the argument becomes practical. The balance is stable. The target can be explained. The investment policy has guardrails. The operating plan can absorb a deficit. The registry is not in crisis. The temptation is to stop there and call the system prudent.

Prudence is necessary. It is not sufficient.

The harder question is whether the reserve protects the ledger first. If a shock came tomorrow, would the first protected functions be record accuracy, public data, reverse DNS, RPKI, account authority, transfer processing, security response, disaster recovery and critical staff? Would withdrawals be classified so members could see whether the money protected live services or institutional scope? Would a deficit be labelled by purpose? Would reserve restoration show how future fees relate to past use? Would legal-contingency spending be tied to ledger protection rather than general staying power? Would investment liquidity match the services that cannot stop?

ARIN's reserve position is a strength if it gives the North American registry enough resilience to survive shocks without harming operators. It is a weakness if it makes the office too comfortable to narrow itself. The same dollar can look like insurance from inside the finance review and like insulation from the member's side of the table. Good reserve policy makes the difference visible.

The proper test is not whether ARIN has money. It should. The proper test is whether the money is disciplined by function, transparency and member accountability. A registry is most legitimate when it can say: these funds protect the records, the public services, the security chain and the live networks first; broader institutional choices must justify themselves through the budget, not hide behind continuity.

That is the economics of reserve policy discipline. A critical registry should never run close to the edge. It should also never let the existence of a cushion become a substitute for the discipline owed to those who fund it and cannot easily leave. The reserve should protect the book, not the bookkeeper's every preference. It should protect the continuity of function, not the continuity of every authority claim. It should give ARIN the capacity to withstand real shocks, while giving members the evidence needed to decide whether the institution has used that capacity narrowly.

The final reserve-account question is therefore simple. If tomorrow brought a security incident, revenue shock, vendor failure, data-centre problem, payment delay, litigation challenge or emergency operation, would the reserve protect the ledger and live networks first, or would it first protect the institution's existing size, programs and discretion?