Summary

  • Escrow is a valuable but narrow control. It verifies funds, holds them under agreed instructions and releases or refunds them when a defined condition is met. It reduces counterparty payment risk; it does not acquire authority over an RIR's eligibility decision, records, sanctions review, inter-RIR coordination or later correction.
  • An IPv4 closing therefore contains at least two distinct finality events. Payment finality is the point at which the money is unconditionally released under the escrow arrangement. Registry finality is the point at which the responsible registry or registries have completed a coherent, authoritative change and defined what can still be corrected, challenged or reversed.
  • Most escrow designs link the two events by observation rather than making them atomic. A provider or party sees a completion notice or recipient record, treats that evidence as delivery and releases funds. The registry does not simultaneously commit the record in the same system that commits the payment, and it is not necessarily bound by the escrow agent's interpretation of completion.
  • The dangerous cases arise in the gaps: approval followed by an incomplete record update; one RIR completing before its counterpart; funds released against a transient public state; a court or fraud finding requiring correction; technical authority remaining with the seller; or a rejection arriving after the parties have incurred financing, legal and operational costs.
  • A serious transfer agreement should define a registry-finality certificate, a cutover snapshot, exact stop conditions, a bounded confirmation window, technical-state checks, refund and unwind duties, correction handling, residual holdback and remedies for an impossible return. “Whois changed” is not a complete closing condition.
  • Number Resource Society can support a portable evidence and reconciliation standard without becoming an escrow company or transfer gatekeeper. The aim is a narrow registry service whose completion state is deterministic, signed, reviewable and interoperable enough for commercial settlement to rely on it.

The safest money in the room can still finance a failed transfer

The comforting version of an IPv4 closing is almost cinematic. The buyer's money waits in a neutral account. The seller cannot touch it. The seller asks the registry to move the block. The registry approves. The buyer checks the record. The escrow agent releases the funds. No one has to trust a stranger with both the addresses and the cash.

That sequence is safer than sending an irreversible wire to a seller before delivery. It is not safe in the broader sense often implied by the word escrow.

Consider a transaction in which every commercial actor performs honestly. The buyer funds on time. The seller submits accurate documents. The broker communicates promptly. The escrow agent follows the instructions exactly. The transfer can still be refused because a registry interprets a holding period, organisational chain, recipient condition, regional rule or dispute flag differently from the parties. It can remain suspended while one institution asks for more evidence. It can be approved by one registry and await the other.

It can appear complete in one public record while credentials or related services remain attached to the previous holder. A later court order or finding of falsified authority can require the record to be corrected.

Escrow has not malfunctioned in any of those cases. It simply does not control the failing component.

This is the important distinction in Lu Heng's observation that an orderly agreement, clean paperwork and escrow do not themselves enforce continuity. A broker can make a transaction look organised while the decisive administrative dependency remains outside the bargain. The registry desk still determines whether it will recognise the change. In an inter-RIR case, two desks must agree and coordinate. The escrow company can hold money against a condition, but it cannot turn those separate institutions into one reliable settlement engine.

The market often describes this arrangement as if escrow sits above the entire transaction. In reality it sits beside the registry. The two systems exchange evidence through people, email, tickets, public records and contractual instructions. They do not share a single commit point. A failure in one does not automatically and instantaneously reverse the other.

That is why the right question is not, “Was escrow used?” It is, “What exactly did escrow make final, what exactly did the registry make final, and what happens if those moments do not coincide?”

Escrow solves payment risk, and that is worth preserving

Criticism of overclaim should not become criticism of the control itself. A properly constituted escrow arrangement performs an essential market function. It changes the incentives on both sides before a transfer begins.

Without escrow, a buyer asked to pay first faces the risk that the seller disappears, fails to submit the transfer, lacks authority over the block or cannot satisfy the source registry. A seller asked to transfer first faces the risk that the buyer receives the recognised registration position and then withholds payment, becomes insolvent or invents a dispute. When the parties are in different countries and have never dealt with each other, ordinary litigation is a poor substitute for controlling the sequence.

An escrow agent addresses this bilateral mistrust by taking custody of the funds and applying agreed release conditions. Escrow.com's published IPv4 sequence is explicit: the parties agree a price, the buyer deposits payment, the seller completes a verifiable transfer, the buyer confirms receipt and accepts it, and the provider releases payment. Its IPv4 terms identify the source and recipient RIRs, allow receipt to be evidenced by recipient-RIR Whois records or buyer confirmation, and tie release to acceptance or expiry of an inspection period.

IPv4.Global describes a comparable sequence in which money is held, the registry change is confirmed in the buyer's account and funds are then released.

These arrangements can protect good funds, reduce deliberate non-performance and create a neutral record of instructions. They can also define cancellation, dispute and refund procedures. That is substantial value. It permits parties to begin a registry request without either side making an unsecured delivery of its principal asset.

But the escrow agent's protected asset is money. Even where its terms call the address block property and define what counts as delivery, it does not operate the RIR. It observes an external fact and applies a private agreement to that observation. It is not the institution that decides whether the source was authorised, whether the recipient qualifies, whether an inter-RIR route is compatible or whether a record should later be amended because evidence was false.

The distinction is easiest to see when a request is rejected. The escrow provider can return the buyer's funds according to the agreement. It cannot return the parties to the exact position they occupied before the deal. Legal fees have been incurred. Financing may have been reserved. A buyer may have promised customers capacity. A seller may have stopped marketing the block. Technical teams may have changed route objects, geolocation records, allowlists or deployment plans. A non-refundable registry fee may already have been paid. Escrow preserves principal; it does not erase reliance.

The correct reform therefore begins by keeping escrow within its competence. Do not ask it to certify the policy merits of a transfer. Do not ask it to guarantee routing. Do not treat its release as conclusive evidence that every registry consequence is permanent. Make it excellent at custody and conditional settlement, then demand a registry completion signal good enough to support that settlement.

Payment finality has a knowable legal moment

Payment finality is more than the buyer clicking “accept.” It is the point at which the relevant money obligation has been discharged under the escrow terms and applicable payment law, and the release is no longer merely provisional. Before that point, funds may be deposited but unavailable to the seller. A release instruction may have been sent but not settled. A bank transfer may remain subject to compliance review or operational failure. After finality, the seller should be able to rely on the payment without expecting an ordinary reversal initiated by the buyer.

Financial-market standards are useful here because they are unusually strict about vocabulary. The Committee on Payments and Market Infrastructures defines final settlement as an irrevocable and unconditional transfer or discharge of an obligation under the governing rules. Its settlement-finality principle asks a system to define the point at which settlement is final and the point after which an accepted instruction cannot be revoked by a entity.

An IPv4 sale is not thereby a securities transaction, and an RIR is not thereby a financial market infrastructure. The comparison is functional. When two valuable obligations are exchanged, sophisticated settlement design refuses to let the word “complete” float. It identifies the legal moment, the system that produces it, the evidence available to entities and the treatment of an exceptional correction.

The same discipline should apply to escrowed address transfers. The agreement should say whether payment finality occurs when the escrow agent issues a disbursement instruction, when the seller's bank is credited, when the inspection period expires or at some other defined point. It should distinguish release approval from actual receipt. If currency conversion, correspondent banking or sanctions screening can hold a disbursement after release, that interval should not be hidden beneath one timestamp.

This clarity matters because remedies change at finality. Before release, a valid cancellation may return funds with limited loss. After release, a buyer seeking repayment may have only a contractual claim against the seller. If the seller has distributed proceeds, entered insolvency or moved jurisdictions, the difference is enormous. A poorly defined registry trigger can therefore convert a correctable administrative ambiguity into an unsecured recovery claim.

Payment finality is the strong side of the present design because escrow companies and payment institutions have direct control over the funds they hold. The registry leg lacks an equivalent universally defined moment. That asymmetry, not an intrinsic defect in escrow, produces the closing risk.

Registry finality is not merely an approval email

Registry finality answers a different question: when can the buyer, seller and relying institutions treat the recognised registration state as complete, coherent and no longer subject to ordinary unilateral change?

Current RIR materials identify parts of that answer but not one global definition. ARIN's transfer guide says that after approval, receipt of signed agreements and applicable fees, and any required inter-RIR coordination, the resources will be transferred. APNIC says the source initiates, the recipient acknowledges, APNIC evaluates the request, the recipient pays the fee for an approved transfer and APNIC updates the Whois record. RIPE policy says the original holder remains responsible until completion and that the RIPE NCC completes the transfer by updating registration records.

For an inter-RIR transfer, RIPE's published procedure requires approval by both registries and coordination under both sets of rules.

These statements make the record update decisive. They do not make every visible artefact at that moment equally conclusive.

An approval notice may be conditional on a contract or fee. A changed public registration record may lag an internal account state or lead it. A resource certificate may need revocation or issuance. Reverse-DNS delegation and Internet Routing Registry entities may require separate action. The transfer log may be published later. In a bilateral case, the source can remove the old state while the destination is creating the new state, or the parties can see different results because caches and publication intervals differ.

Registry finality should therefore include four elements.

First, the decision is final within the ordinary administrative channel: all stated conditions have been met and no routine staff action remains. Second, the authoritative custody record is coherent: exactly one recognised current holder exists in the relevant registry system. Third, related authority controlled by the registry has reached the declared handover state, or any remaining step is identified and assigned. Fourth, the institution defines the exceptional grounds on which the result may later be corrected, such as fraud, clerical error, court order or a successful review.

That fourth element is uncomfortable but necessary. “Final” cannot honestly mean immune from law or correction. RIPE NCC's published arbitration summaries include disputes about transfers and cases in which transfers were reverted following court findings or false information. Those examples do not prove that ordinary completed transfers are unstable. They prove that an administrative record can be changed after apparent completion when a superior legal or evidential ground emerges.

A useful finality statement must distinguish ordinary irrevocability from exceptional correction. Without that distinction, a buyer may believe a completion email guarantees permanence while the registry believes it has merely applied the information available at the time. Escrow may release against the buyer's understanding even though the institution retains a broader correction power.

Registry finality is thus not metaphysical ownership. It is a bounded institutional promise: the registry has completed the requested state transition, no unresolved ordinary condition remains, the resulting record is internally coherent, and any later alteration must use defined exceptional grounds with notice, evidence and review.

Observation is not atomic settlement

The deepest design error is to confuse conditionality with atomicity.

An escrow agreement creates conditionality. It says, in effect, “release the funds if evidence X appears.” If X is a recipient-RIR record naming the buyer, the escrow agent checks that record or accepts a confirmation and then acts. This sequence links payment to registration more safely than an unconditional wire.

It is not atomic because the two state changes do not occur as one indivisible operation. The RIR updates its records in one legal and technical environment. The escrow agent releases money in another. A message, public query or human instruction crosses the boundary. Time passes. Facts can be misunderstood or change.

The distinction is familiar in exchange-of-value systems. Principle 12 of the CPMI-IOSCO Principles for Financial Market Infrastructures says principal risk should be eliminated by conditioning final settlement of one linked obligation on final settlement of the other. Delivery-versus-payment mechanisms are designed so final delivery occurs if and only if final payment occurs. The important words are both occurrences of “final.” A provisional delivery signal paired with final cash is not the same thing.

IPv4 escrow usually offers “observe, then pay,” not true delivery versus payment. The observation may be excellent. It can be cryptographically logged, independently checked and contractually accepted. Yet the escrow system cannot lock the registry state while it commits the funds. The RIR cannot see into the escrow ledger and make its own completion contingent on irrevocable payment. Neither system can automatically abort both legs if the other fails at the last moment.

This non-atomicity creates a classic uncertain interval. At time one, the registry appears to have completed. At time two, the observer verifies. At time three, escrow releases. At time four, the seller receives. During or after that interval, an error report, rival claim, court order, sanctions event, technical correction or counterpart mismatch may emerge. The probability may be low; the exposure is the entire principal plus reliance costs.

Calling the interval short does not remove it. Calling the provider trusted does not remove it. Asking the buyer to click acceptance transfers the judgement to the buyer but does not improve the underlying registry assurance. The proper solution is not to pretend the systems are one. It is to design the interface between them as a first-class risk boundary.

That means the registry must issue a completion statement fit for external reliance, and the escrow instructions must specify exactly which statement qualifies. The statement should have a unique transaction reference known to the parties, identify the prefixes and transfer type, name the source and recipient registry where applicable, record the effective time, confirm that ordinary conditions are closed, and identify any still-pending technical service. A public Whois result can corroborate it. It should not substitute for it.

Rejection leaves more behind than a refund

The cleanest failure occurs before any registry change. The RIR refuses the request, the escrow condition is not met and the buyer receives the money back. Even this is not a return to zero.

Registry refusal can arise from several different facts. The source may not match the recognised holder. Corporate authority may be incomplete. The block may be subject to a lock, dispute or recent-transfer restriction. The recipient may fail a needs or eligibility test. An inter-RIR path may not be accepted. Sanctions review may prevent action. A party may miss a deadline or decline to provide additional documents.

Those reasons allocate responsibility differently. If the seller represented that the block was eligible and it was not, the buyer may have a claim for diligence costs. If the buyer failed an eligibility condition disclosed in advance, the seller should not carry the entire loss. If a registry changes its interpretation after pre-approval, both parties face institutional risk. If two RIRs disagree, neither commercial party may be at fault.

A generic refund clause cannot answer those distinctions. The purchase agreement needs a rejection taxonomy tied to consequences. It should identify which representations survive, who pays registry and escrow fees, whether exclusivity ends immediately, whether the seller may remarket the block, what evidence each party receives and whether a revised request is permitted. Where the registry gives only a vague reason, the agreement should not automatically deem either party in breach.

Pre-approval reduces one class of risk but cannot cure the whole process. ARIN and APNIC both publish recipient pre-approval mechanisms. ARIN states that its pre-approval can remain valid for two years, while APNIC describes a 24-month validity period. These checks can prevent a buyer from funding a deal obviously outside its approved size. They do not prove the seller's authority, block eligibility, absence of disputes, inter-RIR acceptance or final cutover. They can also be superseded by facts arising after approval.

The money returning safely is still a success of escrow. The failed acquisition is still a failure of the transaction. Members evaluating registry performance need to see those outcomes separately. Otherwise the existence of refunds can be used to dismiss the economic cost of refusals that should have been predictable or explained earlier.

Delay turns protected funds into immobilised capital

Escrow is often described as if waiting were neutral because the money is safe. It is not neutral. Held funds cannot simultaneously finance another acquisition, network expansion or ordinary liquidity need. The seller cannot redeploy proceeds. Both parties remain exposed to changes in demand, financing conditions, currency, corporate authority and business plans.

The cause of the wait matters. Some time is legitimate: identity must be authenticated, authority checked, sanctions obligations met and contradictory claims investigated. Some time belongs to the parties because documents are late or inaccurate. Some belongs to an inter-RIR handoff. Some has no visible owner because a ticket is simply pending.

Escrow cannot compel an answer. A long-stop date can end the commercial arrangement, but it cannot make the registry decide before that date. Cancellation may itself be difficult if one registry has begun changing state or if the parties disagree about whether the delivery condition has been met. A buyer may fear walking away from a case that is one day from completion. A seller may refuse an extension while the buyer's funds remain tied up.

The contract should therefore define more than one deadline. It needs an intake deadline by which all party documents must be submitted; a readiness confirmation before funds become fully committed; a cutover authorisation after both registry sides are ready; and a long-stop date after which no state change may be initiated without renewed joint instruction. If a registry cannot agree to the final stop, the escrow condition must recognise that uncertainty rather than treating silence as progress.

A useful pause notice should identify the controller without exposing confidential documents: buyer action, seller action, source-registry review, recipient-registry review, joint reconciliation, legal hold or external order. The notice should say whether the case remains eligible for cancellation and which state is authoritative during the pause.

This is not a demand that every transfer be instantaneous. It is a demand that protected money not become an excuse for ownerless delay. Safety of principal and availability of capital are different properties. An institution that can keep a valuable transaction suspended should be able to state what is pending, who can resolve it and what happens when the parties' commercial window closes.

Two registries create a split-brain closing risk

Inter-RIR transfers expose non-atomicity in its clearest form. The source registry knows the current holder and must retire or alter that state. The recipient registry must create the new recognised state. Both apply their own policies and procedures. RIPE NCC's inter-RIR documentation expressly says both registries must approve and that requests are processed in coordination with the relevant RIR.

The phrase “in coordination” carries a large burden. It must prevent simultaneous conflicting custody, an interval with no recognised holder, mismatched prefix boundaries, incompatible effective dates and disagreement over whether conditions were satisfied. It must also align related services well enough that the buyer can operate after closing.

No escrow agent can see all of that merely by querying one public record. If the source no longer names the seller but the destination has not finished creating the buyer, has delivery occurred? If the destination names the buyer while a source-side certificate or route object remains active, is the transfer complete? If one registry sends approval and the other later reports that a condition was not met, which message controls release?

The worst outcome is a split-brain state: each institution, party or public interface gives a different answer about who is recognised and whether the case is complete. The money leg then has no safe binary trigger. Releasing may expose the buyer; refunding may expose the seller; waiting may trap both while operational authority is already moving.

The answer is a coordinated cutover protocol, not a promise to communicate. Before cutover, both registries should sign a readiness statement referencing the same case, resource set and intended recipient. The source should identify the last valid pre-transfer state. The recipient should confirm that all its conditions are met. A cutover coordinator should issue a scheduled window. Each registry should attest its completed action. A final reconciliation should state that the two resulting views agree.

If either completion attestation is absent or inconsistent, the case enters an exception state and escrow remains closed. The registries then restore the agreed pre-transfer state or finish the cutover according to a published decision rule. Commercial parties should not have to negotiate which registry's partial action counts as delivery after the fact.

This resembles a two-phase commit in logic, but it need not use that literal technology. The important features are prepare, commit, abort and reconcile. Human review can remain where law or evidence requires it. What must disappear is an undefined middle in which one institution has acted, another has not, and the parties' principal depends on screenshots and judgement calls.

A registry record has dependent authority around it

The custody row is central, but a transfer reaches other registry-linked controls. RPKI certificates and Route Origin Authorisations can affect how networks validate route origins. Reverse DNS can affect services and reputation. Internet Routing Registry entities can influence filters. RDAP and Whois data direct abuse, security and commercial inquiries. Account access determines who can maintain these functions.

These controls do not all prove ownership or command routing. They do, however, shape whether the buyer can use the registration position it paid for. A transaction can therefore be complete in the narrow custody record and defective in the surrounding authority.

Suppose the buyer appears as registrant but cannot create the required RPKI authorisation because account entitlements have not propagated. If old authorisations remain, the seller may retain more apparent authority than intended. If old authorisations are revoked before replacements are available, routes may become invalid at networks enforcing origin validation. Similar gaps can occur with reverse DNS or registry-maintained routing entities.

The closing condition should not demand that every independent network accept the buyer's route. RIRs cannot guarantee that, and BGP remains governed by operator policy. It should demand that the registry-controlled services reach a declared handover state. The finality certificate can list each service as transferred, revoked, newly available, not applicable or assigned to a dated post-closing action.

The parties should capture a cutover snapshot. It includes the authoritative registration response, account entitlement, relevant certificate state, delegated reverse-DNS state and any registry-operated routing record within scope. Hashes or signed receipts can show what was observed without publishing confidential account material. The snapshot becomes the evidence against which a later inconsistency is evaluated.

This protects the registry too. Without a precise snapshot, every post-closing routing or reputation problem can be blamed on “the transfer.” With one, the parties can distinguish a registry-control failure from an upstream filter, geolocation lag, stale private allowlist or buyer configuration. Accountability becomes narrower and more credible.

Escrow should not hold the full purchase price until every global operational effect settles. That would make release indefinite. A better design separates the core registry-finality condition from bounded technical holdbacks. Most funds can release when the coherent custody state is final. A smaller agreed holdback can cover specified registry-controlled follow-up items for a short period. Independent routing acceptance remains outside the escrow warranty unless the seller expressly promised assistance.

Rollback is easy to say and hard to perform

Transaction documents often use “unwind” as if it were a reverse button. If the transfer fails, the addresses go back and the buyer receives the money. The idea works only before either leg has become final and before third parties have relied on the new state.

After payment release, returning money requires the seller to have it and to comply. After registry completion, returning the block may require a new registry action, new documents, another policy review or an exception to a holding period. If the buyer has announced the prefixes, assigned addresses to customers, issued certificates, changed reverse DNS or entered downstream contracts, operational return becomes a migration. If the original seller no longer qualifies or has dissolved, restoration may be impossible.

A court-directed correction is even more complex. The registry may be required to alter its record because the original transfer agreement was invalid, authority was falsified or an earlier right prevails. The commercial settlement cannot be reconstructed merely by changing the holder field. The buyer may have paid in good faith. The seller may be insolvent. Customers may be live on the space. Escrow has long since closed.

This is why rollback policy must be designed before closing and why “registry finality” must specify the correction boundary. There should be distinct terms for pre-commit abort, post-registry/pre-payment cancellation, post-payment contractual unwind and compulsory record correction. Each state has different remedies.

Before commit, restore the signed pre-transfer snapshot and refund the funds. After the registry has committed but before payment release, an abort should require both registries to confirm restoration before a refund treats delivery as undone. After payment finality, the normal remedy should not be an informal staff reversal. It should require the contractual or legal ground specified for correction, notice to affected parties, preservation of evidence, an opportunity for urgent review and a continuity plan.

Where exact return is impossible, the agreement needs substitute performance: equivalent clean address space, monetary damages, insurance, a reserve or another negotiated remedy. Pretending every address block is fungible would be wrong because size, registry region, history, reputation and operational preparation differ. The substitute rule must define equivalence rather than assume it.

The registry's responsibility is not to guarantee the seller's solvency. It is to avoid creating unnecessary ambiguity about whether its own action was provisional, final or corrected. An institution that changes the authoritative record should issue an equally authoritative correction record stating the legal or evidential ground, effective time and current recognised state. Silent reversion is incompatible with a market that settled against the prior result.

The agreement needs a state machine, not the word complete

The practical drafting reform is to replace narrative closing language with a small set of mutually exclusive states. Every entity should know which state the transfer occupies and which actions are permitted there.

Agreed means the parties have signed but escrow is not fully funded and no registry cutover may occur. Funded means good funds are held, but no registry has represented that the case is ready. Under review means the request is being evaluated and the pre-transfer registry state remains authoritative. Ready for cutover means all party conditions and all RIR approvals required before state change have been satisfied. Committing means the coordinated update window has begun and cancellation requires the exception rule. Registry final means the coherent state and required attestations exist. Payment final means escrow has irrevocably discharged the payment obligation. Exception means a mismatch, challenge or technical failure prevents ordinary progression. Corrected means an exceptional post-completion change has been made with a preserved reason and replacement state.

No state should be inferred from elapsed time. No public page should silently advance the commercial agreement. Each transition needs an actor, evidence, effective time and allowed next states. If a required event does not occur, the case should move to exception rather than remain ambiguously “processing.”

The release instruction should depend on registry final, not on approved, committing or one visible record. The registry-final state should require the common reference, exact resource set, final holder, source and destination attestations where applicable, and declared status of registry-controlled authority. Buyer acceptance can be an additional condition, but it should not force a buyer to certify facts only the registry can know.

The state machine also improves dispute resolution. If funds released from “under review,” the escrow condition was wrong or misapplied. If the source and destination attestations conflict during “committing,” the registries own the reconciliation. If a court order arrives after both final states, the correction and commercial-remedy clauses govern. The entities no longer argue about the emotional meaning of completion; they identify the failed transition.

This discipline should be portable across brokers and RIRs. Commercial terms can vary. Prices, warranties, governing law and financing can remain private. The minimal state vocabulary can remain common because it describes the interface between payment and registry custody, not the merits of the bargain.

Finality requires evidence that survives the closing screen

An email and a screenshot are weak foundations for a high-value settlement. They can be genuine and still be incomplete. A screenshot may show a cached page. An email may say approved while conditions remain. A public record may change without identifying the request that caused it.

The registry-finality receipt should be machine-verifiable and human-readable. It should contain the RIR name, common case reference, transfer type, exact prefixes, recognised source and recipient, effective timestamp, policy version applied, completion status, counterpart attestation references, and a statement that ordinary completion conditions are closed. It should state the defined exceptional correction grounds and the review contact. A digital signature should allow the parties and escrow agent to verify provenance later.

The escrow agent does not need confidential diligence. It needs a yes-or-no receipt whose semantics are public. The buyer and seller may receive a fuller private record of submissions and decisions. The public transfer log can later provide a separate transparency record. These evidence layers should agree on the resource and date without disclosing the contract price or protected documents.

The escrow system should issue its own finality receipt: amount released, currency, beneficiary, instruction time, actual settlement confirmation where available and the registry receipt on which release relied. Linking the two receipts creates an audit chain. It does not merge the systems, but it makes the boundary visible.

A bounded confirmation period should follow registry commitment before payment finality. During that period, both RIRs and both parties verify that the attested state is visible and coherent. The period should be long enough to catch publication and entitlement mismatches but short enough not to give the buyer a free option after delivery. Its purpose is verification, not reconsideration of the deal.

If the verification fails, the case enters exception automatically. Funds remain held. The registries identify whether the attestation or implementation is wrong. The buyer cannot reject for an unrelated commercial reason, and the seller cannot demand release against a partial state. A clear scope protects both.

Evidence retention matters because disputes may arise years later. The parties should retain signed receipts, not private credentials. Registries should preserve the pre- and post-transfer snapshots, authority evidence and decision reason under controlled access. Escrow should preserve the instructions and final disbursement record. Later correction can then reconstruct what each institution knew and promised at the time.

Risk should sit with the actor that controls it

The present market often loads registry risk into broad buyer and seller warranties because the registry disclaims the commercial transaction. That is understandable but incomplete. Parties should bear risks they can investigate or control. They should not be forced to insure unexplained institutional discretion by default.

The seller controls truthful disclosure of its identity, authority, disputes, prior commitments and block history. The buyer controls truthful recipient information, eligibility evidence, account readiness and payment. The broker controls its representations, instructions and conflicts. The escrow agent controls custody and application of release terms. The RIR controls the consistency of its stated procedure, the integrity of its decision, the accuracy of its record transition and the clarity of its completion signal.

Responsibility need not mean unlimited damages. It means the institution cannot define the decisive condition, perform the decisive act and then describe every consequence as a private matter. If a registry issues a finality receipt in error, loses synchronisation with another RIR or changes the record without the promised review, it should provide correction, reasons and a remedy proportionate to the service failure.

This follows the broader accountability principle in Heng's notes: power over high-value operational assets cannot remain detached from responsibility for exercising that power. The narrower the registry role becomes, the easier that symmetry is to provide. A registry need not warrant price, profitability, customer demand or global routing. It can warrant that it authenticated the request under its rules, kept a unique coherent record, issued an accurate completion receipt and used defined procedure for any correction.

Insurance and reserves can cover residual risks. A broker's professional cover can respond to instruction errors. Escrow licensing and bonding protect custody. A transfer warranty policy could cover specified defects in source authority. The registry could maintain service-failure cover for erroneous record actions. None should be marketed as total protection; each maps to a controlled failure domain.

The parties should also avoid contractual clauses that turn every registry delay into seller default or every registry rejection into buyer default. A neutral institutional-failure category is needed. It triggers refund and cost allocation without manufacturing blame. Repeated unexplained use of that category then becomes evidence for membership oversight rather than a private loss hidden in settlements.

Members need to know whether the closing interface works

Registry accountability cannot be evaluated from completed-transfer lists alone. For the escrow interface, members need aggregate evidence about where cases stop between readiness, registry commitment and commercial settlement.

The reporting unit should be one commercial transfer case linked to one registry case or a reconciled set of bilateral cases. It should count how many funded cases reached ready-for-cutover, how many entered commitment, how many produced matching finality receipts, how many entered exception, how many were restored before payment and how many required post-completion correction. Reasons should distinguish party evidence, policy ineligibility, counterpart disagreement, technical implementation mismatch, external legal order and registry error.

The report should also disclose whether funds were held when an exception occurred and whether the case was resolved by completion, refund, substitute performance or litigation. Amounts need not be public. The accountability question is whether the interface protected both legs and whether an institutional defect created an uncompensated loss.

Every inter-RIR pair should reconcile its counts. A source registry reporting a completed transfer while the destination reports an abandoned case is not a minor statistical discrepancy. It signals disagreement about the event on which commercial settlement may have relied. The pair should publish a correction note after resolving it.

Post-completion changes require special visibility. Publish the number of corrections, broad ground, whether the holder changed, whether an appeal or court order was involved and whether operational continuity measures were used. Small cells can be delayed or combined to protect parties. The existence of a correction should not vanish.

This reporting is not intended to shame institutions for every rejected or corrected case. Some rejections protect the record. Some corrections enforce valid law. The objective is to prove that the institution knows the difference between an ordinary refusal, a failed cutover, a clerical correction and a contested reversal. A registry unable to classify its own outcomes is not ready to supply a finality signal to an escrowed market.

NRS can standardise the boundary without owning the transaction

Number Resource Society has a practical role here if it resists the temptation to become another approval layer.

It can publish an open transfer-finality vocabulary: the state definitions, required receipt fields, bilateral readiness and completion attestations, exception reasons, correction notice and reconciliation rules. Registries, escrow companies and brokers can adopt the standard independently. No NRS permission should be required for a valid transfer.

It can provide conformance tests. A participating registry can demonstrate that it will not issue “registry final” before required counterpart evidence exists, that duplicate current-holder states are rejected, that an interrupted cutover returns to a known state and that signed receipts remain verifiable. These tests examine the reliability of the record service, not the commercial deservingness of buyers and sellers.

It can support party-controlled portability. The buyer and seller should be able to export their state history, submissions, RIR notices and finality receipts in a common packet. If an escrow dispute occurs, each side can provide the same signed event history. Portability also reduces dependence on a ticket interface that may change after closing.

It can publish aggregate exception and correction reports from signed institutional returns. The comparison should preserve context and missing data rather than produce a theatrical league table. An RIR that reports an error and fixes it may be more trustworthy than one that reports no exceptions because it does not measure them.

NRS should not hold client money, choose brokers, set transfer prices, certify legal title or replace courts. It should not make its receipt an extra condition imposed on parties. Its value lies in making the existing boundary between commercial settlement and registry recordkeeping narrow, testable and replaceable.

That is the positive vision of a bookkeeper fit for an asset market. It does not claim the authority to bless the bargain. It provides a record accurate enough that others can settle their bargain without guessing what the bookkeeper meant.

Escrow is strongest when the registry stops borrowing its reputation

The phrase “escrowed transfer” can create a false halo around the whole transaction. Money is safe, so the transfer sounds safe. The conclusion does not follow.

Escrow protects the buyer from paying before the agreed evidence of delivery and protects the seller from delivering without committed funds. It can manage disputes within its terms. It can produce a clean payment record. Those are major protections and should remain standard in transactions between unfamiliar parties.

The RIR still controls a separate finality domain. It can approve or refuse. It can ask for documents. It can coordinate well or badly with a counterpart. It can create a coherent record or a temporary mismatch. It can later face evidence that justifies correction. None of those powers is secured merely because the money waited in a licensed account.

A mature market stops using one control as a substitute for another. It demands protected funds and reliable registry finality. It defines the moments separately, links them through signed evidence and prepares for the exceptional case in which the link fails.

The minimum reform is concrete. Registries issue a finality receipt after a coherent state change. Inter-RIR pairs use prepare, commit, abort and reconciliation states. Escrow instructions release only against the final receipt plus a bounded verification period. Related registry-controlled authority is declared. Corrections use preserved grounds, notice and review. Agreements distinguish refund, restoration, unwind and substitute performance.

None of this asks a registry to guarantee business value or routing. It asks the registry to guarantee the quality of the record action only it can perform. None of it asks escrow to judge policy. It asks escrow to rely on evidence whose meaning does not shift after the funds leave.

The hardest lesson is also the simplest. A protected payment cannot repair an arbitrary refusal. It cannot accelerate an ownerless delay. It cannot synchronise two institutions. It cannot restore a block after downstream reliance. It cannot convert a provisional record into an irrevocable one.

Escrow can keep honest parties from having to trust each other with principal. Only a well-designed registry process can keep them from having to gamble on the bookkeeper.

Sources