Summary

  • RIPE NCC’s Q3 2026 report records 2,172 cumulative EU and OFAC screening alerts, including 110 under investigation, but gives no age distribution for those open cases.
  • Because potential matches face restrictions on new-resource and transfer requests until they are cleared, a privacy-safe case clock would turn a useful status table into an accountability record.

The most important number in RIPE NCC’s latest sanctions report is not the total. It is 110: the alerts classified as “under investigation” on 2 July 2026. The same row records no cases waiting to be started, 2,021 in a combined column for false positives, non-applicable sanctions, exemptions and OFAC outcomes, 16 cases on hold, and 25 confirmed as sanctioned and applicable to RIPE NCC services. Those categories add back to the cumulative total of 2,172.

The previous quarterly snapshot, dated 7 April, recorded 2,110 total alerts, 99 under investigation, 1,971 in the combined outcome column, 16 on hold and 24 confirmed applicable. The arithmetic between the two rows is therefore clear: total alerts rose by 62; the investigation stock rose by 11; the combined outcome column rose by 50; confirmed applicable cases rose by one; and the on-hold count did not change.

That arithmetic is useful, but it is not a workflow history. A stock can rise because new cases arrived faster than old ones were cleared, because an existing case changed classification, or because both happened together. The published table does not identify cohorts. It cannot tell a member whether the 110 open investigations are mostly fresh matches, a small number of old cases, or a mixture. Nor can the 50-case increase in the combined column be called 50 false positives: the column deliberately groups several different outcomes.

The missing clock matters because the report also describes a control with immediate commercial effects. RIPE NCC says sanctions compliance allows no grace period. A potential match must be treated as though it were sanctioned until staff can establish otherwise, and requests for new resources or transfers will not be processed while the case remains uncleared. The document separately says registration is frozen, not use: it does not claim that routes stop working, resources are deregistered or a member’s service agreement is terminated. Still, a transfer that cannot proceed is not an abstract status.

It can delay a transaction, financing, restructuring or recovery plan.

RIPE NCC already publishes more than many institutions would. The report distinguishes members, End Users and inter-RIR transfers; it defines each status; it gives dated snapshots; and its case-level sanctions table protects identities while showing relation, country and affected resource quantities. The organisation’s trust material explains why EU sanctions bind a Dutch association, while the Executive Board’s earlier resolutions set continuity of the Internet beside legal compliance. The problem is not secrecy in general. It is that the most time-sensitive part of the process is visible only as a headcount.

A case clock need not identify anyone. The report could publish age bands for the current investigation stock—less than 30 days, 30 to 90, 91 to 180, and more than 180—together with a median and a privacy-protected upper percentile for cases cleared during the quarter. A cohort table could show how many alerts entered, left or changed status, while suppressing cells small enough to expose a holder. The clock should pause or annotate periods in which RIPE NCC is waiting for information from the affected party or an authority. Otherwise an elapsed-time number would assign every delay to the registry.

The distinction between alert and resource holder also deserves preservation. The Q3 table calls its total “alerts for EU and OFAC investigations”; it should not be read as 2,172 unique organisations. The report says most cases turn out to be false positives, but its aggregate outcome column does not let outsiders calculate a pure false-positive rate. Better time evidence should not be built on a worse denominator.

This is not evidence that RIPE NCC missed a deadline, treated a particular holder unfairly or left the same 110 cases untouched for a quarter. The public record supplies no service target and no case lineage from April to July. It is evidence of a narrower design gap: the institution publishes the state of a consequential queue without publishing its age.

The Q4 2024 report had already acknowledged that many screening alerts were awaiting a conclusion. By July 2026, “not yet started” was zero, a meaningful sign that intake was not simply parked in a visible backlog. The next question is no longer whether work began. It is whether open work resolves on a timescale that members, the Board and the wider Internet community can evaluate without learning who the cases concern.

Sources: RIPE NCC Q3 2026 sanctions report, Q2 2026 sanctions report, Q4 2024 sanctions report, sanctions report archive, RIPE NCC Trust Centre legal and compliance page and Executive Board sanctions resolutions.