Summary

  • RIPE NCC Middle East FZ-LLC has one member and shareholder: the Dutch RIPE NCC association. “One member” means one corporate parent, not one individual and not one elected officer.
  • Ordinary RIPE NCC members elect the parent Executive Board. That elected board represents the association when it exercises the sole member’s powers. The four directors of the Dubai subsidiary are a different body composed of RIPE NCC executives: Hans Petter Holen, Hisham Ibrahim, Athina Fragkouli and Simon-Jan Haytink.
  • Published records show the subsidiary directors proposing or approving management rules, agreement signatures, bank-payment authority and standalone accounts. The parent Executive Board, acting as sole member, adopted accounts, recorded two-director payment authority and approved an intercompany loan at a corrected 5.31% annual interest rate.
  • The record contains real safeguards: public articles and minutes, a two-person payment rule up to AED 2 million, external-adviser consultation, audited accounts, an unqualified Ernst & Young Dubai opinion for 2025, consolidated parent reporting and legal tools for parent-association members.
  • The reviewed public packet does not contain the full Management Regulations, UAE Approval Policy, intercompany agreement, data-processing agreement or loan agreement. That is a bounded visibility gap, not proof that the instruments are improper or unavailable through every other route.
  • No reviewed source establishes unlawful incorporation, invalid resolutions, self-dealing, corruption, unfair intercompany terms, audit failure, UAE government control or personal wrongdoing. The finding is structural: the ordinary member’s influence over the subsidiary is indirect, while day-to-day corporate power is concentrated in officers who serve on both sides of the group relationship.

Start with the noun “member”

The word “member” performs two different jobs in this structure. Confusing them would manufacture a scandal where the documents show an ordinary corporate arrangement.

RIPE NCC is a membership association incorporated in the Netherlands. Its ordinary members exercise rights under the parent Articles of Association. They elect the parent Executive Board, vote at General Meetings and approve the association’s Financial Report.

RIPE NCC Middle East FZ-LLC is a separate Dubai legal entity. Its governance page and Articles of Association identify the Dutch association as its only member and sole shareholder. The single entry is therefore a corporation. It is not Hans Petter Holen, Hisham Ibrahim or any other natural person.

That distinction solves one question and opens another. A wholly owned company has a principal: its parent. But the parent is itself an association. Who expresses the parent’s will toward the subsidiary? Which decisions return to the ordinary membership? Which remain inside the elected board? Which are delegated to staff who also direct the subsidiary?

The answers cannot be compressed into “the RIPE community governs it”. Corporate documents are more exact. They distribute rights among identifiable organs. That distribution, rather than a vocabulary of community, is the proper audit trail.

Four layers, not one board

The control chain has four layers.

First are ordinary RIPE NCC association members. Under RIPE-818, each member has one vote. Members elect the parent Executive Board. A group holding at least two percent of the possible votes may require a proposed resolution to be placed on a General Meeting agenda. Ten percent may require the Executive Board to convene a General Meeting. The General Meeting approves the parent Financial Report and may make clearly specified Executive Board resolutions subject to prior approval.

Second is the elected RIPE NCC Executive Board. It represents the Dutch association and exercises the parent’s corporate rights. When minutes say RIPE NCC acted as the sole member or shareholder of the Dubai company, this is the board through which that act appears in the reviewed record.

Third is the FZ-LLC Board. It is not the elected RIPE NCC Executive Board. The published composition names Hisham Ibrahim as General Manager, Hans Petter Holen as Chair, Athina Fragkouli as Secretary and Simon-Jan Haytink as Treasurer. All four are directors of the subsidiary.

Fourth is operational representation: the subsidiary General Manager or an authorised pair of directors executes particular acts. In the 2025 records, Ibrahim was authorised to sign for the subsidiary, while Holen was authorised by the parent Executive Board to sign for RIPE NCC. For bank payments up to AED 2 million, the published design requires any two current directors to act jointly.

The four-layer map prevents a serious factual error. Holen is RIPE NCC’s Managing Director and CEO and chairs the subsidiary Board; he is not thereby the parent’s elected Executive Board. Ibrahim is RIPE NCC’s Chief Community Officer and the subsidiary’s General Manager. Fragkouli is the parent’s Chief Legal Officer and the subsidiary’s secretary. Haytink is the parent’s Chief Financial Officer and the subsidiary’s treasurer. These are staff and officer overlaps, not identity between the two boards.

From a branch to a company

The timing matters. RIPE NCC had operated a Dubai branch since 2014. In 2024, the parent Executive Board authorised creation of a legal entity in Dubai that would be fully owned by RIPE NCC. By 2026, the FZ-LLC was described as fully operational, and the parent Board resolved to deregister the old branch.

A branch and a subsidiary do not distribute authority in the same way. A branch is an extension of the parent legal person. A subsidiary has its own articles, directors, accounts, resolutions, contracts and representation rules, even when all ownership sits with the parent.

The transition therefore creates durable governance surfaces. The subsidiary can enter an intercompany agreement with the parent. It can maintain its own bank authority. Its Board approves standalone accounts for submission to its sole member. Its General Manager signs for the local entity. The sole member can adopt written resolutions instead of holding a subsidiary General Meeting.

This is why the question is current in 2026. The old branch is no longer the fallback form. The two-entity control chain is becoming the settled legal architecture for RIPE NCC’s Middle East operation.

What the first subsidiary meeting put in place

The first published FZ-LLC Board minutes are dated 22 November 2024. They show the directors adopting Management Regulations, allocating the secretary and treasurer roles and adopting a UAE Approval Policy.

Those instruments matter because they likely translate broad articles into operating permissions: who may approve what, how decisions are documented, and which acts require escalation. Yet their full texts are not contained in the reviewed public packet. The minutes prove adoption, not the content of every control.

The same meeting addressed an intercompany agreement. The Board required consultation with an external adviser before approval. That is a meaningful safeguard. A wholly owned subsidiary and its parent are related parties; an outside view can help test whether the allocation of duties and costs is legally and commercially supportable.

The minutes also record that no director noted a conflict regarding the agenda topics. That statement should neither be dismissed nor overextended. It proves that the formal conflict question was put and the published record contains no declaration. It does not prove that dual roles disappeared, that every applicable legal definition was tested in public or that no structural tension could exist.

Personal conflict, structural dual role and a related-group transaction are different categories. A personal conflict may involve an individual benefit or duty that diverges from the company’s interest. A structural dual role exists when an officer holds positions on both sides of a corporate relationship. A related-group transaction exists because the contracting entities share control. The latter two do not establish the first.

Two signatures on one group agreement

The intercompany agreement supplies the clearest view of the chain. The parent Executive Board authorised Holen to sign on behalf of RIPE NCC. The subsidiary Board authorised Ibrahim to sign for the FZ-LLC. The subsidiary minutes say the agreement was signed on 21 January 2025. They also say a data-processing agreement was signed on 2 April 2025.

The signature structure is legally legible: each entity had an authorised representative. It is institutionally compact: the parent signatory also chaired the subsidiary Board, and the subsidiary signatory was also a senior parent executive.

Compactness is not proof of abuse. It does increase the value of a visible process. A reader should be able to distinguish who prepared the terms, which adviser reviewed them, whether any director recused, which organ approved material changes, and how the agreement allocates cost, service and liability between the entities.

The reviewed packet does not include the agreement texts. It would therefore be irresponsible to call their prices unfair, their obligations one-sided or their data terms deficient. The same boundary applies to the loan agreement. The public evidence supports a governance question about how terms were approved and disclosed; it does not support a verdict on unseen terms.

Accounts travel upward through the sole member

The second subsidiary Board minutes show the FZ-LLC Board approving submission of the audited 2024 financial statements to the sole member. The parent’s 186th Executive Board minutes then record the RIPE NCC Executive Board adopting those statements while acting as sole member and shareholder.

For 2025, the chain repeated with stronger public audit detail. The subsidiary Board approved the audited statements. Ernst & Young Dubai issued an unqualified opinion. In 2026, the parent Executive Board adopted the statements through a sole-member resolution.

An unqualified opinion is important. It says the auditor did not qualify its financial-statement opinion. It does not certify every governance choice, establish regional mandate, validate every related-party price or prove that every operational control is optimal. Financial audit and governance assurance answer overlapping but different questions.

Parent members also receive group-level visibility. The RIPE NCC Financial Report 2025 consolidates the Middle East subsidiary. The General Meeting approves the parent Financial Report. That creates a real member control: the subsidiary’s financial position is not wholly absent from the accounts placed before the association.

Still, consolidated visibility is not the same as a direct vote on standalone subsidiary decisions. In the public decision record reviewed for this article, the elected parent Board—not a direct ballot of ordinary members—adopted the subsidiary accounts as sole member.

Two-person payment authority is a real control

The 2025 subsidiary minutes proposed that any two current directors jointly authorise bank payments up to AED 2 million. The parent Board later recorded the dual-approval bank resolution.

This is a concrete separation-of-action safeguard. One individual cannot execute a covered payment alone. It reduces the risk of unilateral movement and creates at least two accountable approvals.

The control also shows why publication of the reserved-matters boundary matters. What occurs above AED 2 million? Are there aggregate limits, budget tests or related-party thresholds? Which payments require parent approval? How are emergency payments handled? The fact package does not answer those questions, and no conclusion should be invented.

The right response is not to treat AED 2 million as evidence of excessive authority. It is to publish a compact authority schedule: transaction class, threshold, subsidiary approver, parent approver, recusal rule and reporting route. Such a schedule can describe the control without exposing bank details or commercial secrets.

The loan reveals both correction and concentration

The parent’s 186th minutes also record an intercompany loan effective 1 May 2025. They correct the annual interest rate from an earlier 5.48% figure to 5.31%.

That correction deserves credit. A public corporate record acknowledged and fixed a numerical error. The rate is not being smuggled into the accounts without any trace.

The same entry shows concentration. The parent Executive Board approved the loan terms, while the borrower or counterparty sat within a group whose subsidiary directors were parent executives. The public packet does not include the full loan agreement, benchmark, term, security, repayment schedule or pricing analysis.

Without those details, one cannot responsibly call 5.31% high, low, subsidised or exploitative. Currency, maturity, credit risk, market date and other terms would be necessary for comparison. The proper finding is that the approval exists, the corrected rate is public, and the compact control structure raises a legitimate demand for a summary of the basis.

The strongest defence

RIPE NCC can give a strong, document-based defence of this structure.

The subsidiary is not ownerless. Its parent is named. Its Articles are public. The parent is a membership association with an elected Executive Board. The subsidiary’s Board and officers are identified. Formal meeting and telephone minutes are published.

The first Board sought external advice before approving the intercompany agreement. Staff are subject to RIPE NCC policies. Bank payments require two directors within the published limit. Standalone accounts are audited and then adopted by the sole member. The 2025 auditor gave an unqualified opinion. Parent accounts consolidate the subsidiary and return to a General Meeting.

Ordinary parent members possess actual legal tools. They elect the Executive Board, vote one member–one vote, can use a two-percent threshold to place a proposal on a General Meeting agenda and a ten-percent threshold to compel a meeting. The parent Articles also allow specified Board resolutions to be subjected to General Meeting approval, although absence of that approval does not negate the Board’s external representative authority.

This is not governance by secret decree. The public record is much better than a structure in which ownership, officers, accounts and resolutions are invisible.

The defence has limits of its own. Publication of formal minutes does not disclose discussions on the Board’s closed mailing list. An audit opinion does not replace a conflicts process. An elected parent Board is an indirect control over the staff-run subsidiary, not a direct member vote on each subsidiary act. Group consolidation can compress the detail members need to assess standalone decisions.

The conclusion is therefore neither “trust the institution” nor “the company is illegitimate”. It is that a lawful chain earns confidence when each delegation leaves a usable evidence trail and a proportionate reversal route.

What the public packet does not show

Five instruments remain outside this bounded public package: the Management Regulations, UAE Approval Policy, intercompany agreement, interorganisation data-processing agreement and full loan agreement.

The wording is important. This article does not claim that the documents are unavailable to directors, auditors, regulators or members using another access mechanism. It records only that their texts were not found in the reviewed public packet.

The public record also does not show an ordinary-parent-member vote specifically approving the subsidiary’s standalone accounts, bank authority, loan or intercompany agreement. That is not necessarily required by the Articles or applicable law. It identifies the actual decision level: parent Executive Board acting as sole member.

Nor does the packet establish an improper benefit to any director, an audit failure, unlawful incorporation, invalid resolutions, hidden UAE government control, tax avoidance or a defective service. Dual roles are not a substitute for evidence of personal wrongdoing.

These exclusions are not rhetorical softness. They are the boundary between institutional analysis and accusation. The structure is important enough to scrutinise without inventing misconduct.

Corporate authority is not regional mandate

The subsidiary’s legal form can authorise acts inside the group. It cannot by itself authorise claims over a region.

Heng Lu’s doctrine insists on naming the principal. Here the subsidiary’s corporate principal is the RIPE NCC association. The association’s internal principals are its members for the acts allocated to them by its Articles. The elected Executive Board exercises extensive representative power between General Meetings.

Networks, governments, users and businesses across the Middle East may be affected by registry operations. Being affected makes them stakeholders. It does not enrol them as members of the Dubai company or confer a vote in the Dutch association.

This does not make RIPE NCC’s services illegitimate. It fixes the boundary of the claim. A fully owned subsidiary can be validly incorporated, properly audited and operationally useful without becoming a public government. Corporate continuity is not constitutional consent.

That boundary matters because number-resource administration can affect routing, contracts, compliance and business continuity. The more consequential the operational dependency, the less acceptable it is to use service geography as a substitute for a mandate chain.