Summary

  • RIPE NCC’s 1 October table lists 2,339 EU and US sanctions-screening alerts, including 39 not yet started and 119 under investigation.
  • The table records alerts and their status. Its 53 confirmed cases are the ones RIPE NCC says are sanctioned and applicable to its services.

Analysis

The quietest row in RIPE NCC’s October sanctions report is the one that moved. On 2 July, the “not yet started” column showed zero. On 1 October, it showed 39. The total alert count rose by 167, from 2,172 to 2,339, but the reappearance of an unstarted queue is the report’s clearest change in workload state.

Another 119 alerts were under investigation, up from 110 in July. The table lists 20 cases on hold, four more than the previous snapshot, and 53 cases confirmed as sanctioned and applicable to RIPE NCC services, up from 25. RIPE NCC’s accompanying notice says that since the previous report it identified five members and 23 End Users subject to EU sanctions applicable to its services. It also marked four members on hold; one of those also holds resources as an End User.

The denominator needs its own name. RIPE NCC labels 2,339 as alerts for EU and OFAC investigations. That is not a count of 2,339 sanctioned organisations. The status column divides those alerts into five buckets. Its largest, 2,108, combines confirmed false positives, EU sanctions that do not apply to RIPE NCC, exemptions and OFAC cases. The report gives no separate totals for those four outcomes. Calling all 2,108 false positives would turn a mixed filing cabinet into a clean bill of health.

The other statuses describe different work. “Not yet started” means an alert has entered the investigation backlog. “Under investigation” means staff are examining it. “On hold” covers a member or End User who has not cooperated or cannot obtain the documents needed to conclude an EU-sanctions investigation; service restrictions are in place. “Confirmed” means EU sanctions apply to RIPE NCC’s services and the resources have been frozen under its procedure.

That freeze is a registry action: sanctioned entities cannot acquire additional resources or transfer existing ones. RIPE NCC says it does not deregister those resources or terminate a member’s Standard Service Agreement. The report tracks registration status, not packets on a network.

OFAC alerts share the investigation table but travel through a different pressure point. RIPE NCC says it is not obliged to comply with US sanctions; Dutch banks treat them as a factor in whether they will invoice members or accept payments. One table therefore groups alerts tied to two lists and several outcomes, while the consequences vary by status and legal route.

The new 39 are the operational headline. RIPE NCC publishes no age breakdown or processing-time target for that queue in RIPE-868, so the table cannot show how long an unstarted alert waits. The next report can show whether those cases moved into investigation, cleared into another category or remained in the queue.

Sources