Summary

  • Small and mid-sized providers often face a financing mismatch: broadband deployment needs external capital, but the required investment can be too small for infrastructure funds, too slow for venture capital and too risky for conventional lenders. IPv4 purchase adds another upfront claim on the same limited cash.
  • Leasing can lower entry risk when it matches address expense to customer activation, allows capacity to expand in tested increments and preserves funds for the parts of the network that create service: access equipment, backhaul, transit, power, installation, support and working capital.
  • Leasing is not inherently safer or cheaper. A small ISP can become dependent on a lessor that controls registry standing, RPKI, reverse DNS, route objects and renewal. A short or revocable right can be more dangerous than a financed purchase when customers embed the addresses in allowlists, VPNs, mail systems or long-lived contracts.
  • The decision must compare total risk-adjusted cash flows, not purchase price against monthly rent. It should include deployment and transition cost, lessor failure, renumbering, reputation remediation, renewal uncertainty, service obligations, financing cost, residual value and the value of retaining liquidity.
  • A production lease should identify exact prefixes and permitted origin ASes; require timely LOA, ROA, IRR, reverse-DNS and contact support; allocate abuse and geolocation duties; restrict sale or encumbrance that impairs use; define renewal and substitution; and fund an orderly exit if continuity fails.
  • Public evidence establishes the financing problem and the operational control points, but not a global success rate for small-ISP IPv4 leasing. No cited dataset supplies the number of small ISPs that lease, their default rate, customer-retention outcome or risk-adjusted return compared with buying.
  • Number Resource Society can support entry by publishing a rights-first lease term sheet, comparable continuity disclosures and a confidential outcome study. Its role should improve bargaining and evidence, not recommend a provider, certify credit, guarantee a lease or make membership a condition of access.

Entry finance begins with the network the operator has not yet built

A small ISP does not enter the market by acquiring addresses alone. It must reach customers, install equipment, buy or build backhaul, secure transit, arrange power, monitor the network, handle abuse, bill subscribers and survive the time between construction and recurring revenue. Every unit of cash committed to one layer is unavailable to another.

That constraint is not theoretical. The ITU's 2025 Connecting Humanity Action Blueprint describes small and mid-sized ISPs as important to competition and affordable access in lower- and middle-income countries, while noting that limited capital, regulation and technical capacity constrain growth. Broadband projects can have payback periods too long for venture investors while their investment needs are too small for traditional infrastructure funds. Investors may also lack familiarity with ISP business models and perceive high risk.

The Internet Society's guidance on financing community connectivity makes the same problem concrete. Local providers need money not only to start, but to maintain and upgrade systems, support customers and collect payments. Financial sustainability has to span the startup and operating phases. Connect Humanity and its partners similarly describe locally owned networks as requiring finance suited to their operating models rather than one universal instrument.

IPv4 scarcity inserts an additional capital decision into that already crowded budget. A new provider may qualify for limited space from an RIR, obtain addresses from an upstream, use translation, acquire transferable resources or lease capacity. The correct mix depends on its region, scale, service design, customer requirements and time horizon.

Leasing becomes entry finance when it changes the sequence of investment. The operator pays for a defined period of use rather than funding a permanent acquisition at launch. It can deploy a small block, test demand, add capacity as subscribers arrive and defer a larger ownership decision until revenue and financing improve.

That does not make the lessor a bank or the lease a loan. It means the commercial arrangement performs a financing function: it exchanges a large initial commitment for periodic payments and dependence on another party's continuing performance. The analysis must value both sides of that exchange.

RIR scarcity paths help entrants, but they do not fund full growth

Regional policies preserve limited routes for new or qualifying networks, yet those routes cannot be assumed to satisfy a growing ISP's complete requirement.

ARIN's IPv4 Waiting List is supplied when addresses return, commonly through revocation for non-payment. Eligibility, maximum approved size, aggregate holdings, sequence and available block sizes shape fulfilment. Receipt through a waiting-list or specified transfer path removes the organisation from the list under the published rules. ARIN also reserves a limited path for IPv6 deployment and micro-allocations for defined critical infrastructure.

APNIC's IPv4 exhaustion guidance explains that new and existing members can receive only a limited maximum from the remaining pool under current policy and should consider transfers when they require more. The current APNIC resource policy sets the minimum and maximum delegation framework and needs criteria.

The RIPE NCC's 2025 IPv4 report describes how the last-pool model moved from a final allocation to a waiting-list /24 and states that organisations needing more had to find other solutions. The same report treats transfers as a regular post-exhaustion mechanism and discusses temporary transfers as part of the evolving landscape.

These paths matter to a small ISP. A directly registered initial block can support routing independence, establish organisational history and reduce dependence for a core service. IPv6 allocations remain broadly available and should form the long-term addressing plan. Translation can conserve scarce IPv4. Upstream address space can support early customers.

But none removes the growth question. An ISP can outgrow a small initial allocation. A waiting list does not promise capacity on the operator's construction timetable. Upstream space can bind the operator to a carrier and make renumbering harder. Transfer-market purchase may consume cash needed to activate customers. Carrier-grade NAT reduces public-address demand but adds equipment, logging, troubleshooting and application considerations.

Leasing should therefore be evaluated as one layer in a portfolio. It is most defensible when it fills a timed gap between immediately available direct resources, IPv6 deployment and proven customer demand. It is least defensible when management uses rent to postpone every architectural decision indefinitely.

The cash preserved by leasing has an alternative job

The financial case is not "monthly is smaller than upfront." It is whether the cash retained at entry produces more resilience or growth than the rights surrendered by not purchasing.

A fixed-wireless operator may need radios, towers, site access, batteries and installation teams before subscriptions begin. A fibre provider may need civil works, customer-premises equipment and backhaul. A hosting-focused entrant may need servers, power commitments and transit. If an address purchase prevents completion of the revenue-producing network, ownership has protected the wrong bottleneck.

Leasing can align expense with activation. The operator starts with capacity for current customers, adds blocks after measurable utilisation and avoids paying at launch for a long forecast that may prove inaccurate. If the market test fails, it can return capacity rather than liquidate a purchased block under time pressure.

Liquidity also absorbs variance. Customer acquisition may be slower than forecast. Equipment can fail. A licence can be delayed. An upstream may require a deposit. A major customer may pay late. Cash held in reserve can keep the network operating through those shocks. The value of that option is highest when the operator cannot borrow cheaply on demand.

The decision changes as the ISP matures. Once demand is stable, the service depends on long-lived address identity and the operator has access to suitable finance, purchase can remove renewal dependence and preserve residual value. Leasing can remain appropriate for bursts, new regions, temporary migrations or uncertain products while core capacity moves to longer control.

This staged approach rejects two absolutes. Buying is not always prudent because it creates control; control can be acquired too early at the cost of survival. Leasing is not always efficient because it preserves cash; repeated rent and dependency can exceed the benefit once the business is established.

The question is what the next unit of capital must accomplish. Entry finance is successful when leasing lets the ISP build a functioning, revenue-generating network sooner without creating a continuity obligation larger than the cash it saved.

Model the decision with variables, not a universal market rate

There is no defensible universal break-even month for lease versus purchase. Price varies by block size, region, term, reputation, services and market conditions. A useful model keeps those variables visible.

For purchase, the operator should include the block consideration, broker and escrow costs, RIR and professional fees, financing cost, diligence, remediation, implementation and expected exit value. It should also model time to transfer and the risk that the transaction does not complete as planned.

For leasing, the model includes recurring rent, deposits, setup, support tiers, minimum commitments, rate resets, RPKI and reverse-DNS services, reputation work, scaling charges, renewal premiums and exit. It adds the expected cost of disruption weighted by plausible failure scenarios: delayed ROA, lessor default, registry problem, non-renewal, prefix substitution and emergency renumbering.

The value of retained cash enters on the other side. Management can estimate the margin or risk reduction produced when that cash funds customer connections, network redundancy, staff or working capital. The estimate should be conservative and tied to an approved deployment plan. "We prefer to keep cash" is not enough if the cash then remains idle or funds unrelated spending.

The model also needs a horizon matched to customer commitments. An operator selling multi-year service on addresses with a short cancellable lease has a mismatch even if the first-year cost looks attractive. The relevant horizon extends through contract renewal, migration and the time required to replace the prefixes safely.

Accounting does not settle the economics. IFRS 16 generally requires a lessee to recognise a right-of-use asset and lease liability for leases longer than twelve months unless an exemption applies, while the standard allows but does not require its application to certain intangible-asset leases. The exact treatment of an IPv4 arrangement depends on the contract, identified asset, control, reporting framework and professional judgment. Leasing should not be sold as automatically off balance sheet.

Sensitivity is more informative than one answer. Management should vary demand, funding cost, renewal price, required term, outage impact and purchase residual value. Leasing lowers risk when the conclusion survives plausible changes rather than depending on an optimistic customer ramp or an assumed perpetual renewal.

The right to route is the first financed right

The lessee does not receive usable production capacity merely because a contract names a prefix. Its upstreams must accept the announcement, routing authorisations must match the intended origin, and the lessor must maintain the institutional authority needed to support those acts.

RFC 9582 defines a Route Origin Authorization as a digitally signed statement through which an address block holder authorises an AS to originate specified prefixes. That design makes a central dependency visible: the small ISP may operate the origin AS, but the RPKI authority often remains with the direct resource holder.

ARIN's RPKI deployment guidance states that only direct resource holders participate directly in its RPKI models and that a downstream organisation must have its upstream submit ROAs on its behalf. A lease can therefore give the ISP routing use while leaving a critical authorisation action with the lessor or another upstream party.

The contract should identify exact prefixes, permitted origin ASes and more-specifics, the party that creates and changes each ROA, the maximum length, effective time, expiry behaviour and response time for emergency correction. It should prohibit revocation while the lessee is performing, except under a narrowly defined security or legal condition with an emergency procedure.

A Letter of Authorization may be required by transit providers, but an LOA is not a cryptographic ROA and does not compel every network to accept the route. The operator should test its intended upstreams before customer launch. It should not rely on a generic promise that the addresses are "routable."

IPv4.Global's discussion of assignments, allocations and temporary transfers identifies the operational bundle a lessee may need: registration or reassignment, reverse DNS, a routing-registry entry and an RPKI ROA. As first-party market guidance, it usefully describes work the provider sees; it does not replace the current policy or contract in a specific region.

The finance test is strict. If the lessor can disable routing faster than the lessee can cure a billing dispute, the lease resembles callable infrastructure. A small invoice can finance a large dependency.

Registration visibility should identify use without pretending to transfer title

A small ISP needs customers, upstreams and incident responders to reach the right organisation. The public registration layer should not falsely imply that a distant direct holder operates the network, but neither should a downstream use record be described as a permanent transfer.

The parties should determine which reassignment, temporary transfer or other regional record is available and appropriate. The record should identify the operating organisation and durable abuse and technical contacts where policy permits. It should remain subordinate to the direct holder relationship unless a formal transfer occurs.

The contract must allocate who submits and maintains that record, how quickly changes occur and what happens when it expires. A stale contact can send abuse reports to the lessor while the ISP remains unaware. An overbroad public statement can expose customer or commercial information unnecessarily.

RDAP role separation offers a useful design vocabulary. RFC 9083 supports roles including registrant, technical, administrative, abuse and network operations centre. The lease can use organisational role contacts rather than personal data and preserve the distinction between holder and operator.

Visibility also affects diligence. The ISP should verify the lessor's authority through current RIR data and corporate documents. It should identify any sponsoring LIR, reseller or intermediary and understand which party can actually perform RPKI, reverse-DNS and registration changes. A chain of promises is weaker than a direct covenant from the party controlling each action.

The lessor should disclose pending disputes, notices, unpaid registry fees, transfer commitments or encumbrances that could impair use. The lessee does not need unrestricted access to every private record, but it needs evidence that the promised term is supportable.

The aim is functional truth. Public records should help responders locate the operator and understand the direct holder without deciding property, accounting or creditor rights. The contract carries the commercial right; the registration carries the appropriate administrative statement; the route carries reachability. Leasing is safer when none is asked to impersonate the others.

Reverse DNS, IRR and geolocation are part of the financed service

An ISP can originate a valid route and still deliver a poor service if the rest of the operational package is missing.

Reverse DNS can matter for mail, logging, diagnostics and customer services. The contract should state who controls the reverse zone, how delegations or records are requested, the change interface, response time, security controls and what happens at termination. A lessor that remains the only party able to change delegation must provide more than best-effort support for production use.

Internet Routing Registry route objects can support upstream filtering and automation. The relevant maintainer, authorisation and update process should be identified. An IRR object is not a substitute for a ROA, and neither proves the private lease, but inconsistent records create avoidable deployment problems.

Geolocation databases often infer or receive information from several sources. A newly leased block can appear in the lessor's country or a prior user's location. That can affect content, payments, fraud systems and customer expectations. The contract should allocate who submits corrections, what evidence is available and whether the provider promises only effort or a measurable response. No lessor can guarantee every independent database's result.

Reputation is equally important. Addresses may carry prior associations that outlive the old user. Due diligence should check major reputation and blocklist sources relevant to the ISP's services, but "clean" cannot mean no negative record anywhere. The lease should define the checks, date, known exceptions and remedy if a material undisclosed condition prevents the agreed use.

Prefix substitution must preserve these attributes. A contract that lets the lessor replace a /24 at will can force customer renumbering and restart reputation and geolocation work. Substitution should occur only under defined conditions, with equivalent size and region, advance notice, overlapping use, verified routing support and reimbursement of reasonable migration cost when the lessor caused the change.

These services have economic value. A bare lease rate is not comparable to a managed lease that includes RPKI, reverse DNS, registration, reputation monitoring and response commitments. The small ISP should compare the complete service and failure exposure, not only the amount per address.

Reputation warranties must be specific and reciprocal

The lessor controls the history before delivery; the lessee controls much of the conduct during use. A fair contract gives each party duties appropriate to that control.

Before activation, the lessor should provide a dated reputation report, known prior-use category, routing history, registration state and unresolved complaints material to the intended service. It should warrant that it has not knowingly concealed a condition that would defeat the agreed use. If a critical listing prevents deployment and cannot be corrected within the agreed cure path, the lessee should receive a compliant substitute or terminate without penalty.

The lessor cannot promise a permanently clean prefix. Independent systems change, attackers can misuse customer services, and some lists make errors. The warranty should concern disclosed facts, testing and remedies, not an impossible universal outcome.

During the term, the ISP must maintain an abuse contact, respond to credible reports, apply acceptable-use controls and preserve evidence. It should not run services outside the agreed risk profile without consent. A lessor offering space suitable for access customers may price and govern it differently from anonymous proxy or bulk-mail use.

Suspension rights require proportionality. A verified active threat may justify immediate action on an affected portion when delay would cause serious harm. An ordinary complaint should trigger notice, evidence and cure rather than withdrawal of the entire route. Fees for abuse administration should be disclosed and should not become an unreviewable penalty.

The parties should distinguish complaint, confirmed abuse and contractual breach. A complaint is an allegation. Confirmation requires defined evidence. Breach depends on the agreement and cure process. Collapsing all three lets third parties terminate the ISP's capacity by sending accusations.

At exit, the lessor should retain enough contact continuity to close incidents and prevent reports from being misdirected. The lessee should remove services and provide final abuse status. The prefix may need observation before reuse, depending on actual history. No universal cooling period is supported by the cited evidence; risk should determine the plan.

Specific reciprocal duties make the lease financeable. They turn reputation from a vague reason for unilateral termination into a managed operational risk.

Renewal certainty must match customer dependence

The greatest leasing risk often appears after success. The ISP acquires customers, their systems depend on its addresses, and the original term approaches expiry. The operator then negotiates from a weaker position because renumbering threatens revenue.

The contract should force that risk into the entry decision. It should state the initial term, renewal options, notice dates, pricing mechanism, capacity reservation and circumstances in which the lessor may refuse. An option at a price chosen later by the lessor is not meaningful certainty.

Price can be fixed, follow a disclosed schedule, use a governed benchmark with a cap and floor, or be reopened through a defined negotiation and fallback. The preceding benchmark problem matters directly: a lease should not reset against an undefined "market price" published by a commercially interested party without method, coverage and cessation terms.

The ISP should map renewal to customer contracts. If subscribers receive fixed addresses or services embedded in allowlists, the address term should exceed the customer commitment by enough time to renew or migrate. If the ISP can move customers through automated translation and short-lived assignments, it may tolerate less certainty.

Renewal priority can take several forms: an enforceable option, right of first offer, right of first refusal, automatic renewal subject to stated conditions, or guaranteed replacement capacity. Each protects a different risk. Replacement capacity is not equivalent when exact addresses carry customer identity.

The lessor should be restricted from selling, transferring or encumbering the prefixes in a way that defeats the lease. If a transfer is permitted, the successor should assume the obligations before closing or the lessee should receive an orderly migration right. A registry update by itself does not ensure contractual assumption.

Payment mechanics also matter. A short cure period, banking delay or disputed invoice should not permit immediate route withdrawal. The contract can require notice to more than one contact, a reasonable cure path, escrow for disputed amounts and emergency technical coordination.

Renewal certainty costs money because it limits the lessor's future choices. The small ISP should pay for the level of certainty its service actually needs, not buy a premium blindly and not accept a best-effort promise for a critical network.

Continuity rights must survive trouble at the lessor

A lessor can face corporate, financial, registry or operational failure. The ISP should ask what happens when the person answering tickets is no longer in control.

The diligence begins with authority. Which legal entity is the recognised holder or authorised provider? Does it own or control the offered prefix? Is there a reseller, lender, custodian or sponsoring LIR? Who holds the credentials needed for RPKI, reverse DNS and registration? Does the contracting entity have a binding right to instruct those parties for the full term?

The agreement should require the lessor to maintain registry fees, corporate standing, security and operational access. It should notify the ISP of a material adverse event affecting the prefixes. It should preserve authenticated backup contacts and documented procedures so one employee's departure does not disable service.

Financial distress creates harder questions. A creditor may claim the address portfolio or lease receivables. An insolvency officeholder may seek to sell assets. The lessee needs a covenant that any buyer takes subject to the lease where legally effective, notice before disposition and access to evidence of the existing term. Jurisdiction-specific advice is essential; a contract cannot guarantee treatment in every insolvency.

Operational continuity can be strengthened with limited escrow or pre-authorised mechanisms. A neutral party might hold documents, configuration instructions or a conditional mandate to support a successor process. RPKI private keys should not be handed casually to a lessee, and registry credentials should not be shared contrary to security rules. The design should enable defined acts, not create a second uncontrolled administrator.

The ISP also needs redundancy outside the lease. It can hold some directly controlled space, maintain IPv6, diversify lessors for separable services, automate renumbering and avoid placing every critical customer on one prefix estate. Diversification has routing and management costs, so it should follow service architecture rather than a slogan.

Leasing lowers entry risk when the lessor is better placed to carry registry and portfolio obligations than the new ISP and contractually accepts that role. It increases risk when those obligations remain opaque and the ISP carries all downstream loss.

Scaling should follow customer evidence, not a discounted block offer

The strongest entry benefit is staged capacity. The ISP can add usable blocks when customer activation, service mix and utilisation support them. That preserves cash and creates evidence for future finance.

The lease should provide an expansion mechanism without guaranteeing unlimited inventory. It can define request procedures, lead times, preferred region and size, pricing rules and the evidence needed to reserve capacity. The lessor should disclose whether future blocks are expected from the same controlled pool or from third parties.

Technical scaling matters. More small prefixes can increase configuration, routing-policy and monitoring work. A larger aggregate can be easier to manage but commits more cash. The ISP should test what its upstreams accept and whether its service requires portable announcements or can operate through provider space.

Customer segmentation can reduce risk. Infrastructure that depends on stable identity can use the longest-control prefixes. Residential access behind translation can use more fungible capacity. Pilot services can use blocks designed for easy exit. The operator should not mix all customers indiscriminately and discover at renewal that one address pool contains incompatible dependencies.

Capacity discounts deserve scrutiny. A lower unit rent for a much larger commitment may recreate the capital problem through prepaid rent, deposit or take-or-pay obligations. The relevant measure is cash at risk and unavoidable payment, not the headline rate.

Scaling rights should be reciprocal. The ISP needs the ability to reduce unused capacity at defined intervals, subject to reasonable notice and minimums that let the lessor plan. A lease that only scales upward turns uncertain demand into a permanent obligation.

Data from the first blocks should improve the next decision: active customers, public-address demand by service, support burden, abuse incidents, revenue contribution, transition cost and forecast error. Those measures belong to the ISP's business case. They should not be published as a universal utilisation rule or used by a third party to infer customer identities.

Successful staged leasing eventually creates choices. The ISP may continue leasing, buy a core block, refinance, combine direct and leased space or accelerate IPv6. Entry finance is valuable because it preserves those choices until better evidence exists.

IPv6 and translation make leasing safer when they are real exit options

IPv4 leasing should not be presented as an alternative to IPv6. The safer structure uses IPv6 to reduce the amount and duration of dependence on rented IPv4.

The RIPE NCC report states that IPv6 is broadly available while deployment still requires investment in infrastructure, compatibility and skills. A small ISP must therefore budget for both present compatibility and long-term architecture. Ignoring IPv4 can exclude customers and services; ignoring IPv6 can turn a transitional lease into permanent scarcity exposure.

An entry plan can give every feasible customer IPv6, use translation for shared IPv4 access and reserve public IPv4 for services that genuinely require it. The exact design depends on applications, logging law, equipment and support capacity. This article does not prescribe a universal address-to-customer ratio.

IPv6 improves bargaining only when it is operational. The ISP should measure traffic capability, customer equipment, content reachability, support incidents and the services still requiring public IPv4. A slide stating "IPv6 ready" does not create a migration path.

Automation matters as much as protocol. Address inventory, DNS, firewall rules, monitoring and customer configuration should be designed for change. Long-lived hard-coded addresses make every lease renewal dangerous. Stable names, configuration management and dual-running procedures reduce migration cost.

Translation is not free. Carrier-grade systems require capacity, logging, security and troubleshooting. Shared addresses can affect abuse handling and application behaviour. Those costs belong in the lease-versus-buy model. Conservation that creates unacceptable service cost is not a financing success.

The lease itself should support transition. It can permit declining capacity, overlap for migration, temporary parallel prefixes and extension only for defined dependencies. It should not penalise the ISP for reducing demand through IPv6 if notice requirements are met.

The best exit option is one the operator tests before distress. A small segment can be renumbered during the term, customer communications can be rehearsed and alternative capacity can be validated. The exercise reveals whether the supposed flexibility is real.

Leasing lowers risk most clearly when it buys time to deploy a more durable architecture, not when it funds indefinite avoidance.

A rights-first term sheet turns capacity into financeable infrastructure

The contract should be readable as an operational map. At minimum, it should cover the following rights and duties.

The resource schedule identifies each prefix, RIR, direct holder, current registration state, permitted use, origin AS, more-specific policy, term and activation condition. It records known reputation and geolocation findings at delivery.

The authority schedule assigns LOA, ROA, IRR, reverse DNS, registration contact and upstream-support actions. It states who performs each act, evidence of completion, response commitments, authentication and emergency correction.

The continuity schedule defines availability, support, planned maintenance, notice, cure, suspension, renewal, substitution, sale, encumbrance, successor assumption, lessor distress and migration. It separates a serious security emergency from an ordinary commercial dispute.

The commercial schedule states rent, deposit, fees, taxes, escalation, benchmark version if any, minimum commitment, scaling, payment method, disputed amounts and termination charges. It avoids hidden service costs and unilateral "market" resets.

The conduct schedule defines permitted services, abuse response, downstream controls, information requests, confidentiality, lawful process and proportional remedies. It preserves customer privacy while enabling incident response.

The exit schedule names notice dates, customer migration, parallel use, route withdrawal, ROA and IRR changes, reverse DNS, public contacts, evidence, reputation handoff and final settlement. It states which rights remain during a dispute and which duties survive termination.

The evidence schedule lists periodic confirmations: holder status, RPKI state, route visibility, contacts, invoices and notices. It gives the ISP enough information for lenders, auditors or customers without exposing the lessor's unrelated portfolio.

The dispute schedule identifies governing law, escalation contacts, urgent technical relief and the forum for commercial claims. It should allow routes to remain stable while a non-security dispute is reviewed where payment protection exists.

No term sheet eliminates jurisdictional or registry risk. It makes the allocation of that risk explicit. A small ISP can then compare providers and a lender can understand what supports the revenue.

Three entry cases show when the answer changes

Consider a new rural access provider with limited cash, uncertain subscriber adoption and a network designed for IPv6 with shared IPv4 compatibility. It can begin with a modest leased block, preserve funds for access equipment and add capacity only after installations produce revenue. Customers receive dynamic service and the operator has automated addressing. A lease with scaling, stable routing support and an orderly exit can lower risk substantially.

Now consider a small managed-services ISP whose customers require fixed addresses in bank allowlists and multi-year security contracts. The same lease could be dangerous if renewal is best effort or substitution is unilateral. The operator may still lease, but it needs a term longer than customer dependence, enforceable renewal economics, exact-prefix protection and migration overlap. It may choose to buy or directly control a core block while leasing less critical expansion.

Finally, consider an entrant offered a low headline rent through a reseller that will not name the direct holder, cannot commit to ROA response, and may replace blocks after complaints. The operator saves cash at signing but accepts a route, reputation and continuity position it cannot verify. Leasing increases risk even if demand is uncertain.

These cases are analytical scenarios, not reported companies or measured outcome rates. They show why "small ISP" is not a single risk class. Service design, customer identity dependence, upstream architecture, cash runway and contract rights determine the answer.

The common test has four parts. Is capital genuinely constrained? Does preserved cash fund a defined network milestone? Can the ISP obtain the operational rights needed for the customer commitment? Is there a credible path to renew, replace or exit before dependence becomes coercive?

If any answer is no, leasing needs redesign. If all are yes, the arrangement can be more than rental. It can be a disciplined bridge from unproven demand to a financeable operating history.

What should be measured before calling the model successful

The public evidence does not establish how many small ISPs lease IPv4 or how their outcomes compare with buyers. A credible evidence programme should begin without assuming success.

At operator level, useful measures include time from contract to routable service, cash preserved at activation, customer connections funded with that cash, address demand by service, routing incidents, authorisation response time, reputation exceptions, unplanned substitutions, renewal outcomes, renumbering work and outages attributable to the lease layer.

Financial measures include total cash paid, deposits at risk, cost of support services, avoided financing cost, gross margin supported by the capacity and the cost of migration. They should distinguish correlation from causation. A growing ISP that leased addresses did not necessarily grow because of leasing.

Portfolio measures should use clear denominators. The number of active leases is different from the number of prefixes and addresses. An incident rate needs a defined event, observation period and population. Customer churn attributed to renumbering requires evidence rather than assumption.

Comparisons need matched cases. Operators that buy may be larger, older and better financed. Operators that lease may enter riskier markets. A simple outcome difference would reflect selection as well as the financing choice. Confidential research can stratify by maturity, region, service model and customer dependence.

Provider reporting should include response and continuity performance, not only listed inventory. It can publish aggregate ROA turnaround, renewal completion, substitution and unresolved incident measures with privacy protection. Marketing claims should be traceable to a defined population and period.

Negative outcomes belong in the record. A lease that preserved capital but caused a disruptive renumbering may still have been rational at entry, but the full result should inform future terms. A purchased block that consumed cash but secured a critical contract may have created value despite higher initial cost.

Until this evidence exists, no global default, failure, success or return rate should be claimed. The thesis is conditional: leasing can lower entry risk under short-term capital constraint when rights and continuity are explicit. It is not a prevalence claim.

Number Resource Society can improve bargaining without choosing the winner

Number Resource Society's stated concern with open access, operator rights, transparency and accountability gives it a useful place in this market if its role remains evidence-bounded.

First, NRS can publish the rights-first term sheet as an open standard. Small operators often lack specialist procurement teams. A common schedule for routing, RPKI, reverse DNS, reputation, renewal, substitution and exit would make omissions visible before signature.

Second, it can publish a continuity disclosure form. Lessors could state whether inventory is first-party or intermediated, who controls each technical action, what service level applies, how renewal works and what happens after sale or distress. The form would disclose; it would not certify truth without review.

Third, NRS can support confidential outcome research with participating ISPs and lessors. It can define measures, protect customer and prefix identity, publish denominators and include unsuccessful cases. Independent researchers and operator representatives should oversee the method.

Fourth, it can provide educational comparison tools using variables rather than promotional rates. An operator could enter its own term, demand uncertainty, migration cost, funding cost and continuity requirements. The tool should show sensitivity and source limits, not issue an investment recommendation.

Fifth, NRS can maintain a public library of contract concepts, RIR references and technical standards, versioned by date and region. It should direct users to current authoritative policies and make clear that legal and accounting treatment requires competent advice.

The boundaries protect legitimacy. NRS should not name an official lessor, guarantee performance, determine creditworthiness, compel disclosure of private customer lists, approve routing, resolve title or make its standard a condition for RIR service. Its own funding and affiliations should be disclosed.

The positive outcome is bargaining infrastructure. A small ISP can ask the same informed questions as a larger operator. A responsible lessor can show what it provides. Lenders and customers can understand continuity. Competition then occurs on explicit rights and service, not only a monthly number.

The lease lowers risk only if the saved capital and transferred duties are real

IPv4 leasing is often described as flexibility. That word is incomplete. The ISP gains financial flexibility by surrendering some control to the lessor. The bargain works when the control it surrenders is precisely defined, competently performed and cheaper to depend on than to internalise at entry.

The saved cash must have a real destination. It should complete access infrastructure, connect customers, add redundancy, hire operations capacity or preserve runway. If management cannot identify that destination, the financing benefit is speculative.

The transferred duties must also be real. The lessor should carry registry standing, RPKI action, reverse DNS, registration support, reputation handoff and continuity commitments according to the agreement. If those duties fall back on the ISP without authority to perform them, the lease has transferred risk in name only.

Duration must fit the service. Scaling must follow evidence. Renewal must be governed before dependence forms. Substitution must protect operational equivalence and migration. Suspension must distinguish urgent harm from ordinary dispute. Exit must preserve customers before routes disappear.

Buying remains a valid path. Direct RIR resources, upstream assignments, translation and IPv6 remain parts of the same strategy. The small ISP should combine them according to maturity rather than defend one model ideologically.

Public evidence supports the existence of a capital gap for smaller providers, the scarcity constraints that make secondary access relevant, and the technical dependence of downstream routing on holder-controlled authorisations. Market providers publicly offer leasing and continuity services. Those facts establish feasibility and risk points, not a universal outcome rate.

The governance objective is therefore modest and important: make the lease legible enough that a constrained entrant can decide whether periodic access buys time or sells away its future. Number Resource Society can advance that objective by standardising questions and evidence while leaving the commercial choice to the operator.

When the rights are explicit, leasing can fund entry without pretending scarcity has disappeared. When they are not, the monthly payment is only the visible part of the debt.

Sources