RIPE NCC is usually described as a registry. In the IPv4 scarcity economy that description is accurate, but too small. A registry that records who holds a scarce operational identifier can become the place where productive capital is allowed to move, where its security state is expressed, where its transaction history is recognised, where its liquidity is slowed, and where the cost of continued recognition is charged. The institution may still look like a technical coordinator. The market increasingly experiences it as a capital-control surface.
Capital control should not be read here as a loose metaphor for a government restricting currency flows. The phrase is more precise. IPv4 address space has become productive capital because it enables revenue-producing services, protects customer continuity, reduces dependence on sharing technologies, supports hosting and cloud operations, affects reputation and deliverability, and can be bought, leased, reserved, priced, financed in substance or carried as strategic optionality. RIPE NCC does not make the number valuable by decree. Operators, customers, routing systems, scarcity and replacement cost do that. But registry recognition is one of the conditions that makes the capital liquid, serviceable and bankable.
That is why RIPE NCC is the clean test. It is not a failed or marginal registry. It is an independent not-for-profit membership association based in the Netherlands, serving Europe, the Middle East and parts of Central Asia. Its own What We Do materials describe Regional Internet Registry functions for IPv4, IPv6 and AS Number resources, alongside registration, resource transfers, the LIR Portal and RPKI. Its public-service portfolio also includes the RIPE Database, K-root operations, DNS services, RIPE Atlas, RIPEstat, RIS, IP mapping, country reports, meetings, training and external engagement.
Those facts matter because RIPE NCC cannot be dismissed as a local accident. It is mature, documented and technically sophisticated. It has a large member base and operates in a region full of commercially and legally complex networks. If capital control appears here, the problem is not simply corruption, incapacity or litigation. It is a structural feature of the post-exhaustion registry model.
RIPE NCC's official documents are useful factual exhibits. They show the levers: IPv4 run-out, waiting-list policy, transfer rules, a 24-month restriction on scarce resources, inter-RIR compatibility, legacy-resource treatment, sanctions screening, membership charges, RPKI, reverse DNS, audit activity, policy development and closure procedures. They do not settle the economic interpretation. Institutions naturally describe their own authority through stewardship, neutrality, service and stability. The market asks a harsher question: how much uncertainty does the registry remove, and how much does it create?
Market-side arguments from address brokers, lessors, network operators and critics are not neutral either. They have incentives of their own. Yet their value is that they focus on the place where official language is weakest: the gap between the legal form of a registry relationship and the economic substance of scarce address capital. Once a registry record becomes a condition of liquidity, operational security and balance-sheet confidence, the old language of technical coordination is no longer enough.
The central issue for RIPE NCC is therefore not whether registries are necessary. They are. Unique number resources require accurate records, non-duplication, contact data, reverse DNS, route-origin security, transfer recognition and mechanisms for correcting fraud or stale information. The question is whether the institution that performs those tasks remains a narrow ledger or becomes a broad gatekeeper over the commercial use of productive capital.
The accounting shock of IPv4 exhaustion
IPv4 exhaustion is often presented as an engineering story: a 32-bit address space proved too small, allocation pools were depleted, IPv6 became the long-term answer, and operators bridged the gap with transfers, CGNAT, dual stack and private addressing. That account is true as far as it goes. It misses the accounting shock.
RIPE NCC's IPv4 run-out materials give the sequence. For most of RIPE NCC's history, Local Internet Registries could receive IPv4 addresses if they supplied documentation such as network plans. When RIPE NCC reached its final /8 in 2012, policy limited each LIR to one /22, or 1,024 addresses. In November 2019 the remaining IPv4 pool was exhausted. The current waiting-list model allows eligible LIRs that have not yet received an IPv4 allocation to request one /24 from addresses recovered in the future.
A /24 is not nothing. It may be operationally meaningful for a small network, a multihomed service, a compact deployment, a lab, a regional hoster or a business that needs a minimum routable block. But it is not a growth policy for a cloud platform, data-centre operator, access provider, enterprise network, security platform or national-scale ISP. It is a residual fairness device. The main IPv4 economy now lives in secondary transfers, leasing, corporate transactions, renumbering economics, CGNAT limits, IPv6 transition costs and the value of address portfolios accumulated in earlier eras.
Scarcity changes the economic character of the registry record. In the allocation era, RIPE NCC's function could be understood mainly as distribution plus recordkeeping. After exhaustion, the registry no longer sits primarily at the entrance to an abundant pool. It sits at the recognised record layer for resources already embedded in networks and commercial bargains. The registry is not selling the asset, but its record is one of the facts that makes the asset usable at a lower risk premium.
This is why the word capital is analytically useful even if number resources are not ordinary property. A factory machine is capital because it produces output. A telecom licence is capital because it enables a service territory. A route, spectrum assignment, fibre right-of-way, domain portfolio or data-centre lease can be capital because it supports cash flows and strategic control. IPv4 address space has the same economic features when it is clean, routable, transferable, reputation-manageable and operationally embedded.
The capital is not consumed in a physical sense. It is consumed by dependence. Customers are provisioned. Firewalls and allowlists are built. Reverse DNS is configured. ROAs are created. Mail reputation accumulates. Geolocation entries spread. Abuse desks, hosting panels, customer contracts and monitoring systems point to the address. Once that happens, replacing the block is not like changing a label in a database. It is a renumbering project with customer, engineering, legal and reputational costs.
Scarcity also turns history into advantage. Early holders, legacy holders, universities, enterprises, telecom incumbents and companies that received larger allocations under previous norms now possess optionality. They can use addresses, sell them, lease them, reserve them, contribute them to a transaction, or treat them as a strategic continuity buffer. New entrants without such holdings must buy, lease or work around scarcity at current prices. That is not a moral judgment. It is an economic fact. Scarcity capitalises past distribution.
The registry cannot erase that history by avoiding property language. RIPE NCC's Standard Service Agreement states that registration of Internet number resources does not constitute property or confer ownership. That may be legally important. It does not remove commercial reliance. A block can be non-property in the contract and still behave like productive capital in the market. A bank account is not a bag of coins; a share is not a factory; a spectrum licence is not a radio tower. Modern economies are full of valuable rights and records whose usefulness depends on recognition by a reference institution.
The post-exhaustion policy question is therefore simple: when a recordkeeper sits above productive capital, what limits should apply to its discretion? A registry that recognises the capital-like effect of its records should become narrower, not grander. It should publish clearer boundaries, lower unnecessary friction, measure process risk and separate the essential ledger from optional institutional activity. The danger is the opposite path: denying asset reality while quietly controlling liquidity.
Recognition is where capital control begins
Capital control begins with recognition. A buyer can sign a contract for IPv4 space, a lessor can promise use, a network can announce a route, and a bank can review a transaction. But the market still asks a practical question: what does the recognised registry say?
Recognition is not a single database field. In the RIPE NCC environment it is a bundle. It includes who appears in the RIPE Database; who can use the LIR Portal; who can request or maintain resource transfers; whether an allocation is PA, PI or legacy; whether the holder has a contractual relationship with RIPE NCC or a sponsoring LIR; whether resource certificates can be issued; whether reverse DNS can be managed; whether a transfer restriction applies; whether sanctions screening blocks an update; whether audit and data-quality issues affect services; and whether closure or deregistration procedures could affect the record.
Each element has a defensible technical or legal purpose. Together they form a control surface. The economic question is not whether any one lever is necessary. Some are. The question is whether the aggregate system lets capital move with predictable frictions or makes movement depend on discretionary institutional acceptance.
RIPE NCC's Resource Transfer Policies illustrate the line. The policy says legitimate resource holders may transfer complete or partial blocks of Internet number resources, subject to policy and restrictions. Transfers must be reflected in the RIPE Database. The original resource holder remains responsible until completion. To complete the transfer, RIPE NCC updates registration records. This is good ledger architecture: the market needs a recognised transition point, and the registry must prevent duplicate or fraudulent recognition.
But the same mechanism is also capital settlement. A buyer may pay only when registry recognition changes. A seller may remain exposed until the update. A broker may structure escrow around the registry process. An acquirer may treat a registry update as a closing condition. A lessor may use continuing recognised holdership as the basis for recurring revenue. A lender may discount a block that cannot be moved or certified predictably. Registry recognition therefore affects not just administrative status but transaction value.
The transfers page states that RIPE NCC authorises and facilitates transfers of IPv4, IPv6 and ASNs, and that resource transfers are free of charge. A zero transfer fee is useful. It means the registry is not charging a direct transaction toll. But zero price is not zero cost. The cost sits in documentation, timing, uncertainty, restrictions, sanctions exposure, inter-RIR compatibility, legal work, broker reliance, incomplete data and the possibility that one deficiency will shift a clean transaction into delay.
Capital controls are often indirect. A state does not need a formal tax on capital outflow if it can delay approvals, require documents, impose waiting periods, screen counterparties, freeze categories, or make future recognition uncertain. A private registry is not a state, and RIPE NCC has legitimate reasons for verification. Yet the economic mechanism is similar: the holder's capital can move only through a recognised pathway whose friction is defined by the recordkeeper.
This is the discipline RIPE NCC needs to apply to itself. It should not ask only whether a rule is procedurally valid. It should ask what capital effect the rule creates. Does it reduce fraud more than it reduces legitimate liquidity? Does it make market facts legible or merely give staff more hooks for judgment? Does it isolate legal and data-quality defects or convert them into broad service fear? Does it help small operators or raise the fixed cost of participation? Does it strengthen the ledger or expand the gate?
Transfer restrictions are liquidity policy
The clearest capital-control instrument in the RIPE NCC framework is the 24-month restriction on scarce resources. RIPE NCC's in-region transfer documentation states that IPv4 addresses and 16-bit AS Numbers are restricted from being transferred for 24 months after they have been received from RIPE NCC, via transfer from another organisation, or following a change in business structure such as a merger or acquisition. The same material describes documentation requirements and says transfer requests are evaluated under applicable RIPE policies and RIPE NCC procedures.
The rule may have a reasonable origin. It can deter immediate flipping of scarce resources, opportunistic account creation, artificial churn and transactions that convert residual rationing into instant arbitrage. It may preserve confidence that scarce allocations are not merely a conveyor belt into the secondary market. It may also reduce registry workload and speculative gamesmanship.
But the economic effect is straightforward: the rule is a liquidity control. It limits the holder's ability to move an asset-like resource for two years. That affects price, financing, acquisition planning and fallback strategy. A buyer must ask whether a future sale, restructuring or portfolio reallocation will be blocked. A company acquiring a network must understand whether the registry update will start a new restriction period. A lessor must decide whether leasing is more attractive than sale when transfer mobility is limited. A small operator with unexpected cash pressure may discover that a clean address holding is less liquid than expected.
Calling the rule a policy restriction rather than a capital control does not change its effect. Liquidity is not a moral category. It is the ability to convert an asset into another form of value, or to move it to a user that values it more. Every restriction on liquidity has a cost. Sometimes the cost is justified. It should still be measured.
The right metric is not only how many transfers succeed. RIPE NCC publishes transfer data and transfer statistics, which is valuable. Completed transfer lists tell the market where recognised movement occurred. They do not show the shadow count: transactions abandoned before filing, deals redirected into leasing, corporate transactions discounted because of timing uncertainty, requests delayed by document cycles, blocked movements under the 24-month rule, or small operators that avoided the official path because the fixed cost was too high.
In a scarcity economy, the hidden side of process performance matters as much as the published side. A market can look orderly if only successful approvals are visible. It can still be inefficient if many legitimate transactions die quietly. RIPE NCC does not need to publish confidential prices, contracts or private documents. It should publish aggregate process indicators: median and distribution of transfer processing times after complete submission; percentage of requests needing further documents; broad reasons for delay; number of requests affected by 24-month restrictions; number affected by sanctions screening; and aggregate distinction between ordinary corrections, serious authority problems and policy blocks.
That data would discipline the gate without weakening the ledger. Buyers and sellers could price timing. Brokers would compete less on opaque process knowledge. Small operators would know whether they need counsel or simply better documents. RIPE NCC could show that its transfer function removes risk rather than adding it.
The broader lesson is that transfer policy is now market infrastructure. It cannot be evaluated only through the language of fairness, anti-abuse or community consensus. It determines how quickly scarce productive capital can find its highest-value user. If the official path is predictable, capital stays within the ledger. If the official path is uncertain, capital moves into workarounds.
Zero transfer fees do not mean zero cost
RIPE NCC deserves credit for not charging direct transfer fees. In a market already strained by scarcity, a transaction toll would be easy to criticise. Yet the absence of a toll can obscure the real tax. The tax is friction.
Friction appears in several forms. Documentation friction arises when parties must prove corporate authority, current registration, identity and signing powers. This is necessary for fraud prevention, but it imposes legal and administrative cost. Timing friction arises when parties do not know how long evaluation will take after documents are submitted. Compliance friction arises from EU sanctions screening. Policy friction arises from restrictions such as the 24-month rule. Regional friction arises in inter-RIR transfers, where both registries must approve and each region's policy framework matters. Legacy friction arises when historical records are incomplete or when the current relationship with RIPE NCC is optional for some services and required for others.
Each friction can be defended. Together they determine market quality.
The inter-RIR transfer framework is especially revealing. Resources can move between the RIPE NCC service region and another RIR region only where policy compatibility exists and the relevant registries approve. Resources remain subject to the policies of the RIR where they are registered until the transfer is completed, and then fall under the recipient RIR's policies. AFRINIC's lack of an inter-RIR policy, by contrast, means resources cannot move through that channel to or from its region.
For a network engineer, these are policy facts. For a capital holder, they are mobility facts. Two technically equivalent address blocks may have different economic value because one is registered in a region with cleaner mobility, one is trapped behind incompatible policy, one is subject to a waiting period, one has legacy uncertainty, one requires a contractual relationship for RPKI, and one carries sanctions or corporate-authority risk. Registry geography becomes part of asset quality.
This is why "the Internet is global" is not a sufficient answer. Packets cross borders. Registry records do not move without institutional approval. A resource can be globally routable and regionally illiquid. That mismatch matters to buyers, sellers, lessors, lenders and acquirers. It matters to operators choosing where to hold address inventory. It matters to brokers pricing blocks. It matters to small networks that cannot diversify across regions or portfolios.
Friction is not always bad. It can prevent theft, false authority and laundering of dirty records. But beneficial friction is specific. It attaches to a known harm and ends when the harm is addressed. Harmful friction is ambient. It lives in uncertainty, opaque timing, unclear documentation standards, staff discretion, category ambiguity and the absence of reliable process data.
RIPE NCC's legitimacy in the capital era depends on keeping friction specific. A registry can demand evidence without making the process mysterious. It can check sanctions without turning legal compulsion into institutional fog. It can preserve inter-RIR compatibility without making geography feel like a trap. It can protect against fraud without making ordinary market movement feel suspicious.
The market does not need the registry to approve its commercial logic. It needs the registry to tell the truth quickly, consistently and narrowly.
Leasing is not a loophole; it is a scarcity response
Leasing is where allocation-era morality meets post-exhaustion economics. The address market has two basic ways to move use toward demand: sale and rental. Sale is comfortable for registry culture because it produces a transfer entry. Rental is messier because formal holdership may remain with one party while operational use, routing responsibility, abuse handling, customer relationships and economic benefit are distributed through contract. That messiness is real. It can produce opacity, weak accountability and abuse problems.
But treating leasing as inherently suspicious would be an error. Leasing exists because buying address space is capital-intensive and because demand is uneven, temporary or uncertain. A growing platform may need capacity before it can justify a purchase. A small ISP may not want to sink scarce capital into addresses before proving demand. A hosting firm may need elasticity. An address-rich holder may prefer recurring income to sale. A lessee may prefer to keep registry exposure upstream. Leasing is not an aberration in the scarcity economy; it is one of the ways the economy adapts.
The proper registry question is not whether leasing feels like old allocation policy. It is whether leasing preserves accountability. Are abuse contacts accurate? Is the operational user traceable enough for serious incidents? Are route-origin authorisations coherent? Is reverse DNS manageable? Are sanctioned parties screened where law requires? Is the holder reachable? Does the arrangement avoid giving outsiders a false impression about who is responsible for operational conduct?
RIPE NCC should not become a lease regulator. It should not price leases, approve lease terms, police commercial rates or adjudicate ordinary contractual disputes. It should make the ledger usable by a leasing market without pretending the registry is party to the lease. That means publishing clear guidance on what RIPE Database fields can and cannot show, how abuse contacts should remain accurate, how ROAs and reverse DNS can be administered responsibly, what must remain under the recognised holder's control, and when a leasing pattern becomes a registry harm rather than a commercial preference.
If leasing is moralised, it will not disappear. It will become more opaque. Parties will use shell entities, informal customer assignments, routing-only arrangements, offshore intermediaries and contracts that preserve formal holdership while moving economic use. The more the registry insists that the market should look like the allocation era, the more the market will learn to speak in allocation-era code.
Leasing also reveals the link between registry friction and market structure. If transfer settlement is slow or uncertain, leasing becomes more attractive. If the 24-month restriction traps address blocks, leasing becomes a way to monetise immobile capital. If annual fees rise, holders may lease to cover costs. If sanctions screening or corporate-document review creates closing risk, lessees may prefer use without transfer. If RPKI and reverse DNS are easier to manage through the holder than through a formal transfer, leasing gains operational appeal.
A ledger-first registry recognises this system effect. It does not ask whether leasing is morally pure. It asks whether the official record remains truthful enough for operators, customers and investigators to understand responsibility. It distinguishes responsible leasing from opaque leasing. It avoids turning discomfort with a market form into discretionary control over productive capital.
If RIPE NCC remains a neutral ledger, leasing can be one efficient way to use scarce address capacity. If RIPE NCC becomes a gatekeeper, leasing becomes a defensive structure designed to move registry-layer risk away from the operating company. That would be a verdict on the institution, not on the market.
Sanctions compliance is unavoidable and still a market control
RIPE NCC operates from the Netherlands and serves a region that includes the European Union, the United Kingdom, the Middle East, Central Asia, Russia-related exposure, Ukraine-related exposure, conflict-affected networks and operators facing international banking friction. Legal compliance is not optional. It is also not economically neutral.
RIPE NCC materials on transfers and mergers say requests are checked against the EU sanctions list and will not be approved if either party is found to be under sanctions. That is a legally understandable position for a Dutch association. It also turns registry recognition into a compliance closing condition. A buyer, seller, broker, acquirer or lender must ask not only whether the resource is clean, but whether the parties, ownership structure, jurisdictional exposure or name-match risk could block the registry update.
This is capital control in its most literal form. The registry may not be choosing a political policy. It may simply be obeying applicable law. But the effect is that capital movement can be stopped because the recognised recordkeeper cannot process the change. That creates risk even for non-sanctioned parties. A counterparty in a sensitive jurisdiction may carry a discount. A corporate chain may require deeper diligence. A false positive may delay closing. A bank may apply stricter standards than RIPE NCC. Counsel may advise against a transaction that the registry would approve. The market prices uncertainty, not only actual prohibition.
RIPE NCC can reduce this risk without weakening compliance. It can publish clearer process categories: when sanctions checks occur; what legal sources are used; whether indirect ownership is considered; what happens with a possible match; how parties can correct mistaken identity; what services are affected by sanctions status; what cannot be discussed publicly; and how running-network continuity is protected where law permits. It can publish aggregate numbers showing how often sanctions screening delays or blocks transfer, M&A or service requests, without naming parties.
That kind of transparency distinguishes compliance from discretion. If a request is blocked because law requires it, RIPE NCC should make the legal nature of the block legible. If a request is delayed because documents are incomplete, that is a different category. If a request raises policy concerns unrelated to sanctions, that is different again. Capital markets need categories because categories allow risk to be priced.
The danger is institutional fog. If members and counterparties cannot distinguish legal compulsion from internal preference, they will treat the registry as a political gatekeeper. That harms the registry as much as the member. A neutral recordkeeper in a legally exposed region should not pretend it is free of law. It should show exactly where law enters the process and where institutional judgment begins.
Sanctions also show why regional neutrality is more complicated than slogans. RIPE NCC can use operational country data while disclaiming endorsement of international status. It can comply with EU law while serving networks outside the EU. It can try to preserve records while governments and public authorities read those records politically. Neutrality is therefore not absence of constraint. It is disciplined constraint: narrow, explained, evidence-based and as predictable as law allows.
RPKI and reverse DNS turn recognition into control
Capital control is not only about transfer. It is also about operational usability. An IPv4 block is worth more when it has coherent reverse DNS, stable route-origin security, accurate contacts, clean reputation and a holder who can administer it. RIPE NCC sits near several of those levers.
RIPE NCC's RPKI page states that it launched a community-driven system in 2011 allowing LIRs to request a digital certificate listing the Internet number resources they hold. It says RPKI offers verifiable proof that a holder's resources have been registered by an RIR and helps network operators make more informed routing decisions, particularly through BGP origin validation. Sponsoring LIRs and End Users can also request certificates for PI resources, and legacy holders can request certificates for legacy End User resources.
This is not decorative metadata. RPKI turns recognised holdership into cryptographic information that relying parties may use in routing decisions. RIPE NCC does not command global routers, and operators decide how to treat validation states. But as route-origin validation becomes more common, certificate and ROA state become part of the operational quality of a block. A block with clean, well-managed RPKI is easier to trust than one with broken or unavailable route-security data.
That strengthens RIPE NCC's ledger role and increases the danger of gatekeeper power. A reliable RPKI system makes the record more valuable. A discretionary or opaque RPKI change raises the stakes of any registry dispute. Policy implementation around non-functional delegated RPKI CAs shows the institutional reality: a policy process can produce a registry action inside a routing-security trust chain. The action is not merely a mailing-list outcome. It affects operational trust attached to capital-like resources. Such powers require technical evidence, clear notice, predictable timelines and narrow remedies.
Reverse DNS is another operational lever. RIPE NCC's reverse delegation materials explain that reverse DNS maps from IP addresses to domain names using in-addr.arpa and ip6.arpa, and that the RIPE Database is used as the management database for producing DNS zones. The page says RIPE NCC registers only reverse delegations and is not involved in forward domains. Reverse DNS may sound minor to non-operators. In practice it affects mail reputation, logging, abuse response, network hygiene, customer confidence and some service integrations.
The closure and deregistration framework makes the operational linkage sharper. RIPE-858 states that on termination of the Standard Service Agreement, RIPE NCC will stop providing services such as authority to maintain resource records in the RIPE Database, LIR Portal access and use of RIPE NCC's RPKI service; it will deregister relevant records and revoke any certificates generated by the RPKI service, with legacy resources handled separately. The Standard Service Agreement also says failure to comply with policies and procedures can lead to suspension of services and deregistration under the closure procedure.
These powers may be necessary in serious cases. They also reveal why registry recognition is capital control. A contractual, audit, payment, legal or data-quality dispute can touch not only a database entry but RPKI, records, transfer ability and operational administration. Remedies must therefore be proportional and dispute-specific. A billing issue should not create unnecessary routing-security uncertainty. A data correction should not feel like existential threat. A fraud case should be isolated to the disputed resource and evidence. A sanctions problem should be handled according to law, not institutional mood.
The more operational control RIPE NCC provides, the stronger the case for treating it as critical infrastructure. The stronger that case becomes, the narrower its discretion should be.
Fees are a capital charge when exit is constrained
RIPE NCC's 2026 charging scheme sets an annual contribution of EUR 1,800 per LIR account, adds charges for certain independent Internet number resource assignments and ASNs, and keeps a EUR 1,000 sign-up fee. The 2026 Activity Plan and Budget budgets income of EUR 41.140 million, costs of EUR 41.125 million and 202.1 full-time-equivalent staff across registry, information-services, community and organisational activity.
The fee is not large compared with the total cost of running many networks. It can be trivial for a large carrier or cloud platform. It can matter for a small ISP, a sponsoring LIR with narrow margins, a new entrant or a member in a weak-currency market. But the more important point is not absolute price. It is institutional character. A fee paid to a normal vendor is disciplined by exit. A fee paid to the recognised registry is different. The member may need the relationship to preserve registration, portal access, transfers, RPKI, reverse DNS and continuity. That makes the annual charge less like a subscription and more like an infrastructure levy.
Infrastructure levies require scope discipline. The compulsory part of the relationship should fund the compulsory function: uniqueness, registration, data accuracy, transfer settlement, security, reverse DNS, RPKI, compliance, business continuity and the minimum policy support needed to keep the record coherent. Wider services may be useful. RIPE Atlas, RIS, RIPEstat, country reports, training, meetings, public-policy engagement and community support can all create value. But usefulness is not the same as a claim on unavoidable registry fees.
A mature institution will naturally prefer mission breadth. Staff want to measure, train, build, convene and represent. Board members want strategic relevance. Active community participants value meetings and infrastructure. Governments and intergovernmental bodies want a technical counterpart. None of this is sinister. It is how competent institutions behave. It is also how a narrow ledger becomes a broad organisation financed by the capital it recognises.
The question for RIPE NCC is not whether a given activity is worthy. It is whether members can see what portion of the compulsory fee funds unavoidable recognition and what portion funds broader public goods. A member should not need to infer this from broad budget categories. In a scarcity economy, fee transparency is a form of capital-control discipline. If the holder of scarce address capital must pay a registry to preserve recognition, the registry should be exact about what the payment buys.
The fee debate also intersects with transfer and leasing. If annual costs rise, some holders will monetise unused or underused addresses through leasing. If fees are perceived as funding a broad ecosystem rather than a lean ledger, address-rich members may view the registry as taxing capital it did not create. If small operators see fees rising while policy participation remains costly, legitimacy weakens. If a direct relationship with RIPE NCC is seen as expensive or risky relative to leased use, market structure will adapt around the institution rather than through it.
The safest funding model is not necessarily the cheapest. A fragile registry would be worse than an expensive one. The safest model is honest: enough money for a resilient ledger and security layer; clear separation for broader functions; and no reliance on the fact that members cannot easily walk away.
The contract exposes the power-liability gap
The most uncomfortable part of post-exhaustion registry economics is the mismatch between consequence and liability. RIPE NCC is not an insurer, and it would be unreasonable to make it financially responsible for every loss connected to every member's use of number resources. But it is equally unreasonable to ignore the scale of downstream dependence created by registry services.
The Standard Service Agreement incorporates RIPE policies, procedural documents, the charging scheme, billing procedures, closure and deregistration procedures, transfer documents and other materials that may be revised over time. It says the agreement may be amended by RIPE NCC General Meeting resolution without re-signing being necessary. It requires the member to provide complete and accurate information and assist with audits and security checks. It says failure to comply with RIPE policies and procedures can lead to suspension of RIPE NCC services and deregistration under the closure document.
The liability provisions are still more revealing. The member is liable for its use of RIPE NCC services and Internet number resources. RIPE NCC excludes liability for direct and indirect damages, including business damages, loss of profit and damages to third parties, except in cases of willful misconduct or gross negligence. It is not liable for damages caused by failure to make Internet number resources available on time or for damages connected with use of the resources. Its liability is limited to the member's service fee for the relevant financial year.
That contractual structure may be legally defensible for a membership association. Economically, it is revealing. A recordkeeper whose decisions can affect high-value operational capital carries liability capped at the annual service fee. This does not mean RIPE NCC should accept unlimited liability. It means powers and liability should be aligned. Low-liability institutions should have narrow, technical and reviewable powers. Broad discretion with narrow liability is the unstable combination.
Market actors understand this even when they use different language. A company that leases addresses from a specialist provider may be trying to move registry-layer contract risk upstream. A buyer may discount a block because of uncertainty about the registry relationship. A lender may hesitate because the record is powerful and the remedy is thin. A small operator may comply with demands it does not fully understand because the downside of contesting them seems disproportionate.
Ordinary markets have substitutes for liability. Competition lets customers switch. Insurance prices risk. Regulation imposes duties. Capital requirements absorb losses. Courts provide remedies. In the RIR model, several of those disciplines are weak. Members cannot freely choose another registry for the same resource relationship. Registry contracts are not negotiated like bespoke infrastructure-risk agreements. The value of a block can far exceed the annual fee. Downstream customers may have no direct voice in RIPE NCC governance. That makes process restraint the main substitute for liability.
Process restraint means clear standards, narrow remedies, time-bounded notices, independent review where consequences are severe, aggregate transparency and preservation of the last verified operational state during disputes where law permits. It means not using RPKI, reverse DNS, database access or transfer ability as broad leverage when a narrower remedy would solve the problem.
A registry does not need to be rich enough to pay for every network's failure if it is disciplined enough not to create avoidable failure. That is the sustainable bargain. Anything more ambitious invites the market to price fear.
Policy openness is not capital consent
RIPE's policy-development culture is one of its strongest legitimacy assets. RIPE describes a long-established, open, bottom-up process of discussion and consensus-based decision-making. Policy development happens at RIPE Meetings and on Working Group mailing lists. Meetings and lists are open. Archives and formal policy documents are public. A person does not need to be a RIPE NCC member or a regular meeting participant to propose policy.
This openness is real. It is better than closed administrative rulemaking. It allows operators, engineers, researchers, customers, critics and non-members to follow and participate. It also distinguishes RIPE, the open community, from RIPE NCC, the membership association and secretariat.
But openness is not equal representation. Attention is scarce. Large incumbents, consultants and policy specialists can track lists and attend meetings. Small operators may not have staff, English-language confidence, procedural memory or time. Some members in sensitive jurisdictions may avoid visible disagreement. Some affected parties are downstream customers, not members. Some market participants only discover a policy's effect when a transfer, lease, audit, RPKI change or billing issue touches their business.
That difference matters because policies now affect capital. A policy on scarce-resource transferability affects liquidity. A policy on delegated RPKI CAs affects routing-security state. A policy on legacy resources affects historical capital. A policy on closure, data accuracy or audits affects continuity. A policy on fee structure affects the cost of recognition. A mailing-list consensus can become a market rule.
Silence is therefore ambiguous. It may mean agreement. It may mean absence, fatigue, rational inattention, fear, language barriers or a lack of awareness that a technical-looking proposal has economic consequences. The more post-exhaustion policy touches liquidity and operational capital, the less acceptable it is to treat silence as consent.
RIPE does not need to become a legislature. It does need economic impact notes for policies that affect transferability, waiting periods, RPKI, legacy status, audit consequences, fees or service eligibility. Such notes should identify affected classes: small LIRs, sponsoring LIRs, End Users, legacy holders, lessors, lessees, brokers, acquirers, members in sanctions-sensitive jurisdictions and downstream customers. They should describe likely changes in market behaviour. They should commit to post-implementation metrics. They should state what problem the policy solves and what friction it adds.
This would improve, not weaken, RIPE's legitimacy. The open list remains the proper place for technical and policy debate. Economic translation would help absent or small actors see why a proposal matters before it becomes a rule. It would also protect RIPE NCC from the perception that capital controls are being smuggled through technical process.
The old policy culture was built when address allocation was the central problem. The new policy culture must recognise that registered resources are productive capital. An open process that does not analyse capital effects is open but incomplete.
Small operators pay the highest uncertainty premium
Capital controls are regressive when fixed costs dominate. RIPE NCC's region contains wealthy incumbents, global cloud platforms, large European carriers, public-sector networks, universities, Middle Eastern growth markets, small rural ISPs, hosting firms, conflict-exposed operators, post-Soviet administrative histories and members dealing with sanctions or banking difficulty. The same rule does not cost the same across that region.
A large operator can absorb annual fees, retain counsel, monitor policy lists, attend RIPE Meetings, maintain compliance staff, prepare transfer documentation, run RPKI carefully, manage reverse DNS at scale, negotiate lease terms and wait through delays. A small operator may have one technical lead handling billing, routing, customers, abuse complaints and registry paperwork. For the large operator, a documentation cycle is a project-management issue. For the small operator, it can be a business-continuity problem.
This is why RIPE NCC should think in fixed-cost terms. A flat fee, a 24-month restriction, an extra document request, a sanctions review, an audit, a policy-list debate and an RPKI change are not individually catastrophic. But they can accumulate into a fixed uncertainty premium. That premium is heavier for small operators because it does not scale down with revenue.
The small-operator dependency is especially acute around transfers and leasing. If a small ISP needs IPv4 capacity, it may face three options: buy a block, lease a block, or stretch existing addresses with CGNAT and operational compromise. Buying requires capital and transfer confidence. Leasing requires trust in the lessor, routing state, reverse DNS, abuse response and renewal. CGNAT can reduce address pressure but may worsen customer experience, logging burden, compliance cost and application compatibility. A large operator can diversify across options. A small operator may be forced into whichever path has the least immediate cash and paperwork friction.
The registry should not make this worse. It should make official paths cheap to understand and predictable to use. It should publish plain-language guides that separate normal document requirements from serious defects. It should publish aggregate timelines. It should make audit and Assisted Registry Check processes clearly cooperative unless specific evidence shows fraud or non-compliance. It should ensure billing and data-quality issues do not escalate in ways that small operators experience as existential surprises.
This is not special pleading. Small operators are the discipline that keeps a registry from becoming a club of insiders. If rules are usable only by large incumbents and policy regulars, the open registry culture becomes formally inclusive and practically stratified. The cost of capital control then appears not in a line item but in market concentration.
IPv4 scarcity already advantages old and large holders. Registry friction should not add a second advantage by making liquidity and compliance easier for the same actors.
The ledger has to be cheaper than the workaround
A registry wins legitimacy when the official path is cheaper, safer and more predictable than the workaround. That is the core economic test.
If transfer through RIPE NCC is predictable, parties will use it. If RPKI is reliable, operators will rely on it. If reverse DNS management is clear, holders will keep it accurate. If audit activity is cooperative and proportionate, members will correct data. If fees are tied to essential services, members will tolerate them. If sanctions handling is legible, counterparties can plan around it. If legacy treatment is clear, historical resources can enter or remain in the market with lower risk.
If the opposite is true, market behaviour changes. Parties lease instead of transferring. Buyers discount RIPE-region risk. Brokers sell process opacity as a service. Holders avoid updating data because updates may invite scrutiny. Members fear registry emails because scams imitate plausible authority. Small operators stay away from policy lists because they see no practical effect. Capital becomes defensive.
This is the point where official language can mislead. A registry may say its policies are published, its process is open, and its authority is limited by community consensus. All of that can be true, and still the market may experience the registry as a gatekeeper if outcomes are hard to predict. Markets do not buy documents. They buy expected behaviour.
The Trust Portal is a useful step because it centralises information on confidentiality, integrity, availability, information security, legal and compliance, law-enforcement procedures and incident reporting. But trust in a registry is not only cybersecurity trust. It is governance trust: who can decide what, how long decisions take, what data is measured, what can be appealed, how sanctions are handled, how severe remedies are separated from ordinary corrections, how members know whether a policy has created unintended market harm, and how running-network continuity is protected during disputes.
The ledger-versus-gatekeeper distinction becomes practical here. A ledger makes facts legible: who holds the resource, what type it is, what restrictions apply, what transfer history exists, what certifications are available, what reverse-DNS state is visible, what documents are needed, what legal constraints are unavoidable. A gatekeeper makes outcomes dependent on hidden judgment: whether staff are satisfied, whether a business model is liked, whether a policy culture is comfortable with market use, whether an audit will escalate, whether an old record will be accepted.
RIPE NCC's safest path is not to deny power. It is to discipline it. The registry has power because recognition matters. The proper response is not institutional modesty in public speeches but measurable modesty in process design.
What capital-control discipline would look like
A scarcity-era RIPE NCC does not need to become a market regulator, broker, court or asset valuer. It needs to become more explicit about where its authority ends. Capital-control discipline would start with categories.
First, RIPE NCC should separate ledger functions from institutional services in budgeting and public explanation. The essential ledger includes uniqueness, registration, database integrity, LIR Portal access, transfer recording, reverse DNS, RPKI, security, compliance and continuity. Wider services such as meetings, measurement platforms, training, reports and external engagement may be valuable, but they should be costed and justified separately. A member should be able to see what portion of the compulsory fee funds unavoidable recognition and what portion funds broader public goods.
Second, RIPE NCC should publish process-performance data for transfers, M&A updates, inter-RIR requests, legacy updates, sanctions checks, audits and closure cases. Confidentiality does not prevent aggregate publication. Median timelines, delay categories, document-cycle counts, policy-block categories and outcomes would lower the uncertainty premium.
Third, severe remedies should be explicitly proportional. Deregistration, RPKI revocation, service suspension and termination are high-consequence tools. They should be reserved for clear categories and should preserve operational continuity where possible while evidence is reviewed. The goal is not to make fraud hard to correct. It is to avoid converting small defects into systemic fear.
Fourth, RPKI governance should be treated as critical infrastructure governance. Certificate issuance, revocation, delegated CA monitoring, repository reliability, incident disclosure, account recovery and transition support should be governed with technical clarity and market awareness. RPKI should prove the resource relationship, not become general-purpose leverage.
Fifth, leasing should be recognised as a normal scarcity-era use pattern without forcing RIPE NCC into commercial contract regulation. The registry can publish what it records, what it does not record, how abuse contact data should remain accurate, how ROA and reverse-DNS responsibilities can be managed, and which representations are private contractual matters. This would lower risk without blessing every lease.
Sixth, policy development should include capital-effect analysis for proposals affecting liquidity, security state, legacy treatment, fees or service eligibility. Open process remains the foundation. Economic translation makes it usable by those who cannot live on the mailing list.
Seventh, the registry should treat small-operator dependency as an institutional risk indicator. If a rule is easy for a carrier and hard for a small ISP, that cost should be acknowledged. Fixed compliance costs are not neutral merely because they apply equally.
These are not radical demands. They are the discipline expected of an institution whose records have become economically consequential while its liability remains limited.
Watchpoints: where RIPE NCC capital control will become visible
The first watchpoint is transfer friction. The question is not whether RIPE NCC keeps transfers free of direct charge. It does. The question is whether buyers and sellers can predict documentary demands, timelines, restrictions, sanctions exposure and inter-RIR dependencies before committing capital. Watch completed-transfer data, but also watch the absence of abandoned-request metrics. A market that publishes only success can hide rising private friction. If brokers, lawyers and large incumbents are the only actors who understand the path, the path is not truly cheap.
The second watchpoint is the 24-month restriction. If it mainly deters speculative churn, it may be defensible. If it pushes legitimate transactions into leasing, discounts small sellers, complicates ordinary corporate restructuring or traps capital after acquisitions, it should be re-evaluated as a liquidity tax. The relevant evidence is not ideological debate but process data and market behaviour. A rule designed for fairness can become anti-competitive when scarcity deepens and legitimate exit becomes more valuable.
The third watchpoint is fee scope. A EUR 1,800 annual LIR fee is not the main cost of IPv4 scarcity, but it is symbolically important because it reveals whether the registry sees itself as a lean ledger or a broader institution financed by unavoidable recognition. Members should demand clearer separation between essential registry services and optional ecosystem activity. The weaker the separation, the more the fee looks like a toll on capital rather than a contribution to shared infrastructure.
The fourth watchpoint is RPKI authority. Policy outcomes can now change the security state around recognised resources. Technical hygiene may justify revocation or correction after notice, but the process must remain evidence-based, narrow and observable. As RPKI adoption deepens, registry decisions in that layer will carry larger economic consequences. The market will ask whether route-security tools are insulated from ordinary commercial, billing and documentation disputes, or whether they have become another source of leverage.
The fifth watchpoint is reverse DNS and operational administration. These functions may look secondary, but they affect mail, logging, abuse response and customer confidence. The more RIPE NCC's operational services attach to recognised holdership, the more dangerous broad service suspension becomes. A ledger can correct data without breaking useful operational state. A gatekeeper lets routine disputes echo into production networks.
The sixth watchpoint is sanctions handling. RIPE NCC cannot ignore Dutch and EU legal obligations. It can make the boundary between law and discretion clearer. Aggregate transparency around sanctions-related delays and denials would help counterparties price risk and would reduce the temptation to read every sensitive case as politics. The narrowest lawful restriction should be the default. Broader institutional caution should be named as risk management, not hidden inside legal necessity.
The seventh watchpoint is closure and deregistration practice. The contractual documents show that service suspension, deregistration and RPKI revocation are available in defined circumstances. The market will judge legitimacy by how often severe tools are used, how clearly reasons are stated, how much cure time is available, how disputes are reviewed, and whether customer-impacting continuity is protected where possible. Severe remedies should prove that the ledger is defending itself, not disciplining members through fear.
The eighth watchpoint is leasing. If leasing grows because it is commercially efficient, that is healthy adaptation. If leasing grows because direct holding is perceived as exposing operators to unpredictable registry risk, that is evidence of a failing ledger bargain. The distinction will be visible in how lessors market continuity, how lessees discuss registry exposure, and how often registry uncertainty appears in lease pricing. A transparent leasing market can coexist with a strong registry. A defensive leasing market is a symptom of mistrust.
The ninth watchpoint is small-operator participation. A policy process can be open and still dominated by those with time, travel budgets and procedural memory. If small operators appear mainly as fee payers and compliance subjects rather than rule shapers, RIPE NCC's legitimacy will weaken in the markets where scarcity hurts most. The test is not whether a small operator could have joined a mailing list. It is whether the institution can show that fixed compliance costs, language barriers and process risk were considered before rules became market facts.
The tenth watchpoint is institutional language. When RIPE NCC speaks as a bookkeeper, its authority is easier to defend. When it speaks as an authority on unique resources, steward of a broad model, representative of a region, or guardian of market behaviour, the capital-control problem sharpens. Words such as community, stewardship, fairness and stability should be treated as claims requiring evidence, not as evidence themselves. Every time one of those words is used to justify a rule affecting liquidity, certification, reverse DNS, fees or closure, the economic consequence should be stated plainly: who pays, who waits, who loses optionality, who receives discretion and who can challenge the result.
The final watchpoint is whether the official path remains cheaper than the workaround. If accurate records, clean transfers, reliable RPKI, coherent reverse DNS, bounded audits, intelligible fees and lawful compliance make RIPE-region resources easier to use and move, RIPE NCC will have adapted to the capital era without becoming a capital controller in the dangerous sense. If private actors increasingly pay premiums to avoid direct exposure to the registry layer, the market will have delivered its verdict: the ledger has become a gate.