Summary
- Enterprise legacy address holdings in the RIPE NCC region are best understood as scarce capital with custody duties, not as idle technical leftovers or automatic windfalls.
- Non-network enterprises matter because their historic allocations can sit outside ordinary carrier demand while still affecting market liquidity, title confidence, abuse reputation, and the cost of transfer evidence.
- The most important risk is not scarcity in the abstract; it is the internal mismatch between valuable external registry entries and weak corporate memory after mergers, name changes, restructurings, campus spinouts, and procurement turnover.
- RIPE NCC's legitimacy depends on being a reliable ledger with predictable evidence standards, not on forcing redistribution, setting enterprise capital plans, or deciding which private holder deserves to retain address space.
- Transfer-readiness audits are becoming a form of economic infrastructure: they reduce transaction costs, reveal hidden liabilities, and separate usable dormant capital from ambiguous registry residue.
- Leasing legacy space may look attractive, but it creates contract asymmetry, reputational exposure, routing hygiene risk, and future sale friction unless the holder has unusually strong controls.
- The public-interest boundary is narrow but important: historic holders should not be punished for not being networks, yet legacy space should not become a shadow market where poor records quietly confer capital control.
The audit that finds a marketable silence
The meeting usually begins badly because nobody called it to discuss strategy. A finance team is preparing for a divestiture. A legal team is assembling historic corporate records. A security team is cleaning up external attack-surface findings. A network team is reconciling old address plans before another cloud migration. Somewhere in that routine work, a range of public IPv4 addresses appears in an internal spreadsheet with a name that no longer exists, a cost centre that has been closed for a decade, and a contact address that resolves to no working mailbox. The entry is too large to ignore and too unfamiliar to price.
At first, the address space looks like a technical remnant. Perhaps it came from a research lab before the lab became a subsidiary. Perhaps it belonged to a university-adjacent institute that was absorbed by a commercial parent. Perhaps it was assigned to a manufacturing group when private networks were not yet the default. Perhaps a European corporate group inherited it through a merger in which the network team was integrated faster than the archive room. Nobody in the room can say whether the company is the legitimate holder, whether the range is in use, whether it can be sold, whether it can be leased, whether it is safe to keep, or whether a forgotten configuration still announces part of it to the global routing table.
This is the enterprise legacy-holder problem. It is not the same as a carrier seeking more IPv4 addresses for customers. It is not the same as a cloud platform using bring-your-own-IP arrangements to deepen customer lock-in. It is not the same as a datacentre counting rack addresses, or a mobile network managing carrier-grade NAT logs. It is the quieter problem of historic holdings that sit inside companies, universities, foundations, industrial groups, banks, logistics firms, pharmaceutical groups, public-sector spinouts, and research-linked corporations whose main business is not running public Internet infrastructure.
The economic significance is easy to miss because the addresses may be operationally silent. No one is expanding a broadband base with them. No product roadmap is built around them. The board may never have seen them in an asset register. Yet the range may be worth real money, may still carry abuse reputation, may be hard to transfer without documentary repair, and may serve as a form of insurance against future addressing constraints. It may also create liability if stale records, reverse DNS, routing registry data, resource certificates, or forgotten BGP announcements point to a company that no longer watches the space.
The RIPE NCC sits at the centre of this question because it maintains the relevant regional registry for Europe, the Middle East, and parts of Central Asia, and because legacy resources are, by definition, rooted in an earlier allocation era. The RIPE NCC says that legacy Internet number resources are those obtained before, or otherwise outside, the current hierarchical registry system. It also provides registry services that include registration data, reverse DNS, routing registry functions, and, depending on the holder's relationship with the registry, RPKI certification. Those facts define the administrative terrain. They do not settle the economics.
The economics begins with the audit room. A dormant allocation is not free money because a company must prove control, clean records, manage risk, and decide whether to sell, lease, retain, convert, or leave it alone. Nor is it merely a dead relic because scarcity has made IPv4 address space a tradable, insurable, and reputation-bearing form of capital. The enterprise that discovers it owns something useful also discovers that it may not know how it owns it, who is authorized to act, and what past evidence says about the space. That gap is where transaction costs live.
Scarce capital with stewardship cost
IPv4 scarcity is the background, not the story. It would be lazy to frame every legacy-address article as another account of a depleted pool. The RIPE NCC announced in November 2019 that it had run out of IPv4 addresses in its available pool and that recovered addresses would be allocated in small amounts through a waiting list. That public fact matters, because it explains why dormant holdings have value. But it is not enough to explain why enterprise legacy holders matter. Scarcity turns space into capital; custody determines whether that capital is liquid, safe, and legitimate.
For a network operator, address space is working inventory. It supports customers, servers, routers, peering, access products, or security architecture. For an enterprise holder outside the network business, legacy IPv4 space is more ambiguous. It may be insurance against a future migration that needs public addresses. It may be a bargaining chip in a divestiture. It may be a reserve for a regulated environment where renumbering would be costly. It may be a forgotten line in an internal address plan. It may be a saleable asset with a market value that finance has never recognized. It may be an accounting nuisance because legal control is uncertain.
That ambiguity is exactly why the category matters. Capital is not just something that can be sold. It is something that must be held under a credible system of evidence. A company can claim that a prefix belongs to it, but the claim has economic force only if the registry record, corporate succession trail, authorization chain, routing history, and operational state can survive review by a buyer, broker, sponsoring LIR, tax adviser, auditor, insurer, or regulator. Without that evidentiary package, the space is still scarce, but its price is impaired by doubt.
Stewardship cost enters in several ways. Contacts must work. Registry entries must reflect the current legal name and operating reality. Reverse DNS should not point to infrastructure abandoned years earlier. Routing registry records should not authorize networks that no longer announce the space or no longer have a business relationship with the holder. RPKI status should match intended use. Security teams should know whether the range has been used in spam, scanning, sanctions-sensitive traffic, botnet command infrastructure, or other abuse. Finance teams should know whether the company has capitalized the asset, ignored it, impaired it, or treated sale proceeds as an incidental gain. Legal teams should know whether the right to act survived each merger, split, liquidation, or name change.
This makes the enterprise legacy holder both powerful and exposed. Powerful, because a holder outside daily network demand may choose when to sell and therefore can withhold supply from a thin market. Exposed, because the same delay may make the future sale harder. Each year of neglect can add proof work. Each restructuring can create more ambiguity. Each stale contact can make remediation slower. Each unnoticed route leak or abuse episode can reduce buyer confidence. In a market for scarce addresses, the quality of custody becomes part of the price.
Why non-network holders shape liquidity and title confidence
The IPv4 transfer market is often discussed as if supply comes from networks that no longer need addresses and demand comes from networks that still do. That view is incomplete. Many meaningful supplies of historic address space may sit in institutions whose demand for public numbering is not tied to subscriber growth or datacentre expansion. They may be industrial companies that once ran large research networks, banks with early Internet operations, universities that spun out corporate units, energy groups with remote systems, public contractors, logistics platforms, airlines, insurers, pharmaceuticals firms, or conglomerates that inherited address ranges by acquisition.
These holders matter because they can release supply without first reducing a telecom service or cloud capacity. In theory, that should make them important sellers. In practice, the supply is irregular, legally cautious, and often delayed by internal governance. A carrier can decide that a block is surplus because it can trace network use. An enterprise may first need to decide whether anyone has authority to make that statement. The number of addresses is visible in registry data; the internal decision path is not.
Market liquidity depends on more than how many addresses exist. It depends on whether sellers can prove that they can sell, whether buyers believe the transfer will close, whether brokers can price risk, whether registry update standards are predictable, whether stale routing evidence can be cleaned without dispute, and whether legal departments can explain the transaction to auditors and tax teams. A legacy range with immaculate records may move like a high-quality instrument. A similar range tied to an obsolete corporate name, dead contacts, unresolved merger trail, and unknown route history may trade at a discount or not trade at all.
This is where ledger legitimacy becomes market infrastructure. The RIPE NCC's public transfer pages describe processes for changing holdership and for business-structure changes such as mergers and acquisitions. Its required-document guidance describes the need for registered contacts or authorized persons, legal registration papers, and official records that support corporate changes. The content is administrative, but the economic effect is broader. Predictable evidence standards reduce the private cost of finding out whether a seller can act. Unpredictable standards increase the risk premium, invite private gatekeeping by brokers, and push weaker sellers toward opaque arrangements.
Non-network holders also affect title confidence because they are where old corporate histories most often collide with modern registry expectations. A company that has remained a member of the RIPE NCC and has kept its records current is relatively straightforward. A company that inherited a range from a dissolved predecessor, through a series of cross-border mergers, before current digital archives, is not. The issue is not whether the company is honest. The issue is whether the proof chain is legible enough for a registry entry to be updated without turning the registry into a tribunal for every old corporate story.
Title confidence has public value. The Internet routing system depends on unique numbering and widely accepted claims about who may use which ranges. Buyers depend on that confidence when committing money. Operators depend on it when setting filters, creating route origin authorizations, or resolving abuse contacts. Security researchers depend on it when assigning events to holders. Law-enforcement contacts depend on it when seeking the right desk. The public does not need every historic enterprise to sell unused space. It does need the registry evidence to be reliable enough that dormant capital does not become a cloak for confusion.
A ledger before a gatekeeper
The central institutional question is simple to state and difficult to maintain: when should a regional registry behave as a ledger, and when would pressure turn it into a gatekeeper? A ledger records and updates claims under known rules. A gatekeeper decides, case by case, whose claim is socially worthy enough to pass. For enterprise legacy holdings, the distinction is crucial.
There is a recurring temptation to ask why a non-network company should hold valuable public address space when networks, hosting firms, and new entrants need it. The question sounds efficient, but it is dangerous if it becomes an administrative test of moral desert. Many historic holders received or inherited space under earlier conditions. They may have legitimate operational reasons to retain it: regulated systems, long-lived industrial controls, hard-to-renumber sites, customer access lists, embedded partner links, cyber insurance assumptions, or simply the option value of avoiding future dependence on a provider. A registry that penalized them for not being carriers would undermine the continuity that makes registry data credible.
The opposite temptation is equally dangerous: to treat every old registry entry as an untouchable private title regardless of accuracy. That would allow legacy space to become hidden capital control. If dead contacts, obsolete names, and unclear succession are allowed to remain indefinitely without friction, the market cannot distinguish genuine stewardship from archival inertia. Buyers pay more for due diligence. Networks face more stale abuse desks. Security teams misread attribution. Address brokers gain power because public evidence is weak. In the end, the holder with the least transparent custody may still control a scarce resource by default.
The ledger role therefore requires rigor without discretionary redistribution. The RIPE NCC should not decide whether an enterprise has a better social use for a prefix than a buyer does. It should maintain accurate registration data, require clear authority for updates and transfers, provide predictable paths for legacy holders to receive services, support routing and reverse DNS hygiene, and make it possible for genuine holders to repair records without excessive uncertainty. That is not laissez-faire neglect. It is institutional discipline.
The better institutional bargain is narrower. Holders should not be punished for history, but they should face the real cost of maintaining registry truth. A holder that wants services, route security, reverse DNS, transferability, or market value should keep its records and proof chain in order. A holder that neglects those duties should expect friction, delay, and discount. That is a market discipline mediated by a reliable ledger, not a forced redistribution scheme.
The internal custody burden
Enterprise legacy address space lives poorly inside modern corporate systems. It is not a normal domain name, a software licence, a data centre lease, a patent, a fleet asset, or a bank account. It may not appear in enterprise resource planning software. It may not be on the fixed-asset schedule. It may not be known to procurement. It may be understood by one network architect but not by legal. It may have been included in a merger without separate valuation. It may have been excluded from a divestiture by accident. It may be covered by a legacy agreement that no current counsel has read.
This creates a custody burden that is both technical and corporate. The technical side asks whether the address range is announced, filtered, delegated, certified, routed internally, whitelisted by partners, embedded in firewall rules, referenced by VPN devices, used in monitoring, or exposed in certificates. The corporate side asks whether the legal holder still exists, whether the current group is the successor, whether signatory authority is documented, whether a sponsoring LIR is involved, whether external vendors touch the range, and whether any past sale, lease, outsourcing contract, or service-provider relationship created rights that are still live.
The most expensive discovery is often not that the space is in use. It is that nobody can prove with confidence that it is unused. Old enterprise networks leave fossils. A public range may have been moved behind private addressing years ago, but a small lab still advertises a more specific route through a research partner. A reverse DNS zone may still point to names that include a predecessor brand. An incident-response vendor may have asked for a route announcement during a migration and never cleaned up the record. A cloud migration may have retired most uses but left external allowlists in partner environments. An acquired company may have kept a subrange for a business that was later sold, leaving a question about whether the address rights followed the business or stayed with the group.
That fragmentation is the hidden cost of enterprise legacy holdings. The more valuable IPv4 becomes, the more each fragment matters. A buyer will not merely ask whether the range exists. It will ask whether it can be announced cleanly, whether prior route history creates filtering problems, whether reputation can be cleaned, whether the current holder can sign, whether registry data can be updated, whether there are contractual encumbrances, and whether any part of the range has been delegated to a unit that is no longer under control. The enterprise that cannot answer those questions is not holding a simple windfall. It is holding a research project.
Good custody therefore begins before a sale. It starts with an internal register that assigns an accountable owner for the prefix, maps legal lineage, documents current use, records route and reverse DNS status, identifies maintainers, tracks service relationships, reviews RPKI and routing registry entries, and records a decision on retention, sale, lease, or reserve. This is not glamorous governance. It is the practical work that transforms a dormant line in a spreadsheet into usable capital.
Mergers, name changes and title ambiguity
Legacy holders often have histories that look nothing like clean corporate charts. A range may have been issued to an institute, then moved into a university holding company, then assigned operationally to a research network, then inherited by a commercial spinout, then absorbed by a multinational group, then separated during a divestiture. Each step may have left a paper trail, but not the same paper trail. Some steps may be documented by a government registry. Others may be buried in asset schedules. Others may appear only in board minutes, email archives, or network diagrams.
Title ambiguity is not usually a question of theft. It is a question of continuity. Did the legal entity listed in the registry survive under a new name? Did a merger transfer all assets by operation of law? Did a sale of business include Internet number resources or only customer contracts and equipment? Did a research foundation retain the prefix while outsourcing network operation? Did a subsidiary use the range while the parent remained the holder? Did an old university department become a separate company, and if so, did the address range follow the staff, the network, the legal person, or no one at all?
The RIPE NCC's guidance for registry updates and transfers sensibly asks for evidence from authorized people and official records for corporate changes. That is the right kind of friction. It avoids a world in which anyone with access to an old mailbox can move valuable space, while avoiding a world in which every historic anomaly becomes a discretionary policy trial. The harder issue is what happens when the evidence exists but is scattered across several jurisdictions, languages, and eras of corporate law.
In such cases, the transfer-readiness audit becomes a transaction-cost exercise. The holder must assemble legal continuity, technical control, contact authority, and market intent into a coherent package. The cost is not merely lawyers' time. Delay itself has price. Buyers may move to another seller. Market prices may change. A divestiture timetable may close. Tax treatment may become less favourable. Internal attention may drift. A holder that waits until it has a buyer before reconstructing its succession trail may discover that the most valuable part of the asset is the part it cannot produce quickly: credible authority.
Enterprises should treat each historic address range as an asset whose title file needs the same care as a property file or material licence. The file should include the original allocation evidence if available, registry snapshots, current RIPE Database records, corporate registration history, merger or acquisition documents, board or officer authority, service agreements with LIRs or other providers, proof of current maintainer control, routing and reverse DNS status, and a signed internal decision on intended treatment. The point is not to create a museum. It is to reduce future proof cost.
Stale network evidence and reputational shadow
The market for legacy IPv4 space does not price only legal authority. It also prices the network past of the address range. An enterprise may think of its holding as dormant, yet public data may tell a messier story. Parts of the range may have been announced by old providers. Routing registry entries may still list autonomous systems that no longer serve the holder. Reverse DNS may point to abandoned names. RPKI may be absent, incomplete, or inconsistent with intended routing. Abuse desks may have years-old complaints. Security databases may associate the range with spam, scanning, malware distribution, open proxies, sanctions-sensitive activity, or compromised hosts.
Some of this reputation may be unfair. IP addresses are reused, misattributed, leased, hijacked, or briefly routed by others. A holder may have had no practical knowledge of abuse after outsourcing operations. But buyers, filters, and security systems rarely price fairness. They price evidence. A clean range with current records and stable origin history is easier to deploy. A range with years of dirty reputation may require warming, delisting, careful announcement strategy, customer explanation, and contractual indemnity.
Stale evidence is especially important for non-network enterprises because they may not monitor the address space as a carrier would. A telecom operator watches BGP and abuse tickets because public numbering is core to its service. A corporate holder may not have a 24-hour routing desk. It may not know whether a more-specific route appeared for six hours three years ago. It may not know whether a DNS delegation still points to a vendor. It may not know whether a route registry entry was created during a migration and never removed. This is not negligence in the ordinary sense; it is a mismatch between address capital and enterprise operating priorities.
RPKI changes the risk calculus but does not remove it. The RIPE NCC describes RPKI as a system that lets holders request certificates listing the resources they hold and supports BGP origin validation. Legacy holders can use resource certificates under certain service relationships. For an enterprise holder, that means route-origin evidence can become cleaner and more credible, but only if someone is responsible for it. A certificate that matches current intent is a stabilizing signal. No certificate, or an outdated route authorization, can become another diligence question.
The reputational shadow is not only technical. It can be corporate. If a range still points to a household brand, and that range is later leased to a spammer or routed by a weak provider, complaints may reach the historic holder. If a university-linked range is used by a commercial lessee in a controversial sector, the reputational harm may exceed lease income. If a company sells a range without cleaning old references, customers or researchers may misattribute later activity. Registry accuracy does not eliminate these risks, but it gives every party a clearer starting point.
For that reason, a transfer-readiness audit should include a reputation review. It should examine BGP history, routing registry entries, RPKI state, reverse DNS, public blocklists, abuse contacts, old service tickets, security telemetry, and major third-party reputation systems. It should also look for internal dependencies: allowlists, partner tunnels, licensed software tied to source addresses, monitoring systems, certificate records, and compliance documents. The goal is not perfection. It is to prevent a financial decision from being made on the false premise that silence equals cleanliness.
The accounting choice: sell, lease, retain or write down
Once an enterprise knows that a legacy holding exists and can be controlled, the question becomes financial. Should the company sell it, lease it, retain it as operational insurance, reserve it for a future carve-out, convert its status where appropriate, or write down its practical value because evidence is too weak? There is no universal answer because each choice shifts risk between liquidity, option value, reputation, tax treatment, and operational flexibility.
A sale is clean in appearance. It converts dormant capital into cash, eliminates much of the ongoing stewardship burden, and may simplify future audits. It can be attractive to companies that have no foreseeable need for public IPv4 space, especially if internal renumbering has already removed dependencies. But a sale also ends optionality. A company that later needs stable public addresses for a regulated service, a partner network, a cloud migration, or a security architecture may have to buy back at a worse price or accept dependence on a provider. The sale decision therefore belongs not only to finance but also to network architecture, security, procurement, legal, and business-continuity planning.
Retention is often treated as passive, but it is not free. Retained space needs records, contacts, route hygiene, review of third-party references, and an internal owner. If finance recognizes market value, tax and accounting treatment may follow. If finance ignores value, the company may understate opportunity cost. If security ignores the range, reputation risk accumulates. Retention is rational when the option value exceeds sale proceeds and stewardship cost. It is irrational when the company simply avoids a hard decision because nobody wants to own the file.
Leasing sits between sale and retention, and that is why it is tempting. It appears to monetize the asset while preserving long-term control. For a holder that does not need immediate sale proceeds, lease income can look like found revenue. In practice, leasing is a contract-intensive business with asymmetric risk. The lessee gets addresses to use now. The holder keeps the registry relationship, residual reputation, future sale exposure, and the task of policing terms. If the lessee creates abuse, uses the space in sensitive jurisdictions, routes through weak providers, subleases without discipline, or fails to return clean control, the holder may bear costs that exceed rent.
Tax treatment can be equally awkward. Jurisdictions may differ on whether proceeds are capital gains, ordinary income, intangible asset income, or something else. Group structures may determine which entity can sell and where gains are recognized. A university-adjacent holder may face restrictions on disposing of assets inherited from public funding or research grants. A corporate group may need internal transfer pricing if the legal holder sits in one country while the decision maker sits in another. These questions are not reasons to freeze. They are reasons to start earlier than the sale timetable.
The most overlooked choice is impairment. A company may discover a block that appears valuable by size but is impaired by missing authority, unresolved corporate succession, old encumbrances, dirty reputation, or partial dependence by a divested unit. That does not mean the space has no value. It means the headline price is not the net value. Transaction-cost economics is useful here because it turns vague uncertainty into specific frictions: search cost, proof cost, negotiation cost, enforcement cost, cleanup cost, and delay cost. The market does not pay for theoretical scarcity; it pays for deliverable control.
Transfer readiness as economic infrastructure
Transfer readiness sounds like a private checklist, but at market scale it is economic infrastructure. It reduces uncertainty for buyers, makes supply more credible, improves pricing, and strengthens the registry's legitimacy. For enterprise legacy holders, readiness means that the company can answer four questions without improvising: who is the legitimate holder, who is authorized to act, what exactly is being transferred or retained, and what public network evidence needs cleanup before the transaction?
The first question is legal. The holder must trace the path from the historic allocation or earlier registry record to the current legal entity. That may involve name changes, mergers, acquisitions, dissolutions, asset purchases, spinouts, or statutory transfers. The second question is authority. A registry update or transfer should not depend on a helpful engineer with old credentials. It should come from someone with documented power to bind the holder. The third question is scope. The company must know whether it is selling a whole range, a more specific portion, or retaining part for internal use. The fourth question is hygiene. The company must decide which routing, reverse DNS, contact, and certification signals should be corrected before closing.
For a large enterprise, these questions require coordination among teams that rarely meet. Legal can supply company records but may not understand prefix length. Network teams can map announcements but may not know the terms of a merger. Finance can model sale proceeds but may not understand route reputation. Security can identify abuse history but may not know transfer policy. Procurement may hold contracts with brokers, LIRs, DNS providers, or cloud services. Tax may care about which entity holds the asset. The audit must therefore create a common language: address range, legal holder, use state, evidence state, market state, risk state, and decision state.
The RIPE NCC's role is to make the external evidence path predictable. Its public materials already point in that direction: legacy service options, registration maintenance, transfer processes, merger and acquisition documentation, route security, reverse DNS, and database records. The more predictable the evidence expectations, the lower the private cost of readiness. This does not mean weaker standards. It means fewer surprises. A holder should know what proof is likely to be needed before it hires advisers, contacts brokers, or opens a board approval process.
Transfer readiness also helps companies avoid bad sales. A rushed holder may agree to a low price because it overestimates difficulty, or to a high headline price with terms that shift abuse risk back to the seller. A better prepared holder can separate registry risk from market risk, negotiate warranties with more precision, and decide whether cleanup is worth doing before or after a sale. It can also decide not to sell if the audit reveals operational dependencies that would be expensive to replace.
Leasing temptation and contract asymmetry
Leasing is the most seductive option for enterprise legacy holders because it appears to reconcile every desire. The holder keeps long-term control. Finance receives recurring income. The market gains use of dormant space. The company can tell itself that it has not made an irreversible sale. Yet leasing is where the difference between owning address space and operating address space becomes most painful.
An enterprise that leases must act like a risk manager for someone else's network behaviour. It needs contracts that define permitted use, routing authority, abuse handling, sanctions exposure, sublease restrictions, termination rights, monitoring, indemnity, insurance, jurisdiction, data access, and return conditions. It needs technical controls to know who announces the space, where, with which origin ASNs, under which route-origin authorizations, and with what reverse DNS. It needs a way to respond quickly when security researchers, mail operators, hosting providers, or law enforcement contact the listed holder. It needs to decide whether lease income justifies becoming a quasi-operator for risk purposes.
The asymmetry is obvious. The lessee captures immediate operational value. The holder retains residual harm. If the lessee damages reputation, the holder may face lower future sale value. If the lessee disappears, the holder may need cleanup. If the lessee subleases, the holder may lose visibility. If the lease creates conflicting claims, a future transfer may slow. If the space becomes associated with abuse, blocklists may not care that the holder did not send the traffic. The holder's brand may appear in registry data long after the lessee has moved on.
Leasing also affects market transparency. A sale changes holdership and can update records. A lease may leave formal holdership unchanged while practical use moves elsewhere. That can be legitimate, but it can also blur attribution. When public records say one company and traffic points to another, abuse handling, sanctions screening, and routing trust become harder. The wider the gap between formal holder and practical user, the more the market depends on private contracts that outsiders cannot see.
This is why leasing is not simply a private financial choice. At scale, leasing can reduce apparent supply for sale while increasing hidden supply for use. It can support networks that cannot or will not buy. It can also create a layered market in which control is split among holder, broker, lessee, sublessee, transit provider, and route manager. The registry remains a ledger of holdership, but operational reality becomes a chain of private agreements. For scarce capital with public routing effects, that chain deserves scrutiny.
The enterprise test should be strict: lease only if the holder can monitor use, enforce terms, protect reputation, maintain accurate contacts, avoid hidden subletting, preserve future transferability, and explain the arrangement to legal, finance, tax, security, and the board. If those conditions sound onerous, that is the point. Lease income is not passive income when the asset is an Internet identifier tied to public trust.
Market opacity and the liquidity discount
IPv4 address markets are more transparent than they were, but they remain uneven. Public transfer statistics show that transfers occur, brokers quote ranges, and buyers have learned to treat address space as purchasable. Yet much of the real pricing still depends on private negotiations, block quality, reputation, timing, prefix size, regional constraints, legal complexity, and seller urgency. Enterprise legacy holders add another opacity layer because potential supply is often unknown even to the holder.
Opacity creates a liquidity discount. Buyers discount uncertain sellers. Sellers discount their own assets when they cannot prove control quickly. Brokers gain from information asymmetry. Advisers can charge for reconstructing facts that should have been maintained. Bad actors can exploit holders that do not know the market. Internal politics can delay decisions until a sale is no longer timely. The result is a market where scarcity exists, but not all scarce space is equally liquid.
The liquidity discount is not only financial. It affects network development. A buyer needing addresses for a real deployment may prefer a smaller, cleaner range over a larger, uncertain legacy holding. A network planning team may avoid a deal if old route history suggests filtering problems. A cloud or hosting firm may pay more for space that can be certified and announced quickly. A security-sensitive buyer may reject a range with unresolved abuse reputation. Thus, enterprise neglect can keep nominal supply off the market even when the holder would sell at the right price.
This is why transfer readiness has macro consequences. If many enterprise holders clean their records, the market gains credible supply and better price discovery. If they do not, scarcity rents accrue to the cleanest sellers, brokers with proprietary knowledge, and lessees willing to accept messy terms. The market becomes not just a market for addresses, but a market for clarity. Clarity has a price because institutions failed to supply it earlier.
The RIPE NCC can help reduce opacity without setting prices. It can maintain reliable data, clear service routes for legacy holders, accessible guidance, timely update handling, and public statistics. It can encourage contact hygiene and resource-quality review. It can support RPKI and reverse DNS practices that make operational state more legible. It can avoid arbitrary surprises in transfer evidence. It can also resist pressure to become a price regulator, forced-sale authority, or moral allocator of historic holdings. The registry's economic contribution is not price discovery by decree. It is lower uncertainty through better records.
Enterprises have their own role. They should not wait for a broker to discover value. They should know what they hold, why they hold it, what it would take to transfer, and what risks attach. They should create internal decision thresholds: sell if no strategic dependency exists and records are clean; retain if option value is documented; lease only under strong controls; remediate if title is unclear; return if there is neither use nor appetite for stewardship. Such policies transform hidden capital into managed capital.
The public-interest boundary
Legacy enterprise holdings create a genuine public-interest question because IP addresses are globally coordinated identifiers, not ordinary private goods. Their uniqueness matters to routing, attribution, abuse response, and market access. At the same time, historic holders are not wrongdoers merely because they are not networks. Many received or inherited space under rules and practices that existed at the time. Institutional legitimacy depends on respecting continuity even when scarcity later changes the economic meaning of old allocations.
The public-interest boundary has two sides. On one side, the registry community should not treat enterprise holders as hoarders by default. A bank may need stable public addresses for regulated connectivity. A manufacturer may have industrial systems that are costly to renumber. A university-linked institute may support long-running research infrastructure. A conglomerate may retain space for divestiture flexibility. A company may simply value the insurance of having addresses that are not controlled by a provider. These reasons may not satisfy someone waiting for IPv4 supply, but they are not illegitimate.
On the other side, legacy status should not excuse poor stewardship. If a holder enjoys the option value of scarce capital, it should bear the cost of keeping public records usable. Contact data, routing signals, reverse DNS, and authorization evidence are not private conveniences. They affect others. A stale abuse contact wastes time during incidents. A confused registry entry harms buyers and researchers. A forgotten route authorization can weaken routing security. A lease hidden behind old records can mislead those trying to understand who is using a range. The public interest does not require forced sale, but it does require serious custody.
This boundary matters because policy debates often collapse into slogans: free the unused space, or defend historic rights. Neither slogan is adequate. Forced redistribution would damage trust and might drive holders away from voluntary cleanup. Absolute deference to stale claims would allow valuable public identifiers to sit behind decayed evidence. The right approach is institutionally modest but operationally demanding: preserve continuity, enforce evidence, improve hygiene, and reduce transaction costs.
The public interest should also include long-term transition. IPv6 remains the durable answer to identifier scarcity, but IPv4 will retain market value for years because deployed systems, customer equipment, security policies, and business dependencies change slowly. Enterprise legacy holdings are part of that transition economy. Treating them as shameful hoards may delay engagement. Treating them as private treasure with no public duties may weaken trust. Treating them as scarce capital with stewardship obligations is less dramatic and more useful.
RIPE NCC's legitimate role
RIPE NCC's strongest role is not to decide enterprise capital strategy. It is to preserve the conditions under which private decisions about legacy space can be made without damaging registry trust. That means accurate registration data, predictable update processes, clear legacy service paths, transparent transfer evidence, usable reverse DNS, routing registry hygiene, RPKI access where policy permits, and continuity across corporate change. In short, the registry should make the ledger reliable enough that the market can work and the Internet can route.
Accuracy is the first requirement. The RIPE Database contains registration information for networks in the RIPE NCC service region and related contact details, and it supports routing policy publication, coordination, reverse DNS provisioning, and research. For enterprise legacy holders, this is the public face of custody. If the record is stale, every later decision becomes harder. RIPE NCC should continue to make record maintenance practical for legacy holders, including those that are not ordinary network operators, while requiring sufficient evidence for material changes.
Predictability is the second requirement. A holder deciding whether to sell or remediate needs to know what kinds of evidence are expected. That does not mean every case will be easy. It means the categories of proof should be legible: legal continuity, authorized signatories, current holder identity, resource scope, and relevant contractual relationships. Predictability reduces private gatekeeping. If the public registry path is unclear, brokers, law firms, and informal intermediaries become the effective interpreters of registry risk. Some will add value; others will extract rents from confusion.
Hygiene is the third requirement. Route registry entries, reverse DNS, contact data, and RPKI state are not decorative. They are signals that shape routing, abuse response, and market confidence. RIPE NCC can support better hygiene through tools, guidance, assisted registry checks, and clear service matrices for legacy holders. It should avoid making hygiene feel like a trap. If holders fear that cleaning records will trigger punitive review, they will stay silent. If holders see hygiene as the path to safer retention or cleaner transfer, they are more likely to engage.
Continuity is the fourth requirement. Legacy resources exist because the Internet's registry system evolved. RIPE NCC must bridge old allocations and modern evidence without pretending that history was neat. That bridge requires patience with corporate archives, but not credulity. It requires recognition of legitimate succession, but not casual acceptance of weak claims. It requires a way for non-network enterprises to establish service relationships without being forced into roles that do not match their business.
The role RIPE NCC should avoid is capital planning. It should not pressure an enterprise to sell because the space is valuable. It should not decide that a university-linked holder is more worthy than a manufacturer, or that a carrier's need is more important than a bank's reserve. It should not set prices, bless leasing structures, or arbitrate every reputational dispute. Its legitimacy comes from being the institution whose records make private action possible, not from substituting its judgment for private capital allocation.
That restraint is not weakness. It is the discipline that keeps a registry credible under scarcity. When capital value rises, every registry action looks more consequential. An update can affect millions of euros. A delayed transfer can change a deal. A stale entry can mislead a buyer. A certificate can affect route acceptance. Under those conditions, institutional legitimacy comes from narrow authority exercised well.
What enterprise boards should ask
Boards and senior executives do not need to become routing experts. They do need to ask enough questions to prevent valuable holdings from being lost in the gap between technical archives and capital decisions. The first question is basic: do we know whether the group holds any legacy IPv4 ranges in the RIPE NCC region, directly, through subsidiaries, through research-linked predecessors, or through acquired entities? If the answer is uncertain, the company has an information-control problem.
The second question is ownership in the practical sense: which legal entity is listed, which legal entity now claims the space, and what evidence connects them? A corporate secretary's office may be better placed than the network team to answer that. The third question is operational: which parts are announced, delegated, certified, routed internally, referenced by partners, or embedded in security controls? The fourth question is reputation: what does public and private security data say about the range? The fifth question is decision: is the company retaining, selling, leasing, reserving, cleaning, or returning the space?
These questions should not wait for a buyer. The worst time to assemble evidence is during a transaction. The second worst time is during a breach response. A legacy range should be included in cyber asset management, legal entity management, M&A due diligence, and divestiture planning. If a company buys another company with historic address space, the deal team should know whether the range is included, excluded, encumbered, leased, or operationally required. If a company sells a division, the same question should be answered explicitly. Ambiguity is cheap at signing and expensive later.
Procurement also has a role. Contracts with brokers, LIRs, DNS providers, cloud platforms, managed security firms, and network consultants may affect address control. A company should know whether any third party can update records, manage route origin authorizations, control reverse DNS, or route the space. It should know whether broker mandates are exclusive, whether lease arrangements allow subletting, and whether service providers have obligations to return control cleanly. Address space may be intangible, but the contracts around it are very tangible.
Tax and accounting teams should avoid treating the issue as an afterthought. If sale proceeds are material, timing, entity location, historical basis, intercompany arrangements, and asset classification matter. If the space is retained, opportunity cost should be recognized internally even if no balance-sheet line appears. If the space is leased, income recognition and risk reserves should be considered. If the space is impaired by evidence gaps, remediation cost should be weighed against potential value. The point is not to over-financialize a technical resource. It is to stop pretending that a scarce, tradable identifier has no corporate finance implications.
Security teams should insist on monitoring even when the business chooses retention. A dormant range should not be invisible. It should have route monitoring, abuse contact handling, reputation checks, DNS review, RPKI review, and an escalation path. If the company would be embarrassed to see the range named in an incident report, it should not leave the range unmanaged.
The signal for 2026-2030
The next few years will likely make enterprise legacy holdings more important, not less. IPv6 deployment will continue, but IPv4 demand will persist in hosting, security, access, enterprise networking, cloud transition, and regional markets where legacy systems remain stubborn. Prices may move unevenly, but the underlying scarcity will keep address space economically meaningful. At the same time, corporate compliance expectations will keep rising. Boards will ask more questions about cyber exposure, sanctions risk, asset monetization, and divestiture readiness. Legacy address space sits at the intersection of all four.
The strongest signal to watch is not simply transfer volume. It is the quality of enterprise supply. Are more non-network holders cleaning records before sale? Are legacy service relationships becoming easier for enterprises to understand? Are transfer statistics showing larger historic ranges entering the market from corporate sellers? Are buyers asking more aggressively for RPKI, reverse DNS, abuse history, and corporate succession evidence? Are brokers pricing record quality more explicitly? Are leasing arrangements becoming more disciplined, or are they spreading as a shadow market with weak visibility?
RPKI adoption among legacy holders is also worth watching. A rise in clean route-origin evidence would improve deployment confidence and reduce hijack risk. But it must be paired with actual governance. Creating a certificate is not the same as managing address policy. Enterprises need to know who can authorize changes, how intended origins are approved, and how routes are withdrawn after a sale or lease. Route security without corporate control is another kind of stale evidence waiting to happen.
The final signal is cultural. Will enterprises treat historic IP space as a managed capital item, or will it remain a curiosity owned by whichever engineer remembers the password? The answer will shape market liquidity more than any speech about scarcity. If companies build address custody into M&A, asset management, and security governance, dormant capital can move or be retained rationally. If they do not, the market will continue to price confusion.
RIPE NCC's challenge is to keep the institutional centre steady while these incentives intensify. It should make engagement easier, evidence clearer, and records cleaner, while declining invitations to become a redistribution authority. That balance is difficult precisely because scarcity makes everyone impatient. But impatience is a poor foundation for registry legitimacy.
Dormant capital, not dead space
Enterprise legacy holders are easy to caricature. To some network operators, they look like inefficient owners sitting on valuable supply. To some corporate finance teams, they look like unexpected cash. To some engineers, they look like forgotten prefixes that should be left alone until retirement. To some policy advocates, they look like a test of fairness. Each view captures part of the truth and misses the institutional whole.
The better description is dormant capital with public-facing custody duties. The capital is scarce because IPv4 remains useful and no new abundance is coming from the registry pool. It is dormant because many enterprise holders are not using it as working network inventory. It has custody duties because addresses are globally visible identifiers that affect routing, attribution, abuse response, reputation, and market confidence. The fact that a company is not a network does not erase those duties. The fact that the duties exist does not erase the company's legitimate interest in continuity and optionality.
For RIPE NCC, the implication is measured but demanding. Be a precise ledger. Maintain continuity across history. Require evidence for material changes. Support legacy holders that want to clean records. Make transfer and service paths predictable. Encourage RPKI, reverse DNS, and contact hygiene. Publish useful statistics. Resist pressure to decide who deserves capital. Resist the opposite pressure to let stale records persist without consequence. The institution earns legitimacy by reducing uncertainty without taking over the market.
For enterprise holders, the implication is more immediate. Do not wait until a buyer, auditor, incident, or divestiture forces the issue. Find the ranges. Map the legal trail. Clean the contacts. Review the routes. Check reverse DNS. Decide on RPKI. Examine reputation. Identify dependencies. Put finance, legal, security, procurement, tax, and network teams in the same room before a transaction is live. Decide whether the range is reserve, supply, lease candidate, impaired claim, or return candidate. Then treat that decision as part of corporate governance, not as trivia.
For the market, the implication is that liquidity will come as much from evidence as from scarcity. The addresses already exist. The question is whether their holders can prove control and manage risk well enough for the space to move, be leased safely, or be retained honestly. A market in which historic enterprise space remains hidden behind poor records will be thinner, more opaque, and more dependent on intermediaries. A market in which holders clean records and make decisions will be more liquid without requiring forced redistribution.
The enterprise address audit that began as an inconvenience can therefore become a useful institutional exercise. It reveals whether a company knows its own scarce capital. It reveals whether the registry can support continuity without becoming a gatekeeper. It reveals whether the market rewards clean custody. In the RIPE NCC region, that is the real enterprise legacy-holder story: not simply that IPv4 is scarce, but that scarcity turns old records into present-day economic power, and power without stewardship becomes risk.
Public reference points
This article uses public RIPE NCC and NRO materials for factual context on the RIPE NCC service region, legacy resources, legacy services, transfers, required documents, the RIPE Database, reverse DNS, RPKI, and the 2019 IPv4 run-out announcement. The economic assessment above is an institutional analysis of incentives, transaction costs, custody, and legitimacy, not a restatement of any single registry page.