RIPE NCC is a valuable institution. That is precisely why its mandate deserves sharper scrutiny. An irrelevant registry cannot launder much authority; the market ignores it. A competent registry, by contrast, sits inside the operating system of the Internet. Its database is consulted by networks, lawyers, brokers, compliance teams, banks, buyers, sellers, lessors, cloud platforms, hosting companies, governments and engineers trying to decide who may rely on which block of address space. Its transfer procedures, membership contracts, sanctions screening, RPKI services, reverse-DNS administration, audit routines and policy machinery do not merely describe the address economy. They help make it legible.
That is the setting in which mandate laundering occurs. A limited function enters the institutional machine as technical coordination: maintain a globally unique registry of Internet number resources, prevent duplicate recognition, record legitimate changes, support operational data, publish contacts, and provide the minimum security services that make the ledger trustworthy. It exits as a much broader practical power: to shape who may obtain, keep, transfer, lease, certify, finance or safely depend on IPv4 address space and related registry status. The enlargement is seldom announced as control. It is washed through the language of stewardship, community consensus, responsible management, accuracy, sanctions compliance, member services, routing security and the long-term interest of the Internet.
This is not a claim that RIPE NCC is uniquely malign. The charge would be easier, and less interesting, if the institution were chaotic. RIPE NCC is the clean case because it is mature, professional, documented and deeply embedded. It has not had the spectacular institutional crisis associated with AFRINIC. It does not sit on precisely the same property-and-needs-assessment fault line that makes ARIN such an obvious object of North American legal argument. Its service region is harder: Europe, the Middle East and Central Asia, with members ranging from giant incumbents and cloud platforms to small access providers, public bodies, academic networks, data centres, conflict-adjacent operators, sanctioned or sanctions-exposed firms, address traders, lessors and companies trying to turn scarce IPv4 into working capacity.
The official record is useful, but only as evidence. RIPE NCC describes itself as a not-for-profit membership association, a regional Internet registry and the secretariat for the RIPE community. Its 2026 charging scheme sets the annual contribution at EUR 1,800 per LIR account, adds charges for independent and legacy resources, and keeps a EUR 1,000 sign-up fee. Its IPv4 run-out page records that the remaining IPv4 pool was exhausted in November 2019, after the last-/8 regime had already reduced ordinary allocations to one /22 per LIR. Its waiting-list explanation says recovered IPv4 is now distributed as /24 blocks to eligible members. Its resource-transfer policy permits transfers but imposes a 24-month restriction on certain scarce resources after receipt and requires registry updates. Its policy-development process describes an open, bottom-up consensus method. Its 2026 Activity Plan and Budget budgets income of EUR 41.140 million, costs of EUR 41.125 million, and 202.1 full-time-equivalent staff across registry, information-services, community and organisational activities.
Those documents tell us what RIPE NCC says it does. They do not settle what it should be allowed to do. No institution is a neutral witness on the boundary of its own power. The more interesting question is institutional and economic: once IPv4 scarcity has turned registry status into a balance-sheet input, which forms of RIPE NCC discretion still protect the ledger, and which forms merely dress gatekeeping in the older language of community mandate?
A small task with a large shadow
The indispensable registry function is narrow. Internet number resources must be globally unique. If two unrelated networks are recognised as the legitimate holders of the same block, the coordination layer fails. The registry must therefore know who the recognised holder is, which contacts are responsible, what reverse-DNS and routing-security data attach to the resource, and whether a proposed change is legitimate. It must be difficult for a hijacker, forged officer, rogue employee, fake buyer or opportunistic creditor to corrupt the record. It must be possible for operators, counterparties and courts to find a stable registration trail.
That narrow task justifies a registry. It does not, by itself, justify a broad institution. The trouble begins when the vocabulary around the registry expands faster than the underlying mandate. Words such as community, stewardship, fairness, responsible management, consensus and Internet governance sound modest when address space is abundant and the registry is mainly allocating from a free pool. They become heavier once the free pool has disappeared and the same words are used to govern transfers, waiting-list eligibility, audits, fees, legacy-resource updates, sanctions checks, RPKI certification and the contractual relationship between resource holders and the registry.
Scarcity changes the economics. A new IPv4 allocation from an abundant pool was an administrative rationing problem. A transfer of already allocated IPv4 after exhaustion is a capital-market settlement problem. A registry that records the movement of a block after buyer and seller have negotiated a price is not doing the same thing as a registry distributing new space at administrative cost. It may still need to check identity, authority, sanctions, fraud, dispute status, policy compliance and technical integrity. But it is now operating at the transaction layer of a scarce asset market. If its language remains in the old allocation world, it imports authority from one economic setting into another.
RIPE NCC's own IPv4 policy contains the older vocabulary. The policy points to uniqueness, aggregation, conservation, fairness and registration. These were sensible objectives for an allocation system. Yet the statement that only registered allocations and assignments are considered valid has acquired a different meaning after scarcity. Validity is not merely a clerical note. It determines whether a block can be sold, leased, financed, certified, defended in due diligence, used in customer contracts or treated as a stable input to a network business.
The result is a double character. Formally, the registry is a database and service organisation. Economically, it is a recognition layer for scarce productive capital. Mandate laundering occurs when the institution continues to speak as if recognition is low-stakes administration while using that recognition to shape high-stakes market outcomes.
The distinction matters because the Internet has not solved scarcity by abolishing it. IPv6 exists and continues to matter, but IPv4 remains embedded in access networks, hosting, cloud services, enterprise estates, customer equipment, software assumptions, consumer devices and procurement habits. Operators can deploy carrier-grade NAT, dual-stack, IPv6-only islands, proxies and address-sharing architectures. They can buy addresses, lease addresses, merge with address-rich firms or renumber customers. None of these options removes the economic value of a clean IPv4 registration record. Scarcity is no longer a temporary inconvenience on the way to a pure IPv6 world. It is a durable constraint that turns registry administration into market infrastructure.
Why RIPE NCC is the better test
Institutional collapse makes analysis too easy. When a registry is in litigation, receivership, election paralysis or financial crisis, every structural problem can be blamed on local mismanagement. The wider registry model survives because attention moves to personalities, courts, national politics and emergency governance. A mature registry is harder to dismiss. RIPE NCC has the staff, portals, policies, meetings, legal structure, transparency reports, operational documentation and member engagement that defenders of the RIR model would want to display.
That makes the mandate problem sharper. If a well-run registry still carries a gatekeeper temptation, the issue is not simply corruption or incompetence. It is the normal institutional response to scarcity. A registry that controls the canonical record of scarce resources will tend to define more conduct as part of its mandate. It will say it is protecting accuracy, stability, security, fairness, compliance, community policy or the long-term interests of the Internet. Some of that will be true. Some will be scope expansion.
RIPE NCC's service region intensifies the problem. A standard fee, open mailing list, transfer rule, audit process or sanctions screen does not have the same practical meaning in the Netherlands, Ukraine, Turkey, Kazakhstan, the United Arab Emirates, Georgia, Serbia, Lebanon, Germany or the United Kingdom. A large European incumbent can dedicate lawyers and policy staff to registry matters. A small regional ISP may experience the same institution as a necessary bill and a source of operational risk. A cloud platform can internalise policy compliance as a cost of doing business. A new provider may see a /24 waiting-list allocation as a scarce launch input. An operator in a sanctions-exposed environment may treat every registry contact as a continuity event.
Formal equality is not enough. A flat LIR fee, a public transfer page, an open policy method and a standard audit routine can still produce unequal economic burdens. The cost of participation is not only the invoice. It is legal capacity, English-language fluency, staff depth, familiarity with RIPE procedure, ability to travel, comfort with public argument, and the cash flow to wait while scarcity is translated into policy. The institutions best able to dominate the discussion are not necessarily those most exposed to its decisions.
This is why RIPE NCC is the clean test of legitimacy. It forces the question to be asked without crisis theatre: is the registry acting as a ledger that narrows uncertainty, or as a gatekeeper that converts uncertainty into institutional leverage?
Ledger or gatekeeper
A ledger reduces transaction costs. It makes ownership-like claims legible without needing to decide every moral question about the market. A land registry need not endorse the price of a building. A securities depository need not approve the buyer's business strategy. A vehicle registry need not decide whether the second-hand car market is socially elegant. These comparisons are imperfect, but the institutional intuition is useful. The more a record-keeper sits at the settlement layer of a market, the more its legitimacy depends on predictable, narrow, reviewable criteria.
IPv4 address space is not ordinary property. The old registry vocabulary is right to resist the idea that addresses are simply land. They are entries in a global coordination system. They require uniqueness. They depend on routing acceptance. They are embedded in contracts with registries. They can be filtered, hijacked, misused or technically devalued. Yet the fact that an asset is unusual does not make its market effects unreal. If a block can be bought, leased, collateralised in substance, valued in a corporate transaction and relied on by customers, registry recognition becomes economic infrastructure whether or not the word property is used.
The ledger function is strongest when RIPE NCC confines itself to questions that affect the reliability of the record: identity, authority, continuity, dispute status, sanctions law, data quality, routing-security consistency, fraud prevention and clear notice to third parties. The gatekeeper function appears when the registry moves from record integrity to market judgment: whether the price is too speculative, whether leasing offends allocation-era sensibilities, whether a holder is using addresses in a manner the institution finds virtuous, whether a class of members should be discouraged, or whether broad institutional goals justify friction in capital movement.
Mandate laundering often happens at the border between these two functions. A rule can be defended as anti-fraud but also reduce liquidity. A documentation demand can improve data quality but also impose disproportionate costs on small operators. A transfer restriction can discourage arbitrage but also trap capital in less efficient hands. A sanctions check can satisfy legal duties but also blur into geopolitical risk preference. A fee can fund the ledger but also support a large institutional ecosystem that members cannot avoid. In each case the question is not whether the registry has any reason to act. It is whether the action is no broader than the registry function requires.
Scarcity makes this discipline more important. When addresses were allocated at administrative cost, an inefficient rule mostly affected allocation queues. When addresses trade at market prices and support real businesses, the same rule affects liquidity, valuation, financing, customer continuity and the cost of entry. The registry can still say it is only applying policy. Economically, it is allocating risk.
The community is not the market
The first laundering channel is the relationship between the RIPE community and RIPE NCC membership. The distinction is often stated, but its economic importance is understated. RIPE is an open community. RIPE NCC is a legal membership association that operates the registry and serves as the secretariat for RIPE. Community policy can guide number-resource distribution and registry practice. Members vote on association matters such as the charging scheme, board elections and organisational direction. These are overlapping worlds, not identical constituencies.
Each has a different legitimacy problem. The policy community can produce technical norms. Its openness is real: participants can join discussions, propose changes and argue on public lists. But openness is not representation. Participation is filtered by time, expertise, language, confidence, professional incentive, employer tolerance and historical familiarity. The people who speak most often are not necessarily a representative sample of operators, customers and capital providers affected by a rule.
Membership has a different weakness. Members fund the association and vote in general meetings. That is genuine accountability over budgets, board seats and association governance. But the member base is not the full set of affected parties. Many end users depend on provider-independent resources through a sponsoring LIR. Enterprise customers rely on ISP, hosting or cloud address continuity without holding RIPE NCC membership. Banks, acquirers, restructuring advisers, bankruptcy administrators, public bodies, SaaS firms and downstream networks can be exposed to registry decisions through contracts several layers away from RIPE NCC.
Mandate laundering occurs when these two partial mandates are treated as if they add up to public authority. A rule emerging from a small but formally open discussion becomes community-developed policy. A fee model approved by members becomes member accountability. A registry procedure built to apply the rule becomes neutral implementation. By the time the rule affects transfers, audits, RPKI or registration validity, institutional preference has passed through enough legitimate-looking filters that it appears inevitable.
The problem is not that RIPE policy is fake or that membership votes are meaningless. The problem is that neither mechanism should do more than it can justify. A bottom-up technical process is powerful when it defines objective registry requirements: uniqueness, accurate contacts, routing aggregation where still relevant, fraud prevention, transparent transfer recording, data-quality obligations and clear security metadata. It is weaker when it imposes economic preferences over capital movement. A member vote is strong when it approves the cost of running the ledger. It is weaker when it bundles broad institutional ambition into compulsory fees paid by members who need the registry relationship to maintain operational continuity.
The strongest version of RIPE NCC legitimacy would treat these structures as checks on one another. The community should not be a loose source of moral authority for registry expansion. The membership should not be a captive funding base for every activity the institution can plausibly place under Internet stability. The registry should translate community policy into narrow, auditable procedures, and the association should fund only what is proportionate to the compulsory relationship.
The weakness of community language is especially visible when silence is treated as consent. Many small operators do not comment on policy lists because they are not staffed to do so. Many customers do not know the rule exists until it affects a provider. Many capital-market participants see RIPE NCC only during a transaction. Their absence from discussion is not indifference. It is a cost of participation. Institutional economics has a name for this kind of problem: concentrated voice and dispersed exposure. Those with time and status inside the institution speak; those who pay indirectly remain legible only when something breaks.
Fees are a theory of the institution
The 2026 charging scheme is not merely a price list. It is RIPE NCC's theory of what the institution may charge for. The annual contribution remains EUR 1,800 per LIR account. The scheme adds EUR 75 for each independent Internet number resource assignment in defined categories and EUR 50 for relevant ASN assignments. It keeps the EUR 1,000 sign-up fee. Legacy resource holders with a direct agreement pay an annual fee equivalent to the LIR annual fee, with some sign-up-fee exceptions.
On its face this is administratively simple. A flat LIR contribution avoids a direct tax on address holdings and makes budgeting predictable. It reflects a tradition in which members fund a shared coordination body rather than buy metered vendor services. Yet scarcity changes the meaning of the invoice. A member is not buying a discretionary club good in an ordinary market. It is paying the institution that maintains the recognised record for resources embedded in customer contracts, transfer options, RPKI status, due diligence and operating continuity. Exit is constrained. Switching registries is not like switching software vendors.
The fee therefore functions as an infrastructure charge. Infrastructure charges require sharper scope discipline than subscriptions. If a member must maintain the relationship to protect registry status, the institution should be careful about what it bundles into the charge. The case is strong for registration, RDAP and Whois publication, reverse DNS, transfer processing, RPKI, fraud controls, data quality, dispute notation, business-continuity architecture and the minimum policy administration needed to keep the registry coherent. The case is less automatic for broad meetings, fellowships, travel, measurement platforms, training, outreach, public-policy engagement, government liaison, institutional branding and the social infrastructure of a large technical community.
Many of those broader activities produce value. RIPE Atlas, RIS, RIPEstat, training, regional meetings and community support may improve the Internet's information environment. The question is not whether they are good. The question is whether a compulsory registry relationship should fund them all by default. A mature institution will naturally prefer a wide mission. Staff want to build, measure, train, convene and represent. Board members want strategic relevance. Active community participants want the infrastructure of participation. Governments and intergovernmental bodies want a technical counterpart. The temptation is sincere. It is still a temptation.
The 2026 Activity Plan and Budget makes the scale visible. RIPE NCC expects income of EUR 41.140 million and costs of EUR 41.125 million, with a small operating surplus before financial results. It plans for about 20,000 contributing LIRs and 202.1 full-time-equivalent staff. It describes not only registry accuracy and member services but information services, security work, community engagement, external engagement, sustainability, Middle East operations, staff increases and support for the RIPE Chair. These activities may be defensible one by one. Together they show that RIPE NCC is not merely a small database office. It is a substantial institution funded through a relationship that many networks cannot realistically avoid.
That is why market-side complaints about fees should not be dismissed merely because some critics are interested parties. Brokers, lessors, address-rich companies, address-poor entrants and large network operators have their own incentives. So do registry staff, active community participants and incumbents comfortable with the existing model. The question is not who is pure. It is whether the institutional bundle is honest. Once IPv4 has become capital-like, should the compulsory levy fund only the ledger and tightly related security functions, or should it fund a broad ecosystem whose benefits are unevenly distributed?
The fee debate is therefore a legitimacy debate. If RIPE NCC can show that each compulsory euro reduces registry uncertainty, improves accuracy, strengthens security, speeds legitimate transfers or protects continuity, its mandate is stronger. If the fee funds institutional expansion because the registry relationship is the convenient revenue base, the charge becomes a quiet form of mandate laundering.
Scarcity made registration capital infrastructure
IPv4 exhaustion is the economic break. RIPE NCC records that the remaining IPv4 pool was exhausted in November 2019. Before that, the last-/8 policy had reduced ordinary new IPv4 allocation to one /22, or 1,024 addresses, for eligible LIRs. After exhaustion, recovered addresses are distributed through a waiting list, with each eligible LIR able to receive one /24, or 256 addresses, if enough recovered addresses become available. A /24 may be useful for a small deployment, transition plan or routing unit. It is not a substitute for meaningful growth by an access provider, hosting firm, cloud platform or enterprise service portfolio.
The waiting list is therefore not a market alternative. It is a residual allocation mechanism for recovered fragments. The main economic adjustment has moved elsewhere: transfers, leasing, mergers, acquisitions, carrier-grade NAT, customer renumbering, IPv6 deployment, address-sharing, proxies and the careful management of existing holdings. The registry can maintain allocation-era vocabulary, but the market has already moved on.
RIPE NCC acknowledges part of this reality when it explains that surplus IPv4 may be transferred, usually for a price, while RIPE NCC has no interest in the financial aspects and plays a role in processing the transfer and updating registration information. That statement is factually plausible and institutionally revealing. The registry does not set the price, broker the deal or carry the investment risk. But it controls the settlement record. In a scarce market, the settlement layer is not passive.
The record can create or destroy value without owning the underlying network. A buyer may negotiate a price for an IPv4 block, but the transaction depends on recognition. A lessor may rent access to address space, but the arrangement is safer if registry records, routing data and abuse contacts are coherent. A lender or acquirer may treat address holdings as part of enterprise value, but only if the registration trail is defensible. A network may advertise routes, but customers and counterparties will still ask whether the resource position is stable. Registry status becomes a form of economic infrastructure.
That infrastructure is not merely about the right to sell. It affects entry. An address-poor entrant faces a market in which the free pool is exhausted and small recovered allocations cannot solve scale problems. If transfers are predictable, the entrant can buy. If leasing is transparent, it can rent capacity. If registry rules are uncertain, it faces a risk premium. A registry that sees itself only as a technical coordinator may miss how much its procedures shape competition.
Incumbents benefit from this ambiguity. Firms with old allocations can absorb delay, hire consultants, maintain policy relationships and wait out uncertainty. New entrants and smaller operators pay more per unit of uncertainty. The same rule can look neutral on paper and regressive in effect. Institutional economics is often less interested in stated intent than in the distribution of transaction costs. On that test, every registry rule after IPv4 exhaustion should be read as market design.
Transfer policy as market design
RIPE NCC's transfer system is comparatively open by global standards. Transfers are allowed. Inter-RIR transfers are possible where policy compatibility exists. The registry publishes transfer statistics. It does not impose a general needs assessment on every transfer in the manner associated with some other regional traditions. These are important strengths. An outright anti-market registry would be easier to criticise. RIPE NCC's problem is subtler: it accepts the market while retaining allocation-era levers that shape it.
The 24-month restriction on scarce resources after receipt is the clearest example. It can be defended as a brake on quick flips, waiting-list arbitrage and purely speculative churn. That defence has force. A recovered /24 or transferred block should not become an instant instrument for gaming the registry. But the rule also reduces liquidity. It affects acquisitions, restructuring, financing, portfolio cleanup and business failure. It may keep resources in inefficient hands for longer than necessary. It may be tolerable, but it is not merely technical.
A registry that imposes such a restriction should speak in economic terms. What harm is being prevented? How large is the arbitrage problem? How often are legitimate business transactions delayed? Are mergers and insolvencies treated differently from speculative flips? How are inter-company restructurings handled? Does the rule raise prices for entrants by reducing available supply? Does it encourage leasing arrangements that keep formal holdership static while economic control moves elsewhere? These are not hostile questions. They are the questions any market-settlement authority should ask of itself.
Documentation expectations raise similar concerns. It is legitimate for RIPE NCC to verify that a transferor has authority, that the transferee is properly identified, that sanctions law is respected, and that the record will not be corrupted. But the marginal cost of documentation matters. A multinational group can produce corporate chains, board approvals and legal opinions. A small ISP emerging from a local merger may struggle to translate corporate history into the format expected by a Dutch association. A distressed seller may not have the luxury of long review. A buyer in a high-growth market may pay for uncertainty through a higher price or lower supply.
A ledger-first registry measures these frictions. It publishes median processing times, refusal categories, common delay reasons, sanctions-match durations, inter-RIR blockers, documentation defects and the treatment of M&A chains. It distinguishes fraud prevention from avoidable institutional drag. Monthly transfer lists show what moved. Process statistics would show what did not move, or moved only after bearing unnecessary cost.
The point is not to demand automatic transfers. Automatic settlement would invite fraud. The point is to make discretion visible enough that the market can price it and affected parties can challenge it. A hidden queue is a form of policy. A vague evidence demand is a form of tax. A delay with no category is a gate.
Leasing and the shadow price of addresses
Leasing is where allocation-era moral discomfort meets post-exhaustion economics. The address market has two basic ways to move use toward demand: sale and rental. Sale is clean in the registry imagination because it produces a transfer entry. Rental is messier because the formal holder may remain one party while operational use, routing responsibility, abuse handling, customer relationships and economic benefit are distributed across contracts. That messiness is real. It can produce abuse problems, opacity and accountability gaps.
But treating leasing as inherently suspect would be an error. Leasing exists because buying address space is capital-intensive and because operational demand is often temporary, uncertain or mismatched with registry geography. A growing platform may need capacity before it can justify a purchase. A start-up ISP may not want to sink scarce capital into addresses before proving demand. A hosting firm may need elasticity. An address-rich holder may prefer income to an outright sale. Leasing is not a deviation from the market; it is one of the market's responses to scarcity.
The right registry concern is not whether leasing offends the old allocation culture. It is whether leasing preserves accountability. Are abuse contacts accurate? Are route-origin authorisations coherent? Is the customer relationship traceable enough for serious incidents? Are sanctioned parties screened where law requires? Is the holder still reachable? Is the arrangement transparent enough that third parties can understand operational responsibility without exposing private commercial terms? Does the registry record avoid false comfort?
If RIPE NCC moralises leasing, it will not abolish it. It will push it into opaque forms: informal customer assignments, routing arrangements, shell companies, cross-border intermediaries and contracts that preserve formal holdership while shifting economic use. The more the registry insists that the market should look like the allocation era, the more the market will learn to speak in allocation-era code.
A more honest approach would define responsible leasing practices as a data-quality and accountability problem. The registry need not endorse every commercial model. It should insist that the ledger remains useful: accurate contacts, clear maintainer control, abuse reachability, RPKI consistency, sanctions compliance and known points of responsibility. It should not confuse discomfort with speculation for evidence of registry harm.
Leasing also reveals why fees and transfer rules interact. If transfer settlement is costly or slow, rental becomes more attractive. If annual fees rise, holders may lease to cover costs. If uncertainty grows, lessees may prefer short arrangements over purchases. If registry scrutiny is unpredictable, parties may choose structures designed to minimise contact with the registry. A registry that treats each issue separately misses the market system it is shaping.
Audits, ARCs and the price of fear
Audits are necessary. A registry that never checks records becomes an invitation to fraud, stale data, abandoned assignments, false contacts and hijacked resources. RIPE NCC's Assisted Registry Checks and other data-quality reviews can improve the ledger. They can help members clean up records, confirm organisational identity, secure maintainers and align operational data with reality. In a region of corporate restructuring, conflict, sanctions, mergers and old allocations, review is not optional.
The risk lies in audit culture. A data-quality check can become a threat if its triggers, evidence expectations, cure periods and consequences are unclear. Members know that the registry relationship touches resources with real value. Even if the harshest powers are rarely used, their existence shapes behaviour. Operators may over-comply, avoid corrections that could invite scrutiny, pay fees under protest, retain consultants, delay transfers or accept interpretations they might otherwise challenge. Registry risk becomes priced into market conduct.
The economic difference between audit and fear is boundary clarity. An audit asks a narrow question and offers a repair path. Fear arises when the member cannot tell whether a documentation defect, old contact, disputed corporate change or slow response might lead to resource instability. A registry that wants legitimacy should publish clear triggers, standard evidence templates, escalation stages, cure periods, continuity protections, dispute rules and appeal paths. It should separate data correction from punitive action wherever possible. It should mark uncertainty without destabilising the last verified operating state unless the risk is severe.
This is not a plea for laxity. Fraudsters exploit ambiguity. Hijackers exploit stale data. Abuse networks exploit weak accountability. But a registry can be strict without being discretionary. The stricter it is, the more it should define the lane. The most legitimate audit is boring: the member knows the question, the evidence, the deadline, the consequence and the way to challenge the finding.
Public phishing attempts that imitate RIPE NCC illustrate the point indirectly. A fake demand works only if recipients believe the real institution could produce serious consequences. The scam is not RIPE NCC's fault. Yet the fear it exploits is an institutional signal. If members cannot distinguish a routine data-quality request from a threat to resource continuity, the registry has not made its boundaries visible enough.
Audit is a ledger function when it repairs the record. It becomes gatekeeping when uncertainty itself becomes leverage.
Sanctions and the end of easy neutrality
RIPE NCC's region contains a sanctions problem that no slogan can solve. The association is based in the Netherlands and must comply with applicable law. It serves members across countries exposed to EU restrictions, conflict-related controls, banking barriers and heightened compliance scrutiny. Its IPv4 request material says requests are checked against the EU sanctions list and will not be approved if the requester or organisation is under sanctions. The 2026 Activity Plan refers to income that may be uncollectable from ultra high-risk countries and members awaiting clearance from potential sanctions matches. RIPE NCC also publishes sanctions transparency reports.
This is not optional politics. A Dutch association cannot ignore EU sanctions. The registry cannot pretend that banking and compliance risk is irrelevant. But sanctions are another place where mandate can be laundered if the institution is not precise. Compliance can become a broad vocabulary that blurs the difference between legal prohibition, banking inability, risk appetite, operational caution and geopolitical preference.
The ledger-first principle is narrow. If law forbids a service, the registry should say so as clearly as legally possible and identify the legal basis at the level compliance permits. If a bank cannot process payment, the registry should distinguish payment infrastructure from resource legitimacy. If a potential match requires review, continuity should be protected during review unless law requires suspension. If an existing member is affected by changing sanctions, the registry should publish the sequence of notice, evidence, service limitation, data preservation, appeal and restoration.
The gatekeeper temptation is to let sanctions pressure broaden institutional discretion. A registry may begin by complying with law and end by treating certain regions, owners, counterparties or transfers as inconvenient. That may be understandable risk management. It is not neutral stewardship. In a region with war, sanctions, migration and corporate restructuring, unclear compliance discretion can freeze capital movement and punish unrelated customers.
Sanctions also expose the limits of community language. A policy list cannot override EU law. A member vote cannot legitimise non-compliance. Conversely, legal compliance should not become a back door for preferences that could not survive open policy debate. RIPE NCC must keep legal compulsion, board risk management, staff procedure and community policy analytically separate.
The economic test is continuity. Does sanctions procedure remove prohibited service while preserving lawful registry accuracy for unaffected parties? Does it distinguish sanctioned persons from unsanctioned networks in the same country? Does it let buyers, sellers, lessors and customers understand when a transaction is blocked by law rather than institutional discomfort? Does it prevent the registry record from becoming a geopolitical weapon beyond what law requires?
Sanctions transparency is a useful start because it makes the problem visible. The next stage of legitimacy is procedural proportionality: the narrowest service restriction that law requires, the clearest explanation possible, and the strongest protection for accurate registry data where service delivery is constrained.
RPKI turns recognition into operational dependency
RPKI changes the registry relationship because it turns resource recognition into machine-readable routing-security authority. A holder can create Route Origin Authorisations so networks performing Route Origin Validation can distinguish expected origin announcements from invalid ones. In principle this is a substantial improvement. It reduces some classes of route hijack and misconfiguration. It gives operators a cryptographic way to tie route-origin claims to registry-recognised resources.
It also creates dependency. If the registry's record, certificate service, account access or internal procedure changes, the security status of routes can be affected. A wrong ROA can break reachability. A missing ROA can reduce protection. A certification disruption can become an operational incident. The more networks rely on RPKI, the more the registry moves from passive record-keeper to part of the trust infrastructure for routing.
RIPE NCC lists RPKI among the technical infrastructure it provides, alongside other operational services. The 2026 Activity Plan frames routing security as part of resilience. That is plausible. But RPKI intensifies the mandate problem. The registry may say it is merely providing a security tool, yet the tool rests on registry-recognised holdership and centralised service continuity. A member that fears registry discretion now fears not only database changes but routing-security consequences.
The answer is not to reject RPKI. That would be perverse. The answer is to treat it as a high-accountability function, not a soft extension of institutional authority. Certificate issuance, revocation, suspension, account recovery, ROA management, API reliability, incident disclosure and business-continuity planning should be governed with the humility of critical infrastructure. The registry should not use RPKI dependency to pull members deeper into discretionary relationships unrelated to routing security.
RPKI also shows the difference between formal and practical control. The holder owns routers, customers and services. The registry operates the recognition layer that makes a route-origin statement valid. Relying parties across the Internet may reject invalid routes based on data rooted in the registry system. A clerical dispute can acquire packet-level consequences. That is a large power for an institution whose legal and political mandate remains narrow.
The legitimacy standard should therefore be higher than ordinary service quality. RIPE NCC should be judged by whether RPKI design minimises unilateral surprises, documents failure modes, supports resilience where technically feasible, separates sanctions and billing disputes from routing-security continuity unless law compels otherwise, and gives members enough tooling to detect, correct and audit their own state. The more routing depends on registry-issued signals, the more modest the registry must be elsewhere.
Legacy resources and awkward history
Legacy resources sit uneasily in the registry order. They were allocated before today's contractual and policy architecture had hardened. They are often commercially valuable, operationally important and legally ambiguous. The registry needs accurate records and security services. Holders want continuity without feeling that historical resources are being converted into a fresh institutional dependency. Buyers want certainty. Lessors want confidence. Customers want routes that work.
This is fertile ground for mandate laundering because ambiguity can be made productive for the institution. A registry can offer clarity on condition that the holder accepts a broader relationship. Some contractual alignment may be necessary; a registry cannot provide secure services to an unknown or unreachable party. But the line should be explicit. Record integrity, contact accuracy, RPKI access, reverse DNS and dispute notation are ledger concerns. The desire to bring every legacy holder into the same fee and policy universe as modern LIRs is an institutional concern that must be defended separately.
The 2026 charging scheme's treatment of legacy holders with direct agreements as paying an annual fee equivalent to the LIR annual fee is one example of the broader issue. The charge may be reasonable if it reflects real registry costs. It is less compelling if it reflects a desire to regularise history under the association's current funding model. Legacy ambiguity should be narrowed by clear contracts and precise services, not exploited as leverage.
Legacy treatment also matters for the wider market. If legacy holders distrust the registry, records become stale and transactions become opaque. If buyers cannot understand the consequences of legacy status, prices carry a risk discount. If security services are tied to contested institutional claims, routing security suffers. The ledger-first approach is pragmatic: make the record accurate, the service reliable and the contractual boundary plain. Do not turn historical messiness into a mandate windfall.
The political economy of competence
Well-run institutions are often more vulnerable to mandate laundering than chaotic ones because their self-belief is credible. RIPE NCC can point to decades of service, careful documents, public meetings, transparency reports, a trust portal, financial disclosures, technical infrastructure and staff competence. These are genuine strengths. They also make scope expansion easier to defend. If the institution is trusted, why not let it do more? If the community is open, why not let community language settle more questions? If members vote, why not treat the budget as enough legitimacy? If the registry has security expertise, why not expand its role in trust?
The answer is that institutional quality does not eliminate incentives. A competent registry still has a budget interest. Staff still benefit from mission breadth. Active community participants still gain influence from procedural complexity. Large members still navigate the system more easily than small members. Governments still prefer a technical counterpart that can speak for a region. Markets still price uncertainty. Scarcity still turns registration into value.
The most dangerous phrase in institutional governance is "the community asked for it". It converts responsibility into diffusion. If a policy harms liquidity, the registry points to community consensus. If a budget burdens small members, the board points to member approval. If a transfer rule distorts markets, staff point to procedure. If sanctions process becomes opaque, the institution points to legal necessity. Some of these defences may be valid in particular cases. As a general habit they weaken accountability.
RIPE NCC should own the economic consequences of the procedures it operates even when those procedures originate in community policy or board-approved practice. Implementation choices matter. Evidence standards matter. Timelines matter. Interface design matters. Communication tone matters. Appeal routes matter. The boundary between policy and procedure is where much of the real power lives.
The policy-development process recognises that RIPE NCC may publish impact analysis and identify implementation concerns. That role should be used more aggressively to surface economic effects. A proposal affecting transfers, waiting-list eligibility, resource status, RPKI, audit, closure or fees should not be analysed only for administrative workload. It should be analysed for liquidity, small-operator burden, sanctions exposure, legacy-resource impact, leasing effects, due-diligence cost, regional distribution and the risk of increasing registry discretion. If the community wants to make economic policy, it should at least see the economic policy it is making.
Institutional self-belief is not corruption. It is a normal product of competence. The cure is not hostility toward RIPE NCC. It is mandate discipline.
Control surfaces
The economics of RIPE NCC are best read through control surfaces: points where a registry decision, record or service can affect the use, movement or value of number resources. The more surfaces an institution controls, the more carefully its mandate must be bounded.
Registration is the first surface. The RIPE Database is the recognised record for resources in the region. If the record is wrong, stale or disputed, market confidence falls. If it is accurate and changes are predictable, transaction costs fall. Registration is the core ledger function, but it is also the foundation of all other control.
Transfer settlement is the second. RIPE NCC does not negotiate price, but it records the change of holdership. Delay, refusal or uncertainty changes liquidity and price. Waiting-list eligibility is the third. The post-exhaustion /24 mechanism is small, but it still shapes incentives around membership, LIR accounts, timing and expectations.
Resource status is the fourth. PA, PI, legacy, assigned, allocated, sub-allocated and other classifications define what can be kept, moved, certified or relied on. These labels are technical metadata, but after scarcity they become commercial terms. Audit and data-quality review are the fifth. Evidence requests can improve accuracy or impose cost. Ambiguous audit authority raises risk premiums.
Sanctions and payment form the sixth surface. Legal compliance can block requests, interrupt billing, delay clearance or constrain services. Because RIPE NCC is embedded in EU legal and banking systems, this surface is unusually important. RPKI and routing-security status form the seventh. Certification ties registry recognition to routing decisions. Fees and closure powers form the eighth. In a scarce market, closure is not mere administration.
Policy development is the ninth surface. Mailing-list consensus and working-group discussion can change the rules governing all the other surfaces. Participation costs are uneven, so the distribution of influence matters. Institutional narrative is the tenth. Words such as stewardship, community, fairness and responsibility determine whether market participants challenge discretion or treat it as natural.
The sum matters more than any one surface. Each may have a technical explanation. Together they can form a capital-control architecture. That is the central economic risk: not a dramatic seizure of power, but the accumulation of small administrative gates until the institution governs markets while insisting that it merely records them.
What legitimate discretion should look like
RIPE NCC cannot operate with zero discretion. A registry that blindly records whatever a claimant requests would be dangerous. Fraud, hijacking, sanctions, forged mergers, stolen credentials, stale contacts, abandoned companies, court disputes and conflicting corporate documents all require judgment. The question is not discretion or no discretion. It is what kind of discretion is legitimate for a private membership registry that operates a public-like ledger for scarce resources.
Legitimate discretion is objective, narrow and reviewable. It asks whether the claimant is the recognised legal entity or authorised successor; whether the resource is within the registry's responsibility; whether the proposed update conflicts with a known dispute, lock, sanctions prohibition or court order; whether required contacts and maintainer controls are accurate; whether technical metadata can be updated safely; and whether the action preserves uniqueness and third-party reliance. It explains what evidence is needed, which rule applies, how long review should take, what happens if evidence is incomplete, and how the decision can be challenged.
Illegitimate discretion is expansive and moralised. It asks whether the registry approves of the business model, whether a market price is socially pleasing, whether a holder is making enough use in a way the institution respects, whether leasing feels too speculative, whether a region is inconvenient, whether a member is insufficiently aligned with community expectations, or whether broad institutional goals justify delaying capital movement. It may still use technical words. That is the point. Mandate laundering often sounds technical precisely when it is economic.
The policy community should therefore separate registry harms from institutional preferences. A registry harm is duplicate recognition, false authority, untraceable responsibility, routing-security confusion, illegal service, unresolved dispute, broken contactability or corrupted data. An institutional preference is discomfort with secondary markets, dislike of leasing, belief that certain members receive too much value, desire to fund broader community work, or confidence that active participants know what is best for the region. The first can justify refusal or conditions. The second should be treated cautiously and, in many cases, not embedded in registry procedure at all.
The same distinction should apply to fees. Necessary registry costs should be funded reliably. Optional or broader ecosystem activity should be justified separately, with transparent cost centres and serious consideration of voluntary, targeted or external funding. A member should be able to see how much of the annual charge funds the ledger, how much funds security, how much funds community support, how much funds external engagement, how much funds measurement and how much funds organisational overhead. If the answer is blurred, the institution is asking members to finance a mandate they cannot price.
It should also apply to sanctions and RPKI. Legal compliance must be firm, but narrow. Routing security must be resilient, but not used as institutional leverage. Audit must be real, but repair-oriented. Transfers must be documented, but not treated as permission from a moral owner of the address economy.
What to watch next
The first watchpoint is RIPE NCC's next strategy cycle. The 2026 Activity Plan says the organisation is completing the 2022-2026 strategy while preparing future efforts. Strategy is where scope tends to expand. The words will sound harmless: resilience, security, engagement, sustainability, trust, governance. Each can mean a necessary registry investment. Each can also become an umbrella for a larger compulsory budget. The next strategy should separate essential registry functions from broader institutional activity in a way members can price. Ledger accuracy, transfer settlement, RPKI continuity, sanctions procedure and data security belong at the core. Broader convening, measurement and public-policy work may be valuable, but should be costed and justified as such rather than smuggled into the registry charge.
The second watchpoint is the charging model. The flat EUR 1,800 LIR fee has administrative virtues, yet scarcity makes distributional effects more visible. Small operators will continue to ask why they pay the same base contribution as large actors with deeper policy capacity. Address-poor entrants will ask why the institution that controls their recognition also funds a wide ecosystem through a compulsory invoice. Legacy holders will ask whether regularisation is being priced as service or as institutional incorporation. The relevant question is not whether every member finds the fee intolerable. It is whether the bundle is honest.
The third watchpoint is transfer liquidity. RIPE NCC's system is not closed, but the 24-month restriction, inter-RIR compatibility demands, documentation standards, voluntary locks and sanctions reviews all affect market movement. The registry should publish enough process data for the market to distinguish fraud prevention from avoidable friction: median processing times, delay reasons, refusal categories, sanctions-match resolution times, inter-RIR blockers, treatment of M&A chains and common documentation failures. Transfer statistics show the visible market. Friction statistics would show the institutional shadow.
The fourth watchpoint is leasing. IPv4 rental will remain important because buying address space is capital-intensive and demand is uneven. RIPE NCC should avoid a moral panic that treats leasing as inherently suspicious. The right regulatory object is responsibility: accurate holder data, clear operational contacts, abuse handling, RPKI consistency, sanctions screening and traceable accountability. A registry that distinguishes responsible leasing from opaque leasing will strengthen the ledger. A registry that treats leasing as an affront to allocation-era norms will push the market into less transparent forms.
The fifth watchpoint is Assisted Registry Checks and end-user data verification. High-volume checks can materially improve the registry if bounded and repair-oriented. They can also generate fear if members see them as open-ended threats to resources. The registry should publish cure periods, evidence templates, escalation paths, continuity protections and appeal routes. Accuracy should not become a polite word for discretionary pressure.
The sixth watchpoint is sanctions procedure. The region's legal and geopolitical complexity will not disappear. Transparency reports should evolve from aggregate reporting into practical process clarity: what happens to pending requests, existing resources, RPKI, reverse DNS, billing, transfer attempts and third-party dependencies when a potential match is under review or a legal prohibition applies. The narrowest lawful restriction should be the norm. Anything broader should be called risk management, not legal necessity.
The seventh watchpoint is RPKI dependency. As route-origin validation becomes more common, RIPE NCC's security services will carry more operational consequence. RPKI continuity should be insulated, as far as law permits, from fee disputes, ordinary audits and non-security conflicts. Incident handling, revocation safeguards and member-side audit tools should be public enough that reliance is rational rather than hopeful. Routing security must not become a quiet source of institutional leverage.
The eighth watchpoint is the distinction between RIPE community consensus and affected-market consent. The policy process will remain open, but openness does not solve participation inequality. Proposals affecting capital movement should include explicit economic impact analysis, not only technical and implementation assessment. Silence on a mailing list should not be treated as consent by small operators, downstream customers, lessors, acquirers or capital providers.
The ninth watchpoint is legacy-resource treatment. Legacy resources sit between historical allocation, current registry recognition and market value. A legitimacy-minded registry should preserve accurate records and security services without using legacy updates as a back door to impose broader institutional claims than necessary. Legacy ambiguity is expensive. It should be narrowed by clear contracts and record integrity, not exploited as leverage.
The tenth watchpoint is institutional language. The words community, stewardship, fairness and responsibility should be treated as claims requiring proof, not proofs themselves. Whenever RIPE NCC uses those words to justify a rule affecting transfers, fees, audits, sanctions, leasing, closure or RPKI, the economic effect should be stated plainly. Who pays? Who waits? Who loses liquidity? Who receives discretion? Who can appeal? Who bears the downside if the registry is wrong?
RIPE NCC's safest future is not to become small for the sake of being small. It is to become exact about the authority it already has. The registry should be large where the ledger needs scale: accurate data, secure systems, resilient RPKI, reliable transfer settlement, clear documentation, sanctions precision and business continuity. It should be small where scarcity tempts it to govern markets through inherited language. In the post-exhaustion world, legitimacy will not come from repeating that the process is open or that the community has spoken. It will come from proving, decision by decision, that RIPE NCC records scarce resources more than it governs them, and that every unavoidable gate is narrow enough for the market to see, price and challenge.