Summary
- RIPE NCC's sanctions work is often described as compliance, but its economic effect is larger: a screen can touch registry entries, invoices, member status, transfer timing, address liquidity and the evidence burden carried by small network operators.
- RIPE-857, the Q2 2026 transparency report published on 1 May 2026, is the current concrete exhibit. It says RIPE NCC is a Dutch organisation bound by EU sanctions, freezes registration rather than use, bars sanctioned holders from new resources or transfers, does not deregister resources or terminate the Standard Service Agreement for members, and also checks OFAC lists because Dutch banking relationships can be affected.
- The figures show why this is a friction machine, not a simple switch. As of 7 April 2026, the report listed 2,110 total alerts, with 1,971 in a combined false-positive, exempt, not-applicable or OFAC bucket; 99 under investigation; 16 on hold; and 24 confirmed as sanctioned and applicable to RIPE NCC services.
- A freeze that preserves use is economically different from deregistration. It can be a legitimate compliance boundary, but it still affects capital value because a holder cannot acquire further resources or transfer existing ones while the entry is frozen.
- The largest institutional risk is enforcement creep: screening should protect lawful compliance, bank acceptability and registry accuracy, not become a tool for punitive disconnection, political confiscation, address capital control or broad gatekeeping over running networks.
- The sound boundary is continuity-first. RIPE NCC should be able to pause new registry acts, require evidence and protect payment channels; it should preserve the last verified registration state unless law or clear fraud requires narrower action.
Sanctions screening is a friction system, not a switch
The phrase "sanctions screening" sounds clean because it suggests a binary act. A name is checked, a list is consulted, a match is found or cleared, and the institution proceeds. That is not how the economics of RIPE NCC's sanctions work should be understood. At a regional internet registry, a screen is not merely a compliance query. It is an event in a chain of institutional reliance. It can affect whether a holder remains in good standing, whether an invoice can be paid, whether a transfer can close, whether a buyer can price a block, whether a small operator can obtain more address space, and whether counterparties regard a registration entry as clean enough to support contracts.
The important distinction is between legal necessity and institutional reach. RIPE NCC is based in the Netherlands and must obey EU sanctions. That premise is not optional. The question is what follows from it. A legal screen may properly stop a new allocation, a resource transfer, a merger update or a payment channel that would create a prohibited benefit. It may require evidence about name identity, beneficial control, corporate continuity or exemption status. It may force RIPE NCC to maintain a case as frozen or on hold until the facts are clearer. Those actions can be compatible with a thin registry duty.
But a screen can also become a broader gate. If uncertainty around a list entry is allowed to degrade existing registry access, interrupt database authority, erase operational continuity, transform payment friction into member failure, or convert address scarcity into discretionary permission over capital value, then a narrow legal duty has been turned into institutional power. The registry has moved from recording and protecting uniqueness into deciding who may continue to enjoy the practical value of a scarce input. In a post-exhaustion IPv4 market, that is not an administrative footnote. It is political economy.
RIPE NCC's own Q2 2026 sanctions transparency report, RIPE-857, makes the boundary visible. The report says the organisation freezes the registration of affected resources in the RIPE Database, not their use. It says sanctioned entities cannot acquire further resources or transfer existing ones. It also says RIPE NCC does not deregister their resources or terminate the Standard Service Agreement if they are members. These sentences are important not because they settle the policy question, but because they show that the institution already distinguishes between a frozen registry act and the continuity of a running network.
That distinction should be the centre of analysis. A freeze on new registry acts is a compliance tool. Deregistration or service degradation is an economic shock. The first can preserve bank acceptability and legal compliance while leaving the operational record intact. The second can endanger customers, upstreams, downstream users, route-security expectations and the market value of an address block. Good registry governance should be built around the difference.
This is not an argument for ignoring sanctions, nor for treating address holders as owners with unlimited rights. It is an argument for institutional modesty. The registry's strongest public duty is to preserve uniqueness, accuracy and continuity. It is not to become a landlord over the capital value created by scarce IPv4, nor a political arbiter with power to punish networks by breaking their access to registry functions. Scarcity makes the registry powerful; that is precisely why the boundary must be thin, visible and hard to stretch.
The exhibit from RIPE-857
RIPE-857 was published on 1 May 2026 and gives a status date of 7 April 2026 for the main case table. The report says there were no changes since the previous quarter. Its data are not large by the scale of the internet, but they are large enough to reveal the mechanics of screening. Total affected resources include 4,832,512 IPv4 addresses, five /32 IPv6 allocations, eighteen /29 IPv6 allocations and 47 ASNs. Those figures show that sanctions cases are not symbolic. They touch address holdings large enough to matter in network planning and in the IPv4 market.
The same report lists 2,110 total alerts for EU and OFAC investigations as of 7 April 2026. Of those, 1,971 sat in a combined category covering confirmed false positives, EU sanctions alerts that were not applicable, exemptions and OFAC cases. Another 99 were under investigation. Sixteen were on hold. Twenty-four were confirmed as sanctioned and applicable to RIPE NCC services. In plain economic terms, the system generated a large screening workload to locate a much smaller set of confirmed service-relevant cases.
That ratio matters. False positives are not harmless simply because they are later cleared. They impose search costs, correspondence costs, document costs, delay risk and sometimes commercial embarrassment. A holder may need to prove that it is not the listed party, that its local registration documents are current, that its beneficial control is not captured by a restriction, or that an apparent match is only a name collision. RIPE NCC may need to spend staff time reviewing and escalating. During that period, the report says potential matches cannot proceed with new resources or transfers until cleared. The economic burden falls before the final status is known.
The on-hold category is even more revealing. RIPE-857 says a member or End User may be treated as sanctioned if it does not cooperate or cannot provide documentation to conclude an investigation. That may be reasonable from a compliance-control perspective; an institution cannot always distinguish unwillingness from impossibility without evidence. Yet the economic result is harsh. A party can fall into a restricted posture not because it is confirmed to be sanctioned, but because it cannot satisfy the documentation burden. In jurisdictions with disrupted corporate registries, war damage, bank de-risking, language barriers, slow legal paperwork or weak notarial systems, that burden is not evenly distributed.
RIPE NCC's decision to check OFAC lists, while saying it is not obliged to comply with US sanctions, adds another layer. The report gives a practical reason: Dutch banking institutions may be affected, and that can influence invoicing and payment receipt. This is a frank and useful exhibit because it shows how the bank enters the registry. The trigger is not only public law that binds RIPE NCC directly. It is also the risk appetite of the financial rails that allow the Dutch association to bill and be paid. In a membership body, payment access and registry standing are connected.
The report therefore describes an institutional machine with several gears: EU legal duty, OFAC-related banking caution, list alerts, staff investigation, document requests, case status, freeze, on-hold handling, transfer blocking and membership continuity. Calling that machine "compliance" is true but insufficient. The better description is a friction system. It transmits pressure from public sanctions law and bank risk into the registry ledger and from the ledger into address capital value.
The freeze is narrower than deregistration, but not costless
The most important fact in RIPE-857 is the distinction between freezing registration and stopping use. A freeze that preserves use recognises a basic truth of registry economics: the database entry is not the network. Packets do not move because a Dutch association blesses every route in real time. Networks route because operators configure routers, upstreams accept announcements, customers connect, and operational trust persists. The registry entry matters because it coordinates rights, contact data, transfer records, reverse-DNS authority, route-security services and market confidence. It does not itself carry the traffic.
This is why a freeze can be a legitimate intermediate remedy. If a holder is sanctioned in a way applicable to RIPE NCC services, allowing that holder to receive more resources or transfer existing ones may create a prohibited benefit. Freezing the registry act is a way to comply without tearing apart the live network. It protects the database from being used as a channel for further acquisition or transfer while avoiding immediate damage to end customers who may have no role in the sanctions issue. In institutional terms, it is a continuity-preserving control.
Yet the freeze still has economic force. A holder that cannot transfer a block cannot monetise it through sale. A holder that cannot acquire more space may be unable to grow in the usual way. A buyer cannot treat the block as clean inventory. A lender cannot rely on the same exit path. A broker cannot close the same transaction. A merger may need extra structuring or may fail. The value of the address holding is therefore impaired even if the live routing continues. A frozen registration is not confiscation, but it is a restriction on capital mobility.
The policy challenge is to keep that impairment tied to the compliance need. A freeze should not be used as a general punishment. It should not become a substitute for formal dispute resolution, a tool for shaming a region, or an open-ended way to keep politically difficult holders from using address markets. The more valuable IPv4 becomes, the more tempting it is to treat registry control as leverage. That temptation must be resisted because the registry's authority is accepted only so long as it is understood as coordination, not ownership.
The same point applies to good standing. If sanctions review affects a holder's ability to pay fees, submit documents or complete ordinary updates, RIPE NCC needs categories that separate confirmed restriction from procedural uncertainty. A member in good standing should not become a delinquent member merely because a bank refuses a payment path or a document office cannot produce a certificate quickly. Compliance may require restrictions; it does not require a fiction that every delayed case is commercial default.
The freeze/no-use distinction also creates a communication duty. Affected holders, buyers, lenders, upstreams and downstream customers need to understand what is frozen and what is not. If the registry says use is not frozen, then the market needs to know whether reverse DNS, RPKI, maintainer access, contact updates and ordinary abuse-contact corrections remain available. Some of those functions may involve services. Some may involve data integrity. The boundary should be stated with enough precision that operational teams are not left to infer it from silence.
False positives are a governance cost
False positives are often treated as the price of a safe compliance program. That is too casual for a registry. In finance, a false-positive alert may delay a payment or require a bank customer to send documents. In a registry, a false-positive alert can halt a resource request or transfer involving address space that may support a business plan, financing schedule or customer migration. The cost is not only the time spent clearing a name. It is the option value lost during the uncertainty.
The figures in RIPE-857 show that the majority of alerts fall away from confirmed service-relevant sanctions. The combined cleared, exempt, not-applicable and OFAC bucket stood at 1,971 out of 2,110 total alerts on the 7 April 2026 status date. That does not mean screening is mistaken. A good screen is meant to catch more possible matches than final cases. But it does mean the system produces a large proof burden for parties that are not ultimately confirmed as restricted for RIPE NCC services.
The distribution of that burden matters. Name matching is not culturally neutral. Many companies and individuals share transliterations, abbreviations, patronymic forms, legacy spellings, local-script variations and post-merger names. Corporate registration data may be updated slowly. A sanctioned government entity may have a name close to a private telecom provider. A listed person may be a minority director, a former shareholder or a name match with no control. A small network may not have compliance counsel to frame the distinction quickly. The registry's screening system may be technically sound and still produce uneven friction across the service region.
The evidence burden is also asymmetric. RIPE NCC can pause action until a case is cleared. The holder must produce enough proof to satisfy the investigation. If the case concerns a transfer, the buyer may not wait. If the case concerns new resources, the customer's need may not pause. If the case concerns payment, the invoice clock may continue. Delay is a resource allocation in disguise. A large operator can buy patience; a small one often cannot.
This is why aggregate transparency should move beyond final counts. The report usefully gives case categories and totals, but the market also needs timing data: median time to clear false positives, distribution by case type, share of transfer-related alerts, share caused by OFAC billing concerns, share cleared after one document request, and share requiring external legal review. Those data can be anonymised. They would help members price the risk and help the board see whether the system is producing excessive friction.
False positives also test the fairness of communication. A holder should be told enough to understand the category of concern. A possible name collision is different from beneficial-control uncertainty. A country-related exemption question is different from a direct list match. OFAC-linked billing review is different from EU service applicability. Precision is not a courtesy. It is a way to reduce waste. If the registry gives vague reasons, holders oversupply documents, lawyers overwork the case, staff review more material, and the clearing process slows.
The registry should also preserve service while proof is gathered unless law requires otherwise. If a possible match later proves false, any avoidable disruption during the review was an institutional cost imposed on a non-restricted holder. That cost should be treated as a governance metric, not as bad luck.
Banking turns compliance into membership risk
The most economically significant sentence in RIPE-857 may be the one about OFAC. RIPE NCC says it checks OFAC lists even though it is not obliged to comply with US sanctions because Dutch banking institutions may be affected, which influences invoicing and payment receipt. This is not merely a legal note. It reveals the bank as a silent regulator of registry access.
Membership depends on a financial relationship. A member pays fees. The association invoices. Banks move funds. If a bank refuses, delays or questions payment, a registry problem can arise even where the member is not directly captured by a sanctions measure applicable to RIPE NCC services. The formal rule may be about payment; the practical cause may be correspondent-bank caution, over-compliance, internal risk scoring or the inability of a local bank to move euros through the relevant channel.
This creates a difficult classification problem. A member that refuses to pay is different from a member that is willing to pay but cannot get funds through acceptable banking rails. A member that is confirmed as sanctioned is different from a member whose payment route is blocked because a bank dislikes country risk. A member that cannot provide a document because it is evasive is different from one whose corporate registry has been disrupted. Treating all these cases as ordinary non-compliance would convert bank conservatism into registry exclusion.
RIPE NCC should therefore treat payment continuity as part of registry continuity. That does not mean accepting prohibited funds or creating legal risk. It means having documented alternatives when law permits: grace periods, payment references that satisfy bank checks, guidance on acceptable intermediaries, clear escalation, and case categories that distinguish sanctioned-status freezes from payment-channel failures. If the association cannot receive payment from a member due to bank constraints, it should not silently let the case drift into member failure without a continuity review.
The stakes are larger for small operators and operators in exposed regions. A large international group may have multiple banking relationships, subsidiaries, counsel and treasury staff. A small ISP may have one bank, a local accountant and limited English-language documentation. If that bank's correspondent line tightens, the ISP's ability to remain in good standing can depend on RIPE NCC's willingness to distinguish risk from refusal. A registry that cannot make that distinction may end up punishing the very networks most dependent on stable coordination.
Banking friction also changes bargaining power. Where members cannot pay directly, intermediaries can appear. Some may provide useful compliance and treasury support. Others may combine payment help with brokerage, leasing, sponsorship or commercial influence. The more difficult it is for a network to maintain a clean direct relationship with the registry, the more it may rely on private middlemen. That can reduce transparency and increase dependency. A registry committed to thin coordination should not accidentally create a private market in access to its own membership system.
The board should see this as a strategic risk rather than an accounting problem. How many cases involve payment-channel difficulty? How many are OFAC-linked but not EU-service-applicable? How long do such cases take? How many members move from payment friction into restriction? How many are cleared? These are not details for the billing department alone. They are indicators of whether the registry's legal base and banking relationships are creating unequal access to coordination services across the region.
Transfer finality is where scarce IPv4 value meets the screen
The most visible market effect of sanctions screening appears in transfers. Since IPv4 run-out, address demand that cannot be met through new allocation must be met through transfers, waiting-list crumbs, leasing, network redesign or IPv6 migration. For many operators, the transfer market is the only practical route to a meaningful block of IPv4. That makes registry recognition a price-forming event.
An IPv4 transfer is not economically final when the commercial contract is signed. It becomes market-final when the registry record recognises the move and counterparties can rely on the updated entry. Escrow, payment timing, representations, warranties, abuse-history checks, route-authorisation planning and customer migration all revolve around that moment. If a sanctions alert can stop the record from changing, it can stop the transaction from closing. If a potential match can delay the record, it can change the price. If a case remains on hold, it can trap capital.
This is why the statement that sanctioned entities cannot transfer existing resources is more than a compliance fact. It is a restriction on the liquidity of a scarce asset-like interest. The official doctrine may say number resources are not property. Markets can still capitalise the practical ability to use and transfer them. Banks, buyers and operators do not need metaphysical ownership to value a routable IPv4 block. They need continuity, recognition and an exit path. A freeze impairs the exit path.
The impairment is defensible when tied to law. If a transfer would provide a prohibited economic benefit to a listed entity, RIPE NCC should refuse it. But the refusal should be as narrow as the legal problem. A blocked transfer should not imply that unrelated existing customer operations must be disturbed. A blocked seller should not allow a buyer to weaponise uncertainty in a price dispute. A possible match should not freeze unrelated resources beyond what the investigation requires. A case involving one legal entity should not contaminate a corporate group without control analysis.
Transfer finality also depends on the burden of proof. Buyers will price not only the block but the risk of clearance. A block held by a company with straightforward European corporate records may trade more easily than an equivalent block held by a firm in a sanctioned-adjacent market with difficult banking and paperwork. The difference is not technical. It is institutional. The screen has created a discount.
That discount can be socially costly. If legitimate holders in exposed regions cannot sell or transfer cleanly, address space may remain underused, leased through less transparent channels or sold at distress prices to actors with better compliance capacity. Scarcity then allocates not to the highest-value network use, but to the party best able to navigate institutional friction. That is an inefficient outcome for a registry system whose public justification is accurate and fair coordination.
The registry can reduce the discount without weakening compliance. It can offer pre-clearance categories where law permits, publish transfer-screen timing metrics, explain documentation expectations, preserve service during transfer review, and give written reasons when a case is blocked or on hold. The goal is not to make every transaction succeed. It is to let parties know which risks are legal, which are evidentiary, which are payment-related and which are simply rumours.
Finality after approval matters as much as screening before approval. Once a transfer has lawfully passed the registry process, the market needs confidence that the updated record will not be treated as provisional merely because a later political concern becomes fashionable. There will be cases where fraud, binding legal action or a later sanctions designation changes the legal position. Those cases should be handled by their own facts. But the ordinary expectation should be that a completed registry update is reliable. Without that expectation, buyers will demand wider warranties, sellers will face holdbacks, brokers will lengthen escrow periods and lenders will discount address-backed cash flow. The result is a less liquid market and a higher cost of network expansion. A registry that preserves finality is not protecting traders for their own sake; it is protecting the ability of networks to convert scarce number resources into usable capacity without every transaction carrying an indefinite institutional tail risk.
The on-hold category is a pressure point
The on-hold category deserves careful scrutiny because it sits between confirmed sanctions and unresolved evidence. RIPE-857 defines it in practical terms: a member or End User is not cooperating, or cannot obtain documentation to conclude the investigation for EU sanctions, and service restrictions are in place. The category is understandable. A registry cannot close a case without proof. It cannot safely ignore a possible match merely because the holder says the match is wrong. But the category also creates the greatest risk of overreach because it can treat evidentiary failure like confirmed restriction.
The two reasons for on-hold treatment are very different. Non-cooperation is a conduct problem. Failure to obtain documentation may be a capacity problem. A holder that refuses to answer, conceals ownership or sends inconsistent records is not in the same position as a holder trapped by a closed corporate registry, a slow official records process, a war-affected notary, a sanctioned bank or a language mismatch. The remedy should reflect the difference.
An institution designed around continuity would subdivide on-hold cases. One subcategory would cover non-response after repeated notice. Another would cover incomplete but active cooperation. Another would cover document unavailability outside the holder's control. Another would cover bank-related cases. Another would cover cases where the only remaining issue is exemption proof. Such categories need not be public at name level. But they should guide treatment and aggregate reporting. Without them, on hold can become a catch-all penalty.
The problem is not only fairness to the holder. It is accuracy. A case left on hold may keep the database in a frozen state even when the holder is not actually sanctioned. That can impair transfer data, relationship records, invoices and operational updates. If the last verified state is preserved, the damage is limited. If restrictions extend too far, the registry itself becomes a source of inaccurate market signals. A counterpart may interpret on hold as guilt. A buyer may walk away. A customer may assume instability. A bank may tighten further.
On-hold handling should therefore use the minimum effective restriction. For a transfer request, pause the transfer. For a new resource request, pause the request. For a payment-channel case, preserve membership while the route is clarified if law permits. For contact-data correction, allow updates that improve accuracy unless the update would create a prohibited benefit. For route-security data, preserve existing valid authorisations unless a clear legal or security basis requires change. The registry should not degrade accuracy in the name of compliance.
This distinction is especially important because sanctions systems have no simple grace period. RIPE-857 says potential matches must be treated as sanctioned until staff can confirm otherwise. That may be an unavoidable control rule. But if the control rule is strict, the continuity rule must be equally strict. The more the registry must pause new acts, the more carefully it should preserve existing ones.
Continuity is owed to networks, not only to holders
Registry continuity is often described as a service to members. That is too narrow. A registration entry supports customers, upstream providers, downstream networks, domain operators, security teams, abuse desks, route-filter builders, auditors, lenders, insurers and public institutions that rely on connectivity. Many of these parties have no contractual relationship with RIPE NCC and no role in the sanctions issue. When a registry action disrupts a holder, the cost radiates outward.
This is the strongest reason to treat deregistration and access loss as last-resort measures. A sanctioned holder may be legally restricted; its customers may not be. A false-positive holder may be innocent; its customers are still exposed to delay. A member with a payment-channel problem may serve hospitals, schools, data centres, small businesses or households. The registry does not need to become a telecom regulator to recognise that operational continuity has public value.
The continuity principle does not require RIPE NCC to let restricted entities obtain new benefits. It requires the association to distinguish new benefit from preservation of a last verified state. If a network already uses an IPv4 block, keeping the registration visible and accurate may protect other parties from confusion. If a reverse-DNS delegation already works, abrupt removal may create failures unrelated to sanctions. If an RPKI authorisation already reflects routing reality, revocation may change route acceptance in ways that harm users beyond the legal target. Every change should be tested against the question: is this required, or is it a discretionary expansion?
This is where the thin registry concept matters. A registry's power comes from community acceptance of a shared ledger. That acceptance does not rest on the registry being able to punish. It rests on the registry being reliable when politics, markets and compliance pressure become turbulent. The more stressed the service region becomes, the more valuable a restrained registry is. A registry that refuses to turn every sanctions alert into a continuity crisis is not weak. It is doing the hardest part of institutional coordination.
Continuity also protects RIPE NCC. If the association preserves the last verified state unless law clearly requires action, it lowers its own liability and legitimacy risk. It can show banks and authorities that it is not facilitating new prohibited activity. It can show members that it is not using sanctions as a discretionary weapon. It can show markets that a frozen case does not mean sudden erasure. It can show legal reviewers that its actions are proportionate. Restraint is not only a principle; it is risk management.
The alternative is a dangerous feedback loop. More aggressive restrictions create more fear. More fear makes holders less transparent, more reliant on brokers, more likely to litigate and more willing to treat the registry as an adversary. That raises staff workload and legal risk, which can lead the registry to tighten further. The ledger then becomes less accurate precisely because the institution sought more control. A continuity-first approach breaks that loop by making cooperation safer.
Scarcity does not make the clerk a landlord
IPv4 scarcity is the economic background that gives sanctions screening its weight. If address space were abundant and easy to replace, a frozen transfer would be inconvenient but not central to enterprise value. In the actual market, IPv4 blocks can support revenue, customer density, hosting services, access networks, content delivery, cloud workloads and mergers. The registry entry is therefore connected to a scarce capital value even if the legal form avoids ordinary ownership language.
This creates a temptation for institutional expansion. Because the registry entry is valuable, the registry may be treated as if it controls the value. Because it controls recognition, it may be asked to discipline holders beyond the narrow needs of uniqueness and accuracy. Because sanctions are serious, every caution may be framed as legal necessity. Because banks are risk-averse, their concerns may be translated into broad registry restrictions. Scarcity turns a clerical function into a power centre unless the institution actively resists that movement.
The correct answer is not to deny scarcity. The market has already priced it. Operators treat addresses as valuable because they are useful and limited. Transfers, leases, broker markets and corporate due diligence exist because address holdings matter. But scarcity does not convert RIPE NCC into a landlord over address capital. Its duty is to maintain a reliable ledger and apply policy with restraint. It should not use scarcity to enlarge its discretion over who deserves to realise value from a registration.
The phrase "capital control" is useful only if handled carefully. RIPE NCC is not imposing macroeconomic controls. But when a registry can block the transfer of scarce IPv4 resources, its procedures affect capital mobility. A freeze can trap value. A false positive can delay value. An on-hold status can discount value. A bank-driven payment issue can threaten value. These effects may be unavoidable in specific cases. They should not be hidden under technical vocabulary.
Address capital is also not detached from running networks. A block's value comes partly from its scarcity and partly from its embedded use. Customers, route reputation, abuse history, routing-security data and contractual reliance shape the asset-like interest. If registry action ignores those dependencies, it can destroy more value than it protects. If it preserves continuity while limiting new prohibited acts, it reduces collateral damage.
This is the institutional-economics lens. The registry does not need to resolve the philosophical status of number resources to make good decisions. It needs to recognise three facts at once: number resources are coordinated public identifiers; holders and markets build real reliance around them; and the registry's legitimacy depends on not converting coordination into discretionary dominion. Sanctions screening should be designed around those facts.
Evidence burden and the unequal cost of being cleared
The burden of being cleared is not evenly shared. A firm headquartered in a jurisdiction with digitised corporate registries, familiar Latin-script names, stable banks and ready access to legal counsel can respond to a screening query quickly. A firm in a conflict-affected or sanctions-adjacent market may face slower documents, transliteration variance, inaccessible directors, disrupted banks, expensive translations and nervous counterparties. The registry may apply the same procedure to both. The economic impact will not be the same.
This matters because formal equality can hide substantive inequality. If every holder must provide the same class of evidence within the same timeline, the rule may appear neutral while imposing heavier costs on some regions. The issue is not whether RIPE NCC should relax legal requirements. It cannot. The issue is whether it should design evidence pathways that recognise real administrative diversity: accepted document equivalents, certified translations, staged proof, counsel attestations, direct registry-to-registry verification, and senior review where local paperwork cannot fit a Dutch banking expectation.
Such pathways would protect compliance rather than weaken it. A holder that understands acceptable evidence is more likely to provide it. Staff who can classify document gaps are less likely to waste time on irrelevant material. Banks receiving better structured information may be less likely to block payments. Buyers in the transfer market can price cases more rationally. The institution gains information.
The current transparency report gives a valuable starting point, but it does not reveal the lived cost of clearance. It does not tell readers how long false positives remain under review, how many require repeated requests, how many involve payment channels, how many involve transfers, or how many are caused by transliteration or beneficial-control ambiguity. Those are not trivial statistics. They measure the institutional drag imposed by screening.
RIPE NCC should also guard against proof burden becoming a loyalty test. A holder should not have to persuade the association that it is politically respectable, commercially favoured or aligned with a regional narrative. It should have to prove the facts relevant to the applicable sanctions and registry policy. The evidence demand should be tied to legal identity, control, service applicability, payment ability and database accuracy. Anything broader risks turning compliance into informal gatekeeping.
The phrase "good standing" is central here. Good standing should mean that the member meets defined obligations or has a recognised continuity case. It should not be lost by mere geography, by a cleared false positive, by a bank's caution, or by a document delay outside the holder's control. If good standing becomes fragile, members will treat the registry as a risk factor rather than as infrastructure. That would be bad economics and worse governance.
What a proper boundary allows
A proper boundary begins with what RIPE NCC must be allowed to do. It can and should screen against EU sanctions. It can check other lists when banking relationships make that necessary, provided the category and consequence are clear. It can freeze registration acts where services would otherwise breach a legal restriction. It can refuse new resources and transfers involving confirmed sanctioned cases applicable to its services. It can pause requests where a potential match remains unresolved. It can require evidence and place a case on hold when a holder does not cooperate or cannot produce necessary documentation. It can protect staff and banks from unlawful processing.
Those powers are real. They are enough to make compliance credible. The danger lies in stretching them beyond their rationale. A freeze on new registry acts should not become punitive disconnection. A payment-channel problem should not become an easy route to membership termination. A false positive should not become a stigma. An on-hold case should not become indefinite limbo without category, review or preservation. A blocked transfer should not become a political statement about the holder's broader legitimacy. A registry record should not be treated as a prize that the institution may reallocate by discretion.
The boundary is best stated as a continuity rule: preserve the last verified registration state unless a specific legal duty, binding order, verified fraud, security emergency or narrow policy rule requires change. Pause new benefits where necessary. Do not erase reliance unless necessary. Keep the record accurate. Allow corrections that improve accuracy. Give reasons at the level law allows. Provide confidential review. Record aggregate data. Report to the board. Separate bank-risk cases from sanctions-applicability cases. These are ordinary infrastructure-governance disciplines, not radical demands.
Transfer records need a related principle: preserve uniqueness and accuracy, not permission theatre. A transfer check should confirm that the parties, resources and legal conditions satisfy policy and law. It should not become an open-ended review of whether the registry likes the commercial purpose of the transaction, the holder's region or the buyer's business model. If the transaction is blocked, the reason should identify the binding category. If it is delayed, the expected evidence path should be clear. If it is cleared, the record should be final enough for the market to rely on.
The same boundary should apply to customers. The registry should ask whether an action will harm third parties that are not legally targeted. If the harm is avoidable, avoid it. If the harm is required, explain the basis as far as law permits. If the harm arises from internal process rather than legal duty, redesign the process. Continuity is not sentiment; it is the economic function of a shared registry.
This boundary also limits political pressure. Governments, banks, media campaigns, litigants and commercial rivals may all prefer broader action in particular cases. A thin registry can answer each with the same discipline: the ledger will comply with law, preserve accuracy, protect continuity and avoid discretionary punishment. That is how it remains trusted across a service region that is politically diverse and economically uneven.
Metrics would make the line visible
The line between compliance and gatekeeping is difficult to judge from principles alone. It needs metrics. RIPE NCC has already taken a useful step by publishing quarterly sanctions transparency data. The next step is to make the economic friction visible without revealing confidential case names. A mature report would show not only how many cases exist, but how the screening system affects time, transactions and continuity.
The most useful metric is clearance time. How long does it take to clear a false positive? What is the median? What is the 90th percentile? How many cases remain under investigation for more than 30, 60 or 90 days? A false positive cleared in two days is a nuisance. A false positive cleared after three months can break a transaction. Time converts compliance into cost.
The second metric is case type. Alerts should be classified by transfer, new-resource request, merger or acquisition, billing, existing member review, legacy-resource matter, End User matter, RPKI-related service, reverse-DNS issue, and ordinary data update. A registry can report these in aggregate. Members need to know where friction concentrates. If most cases are billing-related, the solution may lie in payment design. If many relate to transfers, the market needs better pre-deal guidance. If existing operations are frequently affected, the continuity rule needs review.
The third metric is status movement. How many under-investigation cases become false positives? How many become on hold? How many on-hold cases are later cleared? How many stay on hold over multiple quarters? How many confirmed frozen cases are later unfrozen? These movements show whether on hold is a temporary evidence category or a semi-permanent restriction. They also show whether the system is learning.
The fourth metric is service effect. Does a case pause only new resources and transfers, or does it affect portal access, database updates, RPKI, reverse DNS, billing, or support? Aggregate reporting on service effect would make the continuity boundary visible. It would also reassure the market that most cases do not threaten live networks, if that is true. If it is not true, members should know.
The fifth metric is banking friction. How many OFAC-related or bank-risk cases affect invoicing or payment? How many are resolved through alternative channels? How many result in delayed good standing? How many are unrelated to EU service applicability? Since RIPE-857 explicitly connects OFAC checks to Dutch banking institutions, this should be part of the transparency regime. The bank is already in the system; the members should see its footprint.
The sixth metric is evidence burden. How many cases require one request, two requests, certified translation, beneficial-control proof, external counsel review or local corporate registry validation? Again, no names are needed. The point is to measure the cost imposed by proof. If evidence burdens are rising, the board can decide whether clearer guidance or better intake would reduce waste.
Metrics are not a substitute for judgment. They are a check on institutional self-narration. Without them, the association can say it is compliant and restrained, while affected holders experience something very different. With them, members can see whether the registry is a thin ledger under legal constraint or an expanding gate.
The next risk is quiet institutional drift
The danger for RIPE NCC is not likely to arrive as a dramatic announcement that the registry is changing its nature. It is more likely to arrive through quiet drift: a few more list checks, a few longer investigations, more bank caution, a broader interpretation of service applicability, more on-hold cases, less tolerance for missing documents, more reluctance to approve transfers, and more staff discretion hidden inside legal language. Each step may be defensible. Together they can change the economics of the registry.
Quiet drift is hard to resist because every case has a risk story. If RIPE NCC clears too quickly, a prohibited party may benefit. If it accepts too little documentation, a bank may raise concern. If it preserves too much service, critics may say it is weak. If it reports too much detail, confidentiality may suffer. If it refuses too much, holders may litigate. The safe bureaucratic choice is often to delay, restrict and ask for more proof. But what is safe for the file may be costly for the market.
This is why the board and membership must treat sanctions screening as a core governance topic, not a specialist legal appendix. It affects fee collection, transfer liquidity, address-market confidence, small-operator survival, regional equality and the reputation of the RIPE Database as a stable ledger. The association's legitimacy depends on being able to show that it can obey the law without becoming a discretionary capital gate.
The wider region makes this harder. The RIPE NCC service region includes economies with different relationships to EU policy, different banking access and different legal infrastructure. A Dutch legal base gives the association clarity of venue but also imports European compliance pressure into a diverse network region. The association cannot make that tension disappear. It can only govern it openly and narrowly.
The ideal outcome is not a sanctions-free registry. That would be fantasy. The ideal outcome is a registry whose sanctions practice is boring in the best sense: clear categories, fast false-positive clearing, preserved existing records, limited freezes, documented payment-continuity options, final transfer records where lawful, and aggregate data that let members see the line between legal compliance and institutional expansion. Boring infrastructure is valuable because users can plan around it.
A continuity economics test
The final test is simple. When RIPE NCC faces a sanctions-related case, the first question should be: what is the minimum action needed to comply while preserving the accuracy and continuity of the registry? That question does not predetermine the answer. In a confirmed applicable sanctions case, new resources and transfers may have to stop. In a payment case, alternative channels may have to be assessed. In a false-positive case, action should be cleared quickly. In an on-hold case, the missing evidence should be classified and service restrictions kept as narrow as possible. In every case, the last verified state should be treated as a continuity baseline.
This test fits the economics of internet numbers. The value of the registry is not that it can make networks disappear. The value is that it keeps a unique, reliable and trusted record across a fragmented world. Scarce IPv4 has made that record financially important. Sanctions have made it legally sensitive. Banking has made it operationally fragile. Those pressures increase the need for restraint.
RIPE-857 shows a system that already contains both good instincts and hard risks. The good instinct is the decision to freeze registration rather than use, and to avoid deregistration or SSA termination for members as the default consequence of confirmed applicable sanctions. The hard risk is the scale of false positives, the proof burden in on-hold cases, the explicit role of OFAC-related banking caution, and the effect of freezes on scarce-resource transferability. The report is therefore not a comfort document. It is a map of institutional friction.
The policy line should be drawn with care. RIPE NCC should screen, pause, ask and document. It should not punish by disconnection, convert bank de-risking into member expulsion, treat evidence gaps as guilt without review, or use address scarcity to become a landlord over registry capital. It should preserve running-network and customer continuity unless a specific binding reason says otherwise. It should make transfer records final when lawful, because markets depend on finality. It should measure the cost of its own screening, because unmeasured friction becomes invisible power.
The old idea of the regional registry as a neutral coordinator is not obsolete. It is more important under stress. Neutrality does not mean indifference to law; it means disciplined compliance that does not expand into politics by other means. RIPE NCC's sanctions screening will be judged not by whether it can recite its obligations, but by whether it can keep the ledger trustworthy while the world around the ledger becomes more hostile to trust.
That is the economics of sanctions screening and continuity. The screen may begin as a name match. By the time it reaches the network, it has become a test of institutional character.