RIPE NCC and the economics of small ISP entry barriers

Summary

• The small ISP entry barrier in the RIPE NCC service region is not a dramatic licensing wall. It is a stack of fixed costs that arrives before a new access provider has subscribers, cash flow, staff redundancy or market reputation.
• A new entrant with fibre or wireless coverage plans still has to assemble legal proof, number-resource rationale, ASN identity, routing evidence, IPv4 purchase or lease capacity, IPv6 transition skill, RPKI and ROA practice, abuse contact reachability, reverse-DNS service, payment reliability and a credible operating story for upstreams and customers.
• RIPE NCC is not an entry regulator, telecom licensing body, investment judge or protector of incumbents. Its official role is closer to ledger and service infrastructure: it distributes Internet number resources to members, supports management tools, keeps registration data, processes transfers, enables related services and applies policy and legal checks.
• The problem is economic incidence. Requirements that are sensible for uniqueness, fraud resistance, security and data quality behave like fixed proof costs. Incumbents spread those costs across established revenue. Small providers must pay them while demand is still prospective.
• IPv4 scarcity is the strongest amplifier. The official IPv4 pool is exhausted; eligible members can normally seek only a single /24 from recovered space through the waiting list. Anything larger or faster usually pushes the entrant toward purchase, lease, acquisition, address sharing or an IPv6-first plan that the market may not yet reward.
• Registry fees are modest only after scale exists. The 2026 RIPE NCC charging model keeps an annual EUR 1,800 contribution per LIR account, a EUR 1,000 sign-up fee and additional charges for specified independent resources and ASN assignments. For a carrier those are line items. For a start-up ISP they are part of launch capital.
• The membership and sponsoring paths each solve one problem and create another. Membership gives direct standing and portal access, but adds fixed cost and verification. Sponsorship can lower entry friction for independent resources, but it adds counterparty dependence that a new ISP must explain to upstreams, banks and customers.
• RPKI, ROAs, reverse DNS, abuse contacts and routing records are not the main story by themselves. Here they are components in an entry-cost stack: each is a credential that helps a small ISP look durable, and each requires knowledge, process and attention before the network has the scale to fund specialist staff.
• A narrow, reliable ledger helps entry by making proof predictable. A discretionary or opaque service layer raises entry costs even if no one intended to exclude newcomers.
• The policy test is practical: RIPE NCC should keep evidence strict and fraud controls strong while publishing clearer launch-path guidance, timing expectations, entry-sensitive fee transparency, status categories, small-team examples, and continuity rules that let legitimate new providers prove themselves without turning the registry into a commercial gate.

The launch desk is already full before the first subscriber

The entry problem is easiest to see at a new-entrant launch desk. A small access provider has a coverage map, a fibre ring under negotiation, a wireless overlay for difficult streets, upstream quotes, a cabinet plan, a small operations team, a local sales pipeline and enough demand to justify the first build. The founders can point to apartment blocks, business parks and public institutions that want an alternative supplier. The hardware list is not mysterious. The early customers are not imaginary. The economic problem begins when the network has to become legible to the rest of the Internet.

Before it can look durable, the new provider must assemble a thick file. It needs a legal entity that can pass verification. It needs an ASN or a credible path to one, because a network that depends entirely on upstream identity looks less independent to sophisticated counterparties. It needs an IPv4 strategy even if its engineering preference is IPv6-first, because customers, platforms, premises equipment, legacy services and enterprise security habits still impose IPv4 demand. It needs to know whether it will join RIPE NCC as a member, use a sponsoring LIR for independent resources, lease addresses, buy addresses, acquire a small holder, or launch with a compressed allocation plan and rapid IPv6 deployment. It needs a plan for RPKI and ROAs so its routes are not treated as casual claims. It needs reverse-DNS service, abuse contact reachability, routing records, billing contacts, document storage, authority signatures, and staff who know what each of those items means.

None of this is unreasonable in isolation. Public numbers must be unique. Fraudulent transfer claims must be blocked. Legal authority must be checked. Abuse mail must reach someone. Routing security has to be more than theatre. Reverse DNS can matter for mail, logs and operational hygiene. But the fixed-cost nature of the stack is decisive. A national incumbent can keep a registry team, counsel, accountants, security engineers and network policy staff. A new ISP may have three engineers, a founder handling finance, a part-time lawyer and an installer who also answers weekend support calls.

The entrant's board file therefore looks unlike the board file of a normal retailer or software reseller. It is not enough to show market demand and unit economics. The file must show that the network can obtain and preserve the identity credentials that upstreams, peers, customers, banks and cloud platforms expect. It must show that IPv4 will not become a launch bottleneck, that IPv6 will not remain a slide, that abuse complaints will not disappear, that routes will not look suspicious, that reverse naming can be maintained, that payments to the registry can be made reliably, and that the provider has a route to scale without being trapped by number scarcity.

This is why small ISP entry should be analysed as institutional economics, not as a morality play about whether RIPE NCC is friendly or hostile. RIPE NCC is not telling the entrant where to build, whom to serve, what retail price to charge or whether its wireless plan is sensible. It is not a telecom licensing body or an investment committee. Yet its record and services sit in the launch file because other market actors rely on them. The registry layer is the place where a new network proves that its claim to identifiers, contacts and route authority is more than aspiration.

That proof has a price. It consumes cash before revenue. It consumes managerial attention before the first outage. It requires scarce technical judgement before the first hire can be fully specialised. It also shapes credibility. A provider that can produce a clean registry file appears more bankable and more reliable than one whose founders say they will fix "the IP stuff" later. In a scarce-address economy, that difference can determine whether the provider launches as a durable network or as a fragile reseller waiting for its first constraint.

The official role is narrow, but the market reliance is broad

The narrow official baseline matters because it prevents a false argument. RIPE NCC does not formally decide who may become an ISP in the service region. It does not award telecom concessions, guarantee customer service, police retail contracts, set IPv4 market prices, decide which investors deserve entry, or protect large members from competition. Its public materials describe a more limited function. The Manage IPs and ASNs page says RIPE NCC distributes Internet number resources to its members and provides tools to help them manage allocations and assignments. The membership page says an organisation needing IPv6 address space and AS Numbers, or making assignments to End Users or customers, should become a member; it also notes that eligible members can normally request a single /24 via the IPv4 waiting list and that an organisation needing IPv6 or an AS Number can sometimes obtain independent resources via a sponsoring LIR.

That official role sounds administrative. In a launch case it becomes market infrastructure. Upstreams want to know whether the entrant's routes are connected to recognised resources and a real legal entity. Banks and investors want to know whether address needs are funded or at least honestly scoped. Enterprise customers want to know whether the new ISP can keep service identity stable. Security teams want usable abuse contact information. Cloud and content platforms may look at route origin, prefix reputation and contact data before deciding how to treat traffic. The registry does not command those private decisions, but its record feeds the confidence environment in which those decisions are made.

This gap between narrow mandate and broad reliance is the core of the entry-barrier problem. The registry acts within a bounded remit, yet the market turns registry facts into commercial evidence. When those facts are easy to assemble, the entrant looks less risky. When they are hard to assemble, the entrant pays a credibility discount. The discount may appear as a higher upstream deposit, a smaller credit line, a more conservative supplier contract, slower customer procurement, larger address-lease collateral, or a requirement that the entrant use an established sponsor rather than act directly.

The difference is not simply competence. A new ISP may be technically strong and still struggle with registry proof because the work is front-loaded. It must understand documentation, corporate authority, membership or sponsorship, transfer restrictions, IPv4 scarcity, ROA timing, reverse delegation, abuse mail, billing processes and route hygiene before it has the internal division of labour that mature operators enjoy. A founder who spends a week cleaning the launch file is not spending that week selling, installing, training support staff or negotiating power and space.

This is the sense in which registry-layer requirements can be pro-competitive in design and anti-entry in effect. The requirements protect uniqueness and trust. They also raise fixed costs. In most markets, fixed costs are the friend of incumbency. They are not always intended to exclude. They simply reward firms large enough to treat them as overhead. RIPE NCC can be a neutral ledger and still sit in a cost structure that favours established operators. The institutional question is how much of that cost is unavoidable proof and how much is procedural opacity that could be reduced without weakening the ledger.

The answer should not be a demand for weaker checks. A registry that approves weak claims would damage entrants by making number resources less trustworthy. The better answer is predictability. A small ISP should know what proof is needed, which path fits its plan, how long each class of request normally takes, what fees are due, what mistakes are common, how sponsorship changes control, how IPv4 transfer limits affect growth, and which operational services must be ready by launch. Predictability lowers the fixed cost while preserving the standard.

Scarcity turns address strategy into start-up finance

IPv4 scarcity is the strongest economic amplifier because it converts a technical plan into a financing problem. The RIPE NCC IPv4 run-out page records the sequence plainly: after the final /8 stage, each LIR could receive one /22; after no more /22 prefixes remained, smaller prefixes could be used; after exhaustion on 25 November 2019, LIRs could enter a waiting list to receive one /24 from future returned addresses. A /24 can be useful and, in many contexts, operationally important. It is not a growth pool for a provider expecting to serve a material access footprint.

For the small entrant, that changes the launch model. It cannot assume that the registry will supply the IPv4 needed for an ordinary commercial plan. It must choose among imperfect strategies. It can buy IPv4, but that requires capital, diligence, transfer timing and confidence that the block will be clean enough to use. It can lease IPv4, but leasing adds counterparty risk, reputation risk and contract renewal risk. It can acquire a small provider partly for its address holdings, but that turns network expansion into M&A diligence. It can rely heavily on CGNAT and IPv6, but that adds logging burden, troubleshooting complexity and possible customer resistance. It can start with a small footprint and defer growth, but delay can surrender the local market to incumbents.

The financing effect arrives before the first subscriber pays. Address purchase ties up capital that could have funded fibre drops, radios, routers, installation vans or customer acquisition. Address leasing lowers upfront spend but adds recurring cost and uncertainty. CGNAT equipment and logging systems cost money and staff time. IPv6 transition work is necessary, but it does not eliminate the need to serve customers and counterparties that still behave as if IPv4 is normal. Even a clean wait-list path gives a minimal unit, not a business plan.

This is not a complaint that RIPE NCC should recreate abundance. It cannot. Scarcity is a global historical fact, and administrative nostalgia will not produce millions of clean IPv4 addresses. The relevant question is how the registry layer affects the cost of adapting to scarcity. If transfer paths are predictable, due-diligence expectations are clear and status categories are understandable, the entrant can price purchase or lease decisions. If the path is uncertain, the entrant must buy insurance through lawyers, brokers, larger deposits or conservative launch scope.

Scarcity also changes investor scrutiny. A lender or equity backer will ask how many customers can be served per address, whether the provider has a credible IPv6 plan, whether leased ranges are stable, whether purchased ranges are transferable, whether ROAs can be set, whether reverse naming can be maintained and whether abuse history might harm early reputation. A founder may see these as technical details. A financier sees them as risk items. The registry record and related services become part of the credit file.

Incumbents approach the same questions from a different starting point. They often hold historical address space, maintain address-management staff, know brokers, keep legal templates and have enough cash to buy ahead. They can experiment with IPv6 and CGNAT while holding legacy capacity. The entrant, by contrast, must decide under constraint. Each address decision affects launch capital, perceived reliability and future option value.

That is why IPv4 scarcity should be discussed as pre-entry economics rather than only as an operational constraint after launch. By the time a small ISP announces service, many entry barriers have already been paid: the consultancy call, the transfer review, the lease agreement, the CGNAT design, the IPv6 training, the reverse-DNS plan, the ROA playbook, the address-reputation check, and the investor explanation. The public sees a new provider. The board sees a proof stack financed before revenue.

Fees are modest only after scale exists

The RIPE NCC fee schedule is not, by itself, a large line item for a substantial network. The Charging Scheme 2026 keeps the annual contribution at EUR 1,800 per LIR account, continues a EUR 75 charge for specified independent Internet number resource assignments, continues a EUR 50 charge for specified ASN assignments, and lists a EUR 1,000 sign-up fee. The Billing Procedure 2026 describes invoices, billing contacts, payment methods, non-payment consequences and a halt to new or ongoing requests if payment is not received within 60 days from invoice date.

Those figures and rules are understandable. A registry requires funding. Records, security, support, transfer processing, legal compliance, systems and member services are not free. Payment reliability matters because a membership association cannot run on vague promises. Yet fixed fees should be read through the entrant's balance sheet. For a mature operator, EUR 1,800 is a routine annual cost. For a small ISP that has not yet activated customers, it sits beside incorporation fees, engineering design, tower access, duct rental, hardware deposits, upstream setup, insurance, professional services, address leasing or purchase and early payroll.

The fee's economic incidence is therefore temporal. It arrives before scale. It arrives when the provider's fixed costs are highest and revenue is least certain. It is also bundled with proof costs that do not appear on the RIPE NCC invoice: staff time, legal documents, evidence preparation, payment setup, corporate authority records and operational readiness. The registry fee may be small; the launch package around it is not.

Payment reliability has a credibility function as well. A new ISP must show that it can pay invoices, keep billing contacts current and avoid administrative interruption. That sounds simple until the provider operates across banking frictions, currency movement, new-company controls, sanctions screening anxieties or local finance constraints. A provider that cannot demonstrate boring payment discipline will look fragile to upstreams and customers even if its network design is sound.

For a large incumbent, such discipline is invisible. The finance department pays. The registry contact list is maintained. If one person leaves, another knows the process. A small entrant may rely on one founder and one finance assistant. If the founder is travelling, the bank flags an international payment or a PDF invoice goes to a stale address, a routine invoice can become a launch-risk distraction. The formal rule is equal. The operational burden is unequal.

This does not mean fees should be waived casually. Free access can create perverse incentives, multiple speculative accounts and weak cost discipline. The better approach is entry-sensitive transparency. A new provider should be able to see, in plain language, the cash sequence it must prepare: sign-up fee, annual contribution, additional charges where relevant, billing calendar, payment references, consequences of delay, cure route, relationship between payment state and resource requests, and the difference between membership and sponsorship costs. The simpler the cash map, the less capital is wasted on uncertainty.

Fee transparency should also separate the essential ledger from wider institutional scope. Small entrants are likely to value accurate registration, portal access, transfers, RPKI, reverse DNS, support and registry security. They may value training, measurement and community services too, but those are not all equally urgent at launch. The more clearly RIPE NCC explains what portion of the compulsory relationship supports the core ledger and related operational services, the easier it is for small providers to defend the fee to investors and boards.

The practical point is modest. The fee level is not the main barrier. The combination of timing, fixed incidence, proof work and cash discipline is. A policy discussion that looks only at the nominal annual amount will miss how entry costs accumulate before the first invoice can be amortised across customers.

Proof is not hostile, but proof has a fixed cost

The membership path makes the proof issue explicit. RIPE NCC says that after receiving an application it performs checks according to due-diligence procedures; an applicant cannot become a member if a prior membership was terminated for fraudulent or misleading information within the relevant period or if the person or organisation is subject to EU sanctions; after document verification it sends the Standard Service Agreement and invoice; the account is activated after payment and signed documents are received. Those are ordinary safeguards for a registry that maintains globally relevant records.

For the entrant, however, proof is labour. A new company must show legal existence, authority to sign, accurate contacts and payment capability. If it later buys or receives resources, the in-region transfer page says transfer requests can be submitted only by the offering LIR or sponsoring LIR of the offering End User; documents are required for each party; authority to sign must be shown; the request is evaluated under applicable policy and procedure; EU sanctions checks apply; and transfers are free of RIPE NCC charge. The transfer fee may be zero, yet the documentary work is not.

This proof is not bureaucratic decoration. Without it, the market would face false claims, hijacked accounts, forged transfers and unstable records. A small ISP is harmed by weak proof because its own acquired addresses, ASN identity or customer promises would become less credible. The question is not whether proof should exist. It is whether the proof path is legible enough for a small team to perform without buying excessive intermediation.

Legibility matters because a proof request has different meanings. It may be routine data hygiene, authority verification, sanctions screening, incomplete paperwork, transfer restriction, payment issue, suspected misrepresentation or a serious dispute. A mature operator can parse those categories through experience. A new entrant often cannot. If every request feels existential, the entrant overreacts, delays, hires counsel too early, or avoids the official path. If categories are clear, the entrant can cure defects quickly.

Proof costs are also jurisdictional without being a rural, island or income story. Corporate extracts, notarisation practices, translations, director records, beneficial ownership evidence and bank payment norms differ across the service region. The same sentence - provide a recent registration document - can be a ten-minute task in one country and a multi-day exercise in another. Uniform standards remain necessary. But uniform standards do not require blind process design. Examples, checklists, accepted document types and early completeness checks can reduce friction while keeping the evidentiary threshold intact.

The strongest proof design is staged. At launch, a small ISP should be able to know what is needed for membership or sponsorship, what is needed for ASN assignment, what is needed for IPv6, what would be needed for an IPv4 transfer, what payment facts must be ready, and what records must be maintained after activation. Later, if the provider buys addresses or enters a merger, the evidence file deepens. Staging prevents the entrant from treating every future requirement as a launch blocker while still warning it about the costs of future growth.

The market will reward providers that build this discipline early. Clean legal records, clear authority, correct contacts and documented resource plans reduce upstream risk. They also help when the provider later seeks debt, sells a minority stake, acquires a neighbouring network, or leases additional space. Registry proof becomes corporate infrastructure. The earlier it is treated as such, the lower the chance that a promising network becomes fragile because its first growth event exposes a messy file.

A routing identity is a market credential

Small ISPs do not seek an ASN for vanity. They seek routing identity because counterparties need to understand who is originating routes, how the network is engineered and whether the provider can act independently of a single upstream. A provider that uses only provider-assigned addressing and upstream identity may still sell service. But it looks different from a network with its own recognised routing presence, resource plan and route-security practice. The difference can matter to business customers, wholesale partners, peering venues and investors.

The registry layer enters this market credential through AS Number assignment, route-related data and the broader trust environment around BGP. RIPE NCC materials treat ASNs as part of the Internet number-resource system that members and qualifying users can request or sponsor. The details differ by resource type and path, but the entrant's economic question is consistent: can it obtain a routing identity that matches its business plan without creating hidden future dependence?

RPKI is part of that credential stack. RIPE NCC's RPKI material describes a system in which eligible holders can use certificates and Route Origin Authorisations to make verifiable statements about which AS may originate routes for their resources. For the new provider, this is not just a security checkbox. It is a signal to upstreams and peers that the provider understands modern route-origin hygiene. It can reduce suspicion around a new origin, especially if the provider is using leased or recently acquired space.

But route-security readiness is itself a fixed cost. Someone must know how ROAs work, which prefixes will be announced, what maximum length is safe, what happens during a provider change, how to avoid accidental invalid routes, how to monitor validation state and how to coordinate with leased-space counterparties or sponsors. A large operator has a routing-security function. A start-up ISP may have a network engineer who learned the process while also configuring access equipment and customer VLANs.

Reverse DNS is another credential, though a quieter one. RIPE NCC's reverse delegation page explains that reverse DNS delegations allow mapping from IP addresses to domain names, that IANA delegates corresponding reverse zones to RIPE NCC for IP blocks allocated to it, and that the RIPE Database is used as the management database for producing those zones. A new ISP does not need a grand theory of reverse DNS. It needs to avoid looking careless. Mail systems, logs, security teams and customers can notice poor reverse naming.

Abuse contact reachability belongs in the same stack. RIPE NCC's abuse-c information explains that the policy implementation began in 2013 to help end users find abuse contact information and provide a consistent place in the RIPE Database for that information. A new ISP with a reachable abuse path looks more durable than one whose contact trail ends in a founder's overloaded inbox. Again, the requirement is sensible. Again, it costs attention.

The entry barrier is therefore not one routing-security rule, one reverse-DNS task or one abuse-mailbox update. It is the accumulation of small credentials that must be right before the provider has scale. The new ISP has to look like a real network on day one. Incumbents acquired that look over years. The entrant must buy or build it upfront.

IPv6 reduces the ration, not the launch burden

IPv6 is the honest long-term answer to address scarcity, but it is not a magic entry subsidy. A small ISP can and should design for IPv6 from the beginning. It can request appropriate IPv6 resources, train staff, configure access networks, support customer equipment, make monitoring dual-stack aware and avoid building a business whose only growth path is IPv4 compression. In that sense, IPv6 is a pro-entry technology. It gives the entrant a way to scale address identity without buying every unit of growth in the IPv4 market.

Yet IPv6 does not remove the pre-entry proof stack. The provider still needs legal verification, membership or sponsorship, ASN strategy, routing identity, contact data, RPKI practice, reverse-DNS thinking, payment discipline and customer credibility. It also needs to persuade customers and counterparties that IPv6 readiness is operational rather than rhetorical. A network can be IPv6-capable and still lose business if customers require IPv4, equipment is uneven, enterprise security files assume IPv4, or service desks are unprepared for dual-stack troubleshooting.

The economics are therefore transitional. IPv6 reduces the physical ration of addresses. It does not eliminate the market's attachment to IPv4, nor does it eliminate the credibility work that surrounds registry identity. A small ISP may present itself as modern by defaulting to IPv6, but it still needs a credible IPv4 story: how many public IPv4 addresses it controls, whether it uses CGNAT, how it logs shared addresses, how business customers obtain public addresses, whether leased space can be routed with clean ROAs, and how growth is funded.

The transitional burden can be heavier for entrants because they cannot depend on old reserves. An incumbent can run dual-stack while maintaining historical IPv4 capacity. A new ISP must make hard choices immediately: buy less IPv4 and invest more in IPv6; lease space and carry recurring risk; use CGNAT and accept support complexity; or target customer segments that tolerate IPv6-first service. Each strategy is viable in some context. None is free.

This is where registry guidance can lower entry cost without making product decisions. RIPE NCC should not tell a provider whether to use CGNAT, how to price public IPv4, or which customer segment to pursue. It can, however, make the launch path clearer: how IPv6 resources can be obtained, how ASN and IPv6 requests interact, what sponsorship can and cannot do, how ROAs should be handled in common start-up patterns, how reverse DNS differs across IPv4 and IPv6, and what evidence a new network should have ready before it approaches upstreams.

The best IPv6 entry support would be practical rather than promotional. New providers do not need slogans about the future of the Internet. They need deployable checklists, sample launch timelines, risk notes for leased IPv4 with IPv6-first access, guidance on dual-stack monitoring, and clear explanations of which registry tasks should be finished before customer activation. Training has value when it reduces fixed cost, not when it adds another institutional obligation.

IPv6 also changes credibility over time. A provider that can show high IPv6 capability, strong route-origin practice and disciplined customer support may need less IPv4 per unit of revenue than a legacy-style entrant. That can be a competitive advantage. But it becomes an advantage only if the market believes the provider can operate reliably. Registry proof, again, is part of how that belief forms.

The sponsoring path lowers one barrier and creates another

Sponsoring LIR arrangements can lower entry friction for some providers and users because they avoid requiring every independent-resource holder to become a full RIPE NCC member. The membership page notes that an organisation needing IPv6 address space or an AS Number does not necessarily need to become a member and can get independent resources via a sponsoring LIR. The in-region transfer page also shows that End User transfers may involve sponsoring LIRs. This is an important flexibility. It can let a smaller actor obtain a resource relationship through an established intermediary.

But sponsorship changes the entry file rather than eliminating it. A new ISP using a sponsor must explain the relationship to itself and to counterparties. Who can submit which request? Who maintains which records? What happens if the sponsor changes terms, exits the business, is slow to respond or has a dispute? How will abuse contact updates work? How will RPKI and reverse DNS be handled? Can the provider move to direct membership later? What costs and timing would that move carry? A sponsor can reduce fixed institutional cost, but it adds counterparty dependence.

For a small provider, that dependence can be rational. Direct membership may be too expensive or too early for a limited launch. A sponsor may have the experience to prevent errors. It may already know the paperwork, portal steps and common pitfalls. The sponsor can convert confusing registry tasks into a service. That is pro-entry when the sponsor is transparent, responsive and aligned with the entrant's growth path.

The same structure can become restrictive if the entrant does not understand it. A provider may discover that the sponsor's response time is part of its own customer promise. It may find that an urgent update must wait behind the sponsor's queue. It may rely on the sponsor's contact hygiene and payment state. It may be less able to prove direct control to an upstream, lender or enterprise customer. It may face switching costs if the sponsor relationship becomes poor.

This is not an argument against sponsorship. It is an argument for making the sponsorship economics explicit. A launch guide for small ISPs should compare direct membership, sponsored independent resources, leased IPv4, purchased IPv4 and upstream-assigned addressing in terms of cash cost, proof cost, control, route-security management, reverse-DNS handling, transfer flexibility, customer credibility and exit path. That comparison would not tell the entrant which model to choose. It would make the tradeoffs visible.

Visibility matters because entrants are prone to underpricing governance dependence. They budget routers and radios because the invoices are obvious. They underbudget account authority, legal records, contact updates and sponsor responsiveness because those costs appear later. By then the provider may already have customers and a public reputation. The cheap launch path can become an expensive growth path.

RIPE NCC's role should remain narrow. It should not rate sponsors, police commercial terms or adjudicate ordinary service disputes. But it can publish clear descriptions of what sponsorship means and where control sits. It can make request responsibilities and common failure modes plain. It can ensure that the registry-facing duties do not become a fog in which new providers misunderstand their own dependence.

Credibility is assembled from small reliable signals

Small ISP entry is a credibility formation problem. Customers may want an alternative provider, but they also fear being stranded by a thinly staffed network. Upstreams may want new business, but they dislike routes that look poorly documented. Building owners may welcome competition, but they require insurance, support contacts and implementation confidence. Investors may like local demand, but they need assurance that scarce resources will not trap growth. Registry-layer facts contribute to each judgment.

The signals are often mundane. The legal name matches public records. Billing contacts are current. Abuse mail is monitored. The ASN plan is coherent. Prefixes are registered and announced as expected. ROAs match the route plan. Reverse DNS is not neglected. The IPv4 strategy is honest. IPv6 is deployed rather than merely promised. The provider can explain membership or sponsorship. The founder knows what happens if a payment is late, a route changes, a leased block is withdrawn or a transfer takes longer than expected.

No single signal proves durability. Together they create confidence. They tell counterparties that the entrant understands the difference between selling bandwidth and operating a network. They also reduce the fear that a new provider will externalise costs onto upstreams, customers or the wider routing system. The registry layer is not the whole due-diligence file, but it is one of the few parts that can be checked outside a sales pitch.

This has distributional consequences. A provider backed by an experienced operator can assemble the signals quickly. A provider founded by local engineers with little registry experience may need to learn them at high cost. If guidance is opaque, experience becomes a moat. If guidance is clear, technical capability and local demand matter more. That is the pro-entry case for a narrow, legible registry.

Credibility also protects the entrant from predatory dependence. A small ISP that does not understand address markets may accept a poor lease, overpay a broker, rely too heavily on a sponsor, misread transfer timing or launch with an IPv4 plan that collapses after the first growth wave. A stronger registry knowledge base lowers the chance that the entrant buys expensive certainty from intermediaries simply because official process feels obscure.

The credibility stack should be treated as a product of infrastructure design. RIPE NCC already publishes many materials, but a new entrant has to assemble them across membership pages, transfer pages, RPKI pages, reverse-DNS pages, abuse-contact material, billing procedures and resource guidance. A mature operator knows where to look. A new ISP often does not. A launch-oriented map would reduce search cost.

The map should be written in the language of entry, not only in the language of resources. "If you are a small access provider planning first service, decide these items before launch." "If you are using leased IPv4, verify these points." "If you are using a sponsoring LIR, understand these controls." "If you will advertise your own routes, prepare these ROA and contact practices." "If you expect to grow, model the cost of IPv4 beyond a /24." Such guidance would not lower standards. It would reduce wasted motion.

The result would be boring in the best way. A new ISP would still need money, engineering skill, upstream contracts, local access rights and customers. But it would not lose weeks discovering the registry stack by accident. In a market where incumbents already hold scale, reducing accidental fixed cost is a serious pro-entry intervention.

Incumbents amortise what entrants must fund at once

The same registry requirement has different economics depending on when it hits the provider's life cycle. An incumbent incurred many of its registry costs in the past, when address abundance was greater, staff routines were forming and fixed costs could be spread across a growing customer base. It may now operate with historical IPv4 holdings, established portal access, trained staff, documented authority, old supplier relationships and tested contact processes. It can absorb new requirements as adjustments to an existing machine.

The entrant faces the machine all at once. It needs numbers, routing identity, address strategy, evidence, route security, reverse DNS, abuse contactability, billing discipline and customer credibility before it has scale. It also enters after IPv4 exhaustion, which means the historical subsidy of easier allocation is gone. The incumbent's address base is sunk. The entrant's address base is financed at current scarcity prices.

This is not necessarily unfair in a legal sense. Historical allocation cannot be rewound. Incumbents also invested in networks, took earlier risks and built operational capacity. The point is economic, not moral: a neutral rule can favour incumbents when it is a fixed cost and incumbents have already paid or amortised it. The absence of discriminatory intent does not remove the entry effect.

The effect is visible in staffing. Incumbents have people who know how to maintain registry data, answer audits, manage ROAs, handle reverse DNS, respond to abuse mail and coordinate transfers. Entrants often use founders and early engineers. Every registry task competes with installation, sales, support and design. A small error can consume disproportionate time. An incumbent can turn the same task into a ticket.

It is visible in bargaining. A small ISP buying IPv4 has less patience than a large address buyer. It may accept worse terms because delay threatens launch. It may lease at a premium because purchase ties up cash. It may use an intermediary because process knowledge is scarce. The registry is not charging those premiums, but the market charges them around the registry path. Reducing path uncertainty therefore reduces private extraction.

It is visible in trust. Customers already know the incumbent, even if they dislike it. The entrant must prove reliability in advance. Clean registry posture becomes part of that proof. If the entrant cannot explain its number strategy, sophisticated customers will hesitate. If it can, the entrant narrows the credibility gap. Registry legibility therefore has competitive significance beyond the technical file.

This is why a reliable ledger is pro-entry even when it refuses to favour entrants. Preferential treatment can backfire by weakening trust. A weaker proof standard for newcomers would make their resources look suspect. A better approach is to make the same standard cheaper to meet: plain requirements, early completeness checks, standard examples, timing data, a launch guide, clearer fee sequencing and practical escalation for small teams. Equality of standard with lower avoidable cost is the right target.

Incumbency also shapes policy attention. Larger operators and experienced actors have more time to follow mailing lists, attend meetings, study charging proposals and influence technical norms. Small entrants are often absent because they are not yet members or are too busy launching. Policy designed from the perspective of visible actors may underestimate pre-entry burden. That does not make policy illegitimate. It means entry impact should be measured rather than assumed.

The structural conclusion is simple. A registry can support competition by being narrow, boring and predictable. It does not need to subsidise every new ISP. It needs to avoid turning accumulated procedural knowledge into a hidden moat.

The correct boundary is a narrow ledger

The boundary matters because the same scarcity that makes RIPE NCC important also makes overreach tempting. When IPv4 is scarce, when RPKI affects route-origin confidence, when reverse DNS and abuse contacts matter to operational trust, and when transfers influence address-market value, the registry layer can appear to have quasi-regulatory power. It should resist that appearance. Its pro-entry role is not to choose winners. It is to keep the proof layer reliable and bounded.

A narrow ledger records who is recognised, what resources are held, which contacts are maintained, how transfers and changes are evidenced, and which operational services support accuracy and security. A gatekeeper judges whether a business model is desirable, whether leasing is morally appealing, whether a small ISP's capital plan is wise, whether customers should prefer one provider, or whether broader institutional ambitions justify more friction. The first role lowers entry barriers by reducing uncertainty. The second raises them even when it speaks in the language of stewardship.

Narrowness does not mean passivity. Fraud control is active. Sanctions compliance is active. Data-quality review is active. RPKI security is active. Reverse-DNS accuracy is active. Abuse contact reachability is active. But each action should be tied to the integrity of the record and the services that depend on it. The moment a registry drifts into general market judgement, entrants face a risk they cannot price.

Entrants are especially sensitive to discretionary signals. A large incumbent can absorb a vague delay, call experienced advisers and escalate through known channels. A small provider may not know whether a delay is normal, dangerous or fatal. It may freeze investment while waiting. It may overpay for certainty. It may abandon a direct path and become dependent on a larger actor. Procedural opacity is therefore not neutral; it reallocates bargaining power.

This is why status language should be precise. A request can be incomplete, under authority review, waiting for payment, affected by transfer restriction, blocked by legal constraint, held for suspected misrepresentation, or ready for action. Those categories carry different economic meaning. A small ISP needs to know which one applies so it can decide whether to fund equipment, sign customers, close a lease, switch sponsors, delay launch or seek review.

The same precision should apply to continuity. A new provider should understand which services are safe during routine review, which may be affected by payment delay, which require urgent correction and which are insulated unless law or security requires action. It should not have to infer whether an administrative issue might affect RPKI, reverse DNS or request processing. Clear boundaries let small teams plan.

The ledger boundary also protects RIPE NCC. A registry that stays narrow can defend strict proof as a technical and legal necessity. A registry that appears discretionary invites market actors to treat every delay as policy, every fee as rent and every service decision as favouritism. In a scarce-address economy, trust in the ledger is part of the asset's value. Institutional humility is therefore not merely ethical. It is value preservation.

The correct criticism of entry barriers is not that RIPE NCC intends exclusion. The better criticism is that a necessary proof layer can become expensive by accumulation. The correct remedy is not weaker proof. It is less avoidable cost around strong proof.

A practical entry-cost agenda

The practical agenda begins with a small-ISP launch path. RIPE NCC could publish a concise, maintained guide for new access providers in its service region. It would not promise success, waive policy or advise on retail strategy. It would map the registry-side steps that a serious entrant should understand before launch: membership versus sponsoring LIR, ASN needs, IPv6 resources, IPv4 waiting-list limits, IPv4 purchase or lease implications, transfer restrictions, RPKI and ROA readiness, reverse-DNS setup, abuse contact reachability, billing contacts, document evidence and common timing risks.

The second item is timing visibility. Entrants do not need every request to be instant. They need to know the likely range and what starts the clock. If timing depends on complete documents, define completeness in practical language. If sanctions checks, authority reviews or payment issues can extend the period, say so by category. Aggregate timing data would help banks, sponsors, buyers, sellers and new ISPs price the gap between commercial plan and registry recognition.

The third item is proof examples. Small providers need examples of accepted company records, authority evidence, transfer files, sponsor agreements, abuse contact setup and ROA transition planning. The examples should be jurisdiction-neutral but practical. They should explain common defects without implying that one legal system is the norm. Proof standards can remain firm while the path to satisfying them becomes less mysterious.

The fourth item is fee and cash sequencing. A launch checklist should show sign-up, annual contribution, independent-resource charges, ASN assignment charges, billing-contact duties, payment references, non-payment consequences and how payment status affects new or ongoing requests. A small ISP should be able to include the registry-side cash sequence in its board file without reconstructing it from several pages.

The fifth item is sponsorship clarity. RIPE NCC need not police sponsor pricing to explain control. It can publish a plain-language comparison of direct membership and sponsoring LIR paths: who submits requests, who maintains records, what the End User can change, how abuse contact and reverse DNS are handled, what happens when the sponsor changes, and what should be considered before later migration to direct membership.

The sixth item is entry impact in policy and charging discussions. Any proposal affecting transferability, RPKI terms, reverse DNS, audit practice, closure, payment status, membership fees, ASN charges or independent resources should include a short entry-cost note. Does it add fixed cost? Does it require specialist knowledge? Does it affect entrants before revenue? Does it favour those with historical address holdings? Does it push small providers toward leasing or sponsorship? The note would not veto policy. It would make incidence visible.

The seventh item is operational education that respects scarce time. Training for entrants should focus on launch-critical tasks: how to prepare a resource plan, how to avoid invalid ROAs, how to keep abuse mail reachable, how to structure reverse DNS, how to document IPv6 deployment, how to assess leased IPv4, and how to preserve evidence for future transfer or financing. The best training product for a small ISP is not a certificate. It is fewer avoidable launch mistakes.

Finally, RIPE NCC should keep its institutional claim modest. Small ISP entry is shaped by many forces outside the registry: civil works, wholesale access, spectrum, capital, landlords, customer acquisition, national law, competition policy and equipment supply. The registry should not pretend to solve those. Its part is narrower and important: make number-resource proof strict, clear, predictable and operationally reliable. If it does that, it reduces a fixed-cost stack that incumbents amortise and entrants feel immediately.

The new-entrant board file will still be hard. It will still need a coverage plan, upstream terms, cash, staff, customer commitments and a disciplined network design. But it should not have to pay an extra uncertainty tax to prove that its identifiers, contacts and route authority are real. In a scarce-address economy, that is the difference between a ledger that supports entry and a service layer that accidentally makes incumbency look natural.