Summary

  • ARIN's Number Resource Policy Manual states that number resources are nontransferable unless ARIN expressly and in writing approves a transfer request, and that the receiving entity must sign a Registration Services Agreement unless it already has one on file.
  • A holder that never signed anything can still start a transfer, but the 2011 procedure ARIN published warned that verification takes longer or fails without an agreement — and the fee shelter for that unsigned status closed on 31 December 2023.
  • No document reviewed for this briefing shows ARIN reclaiming an address block on its own initiative, and no allocation volume or share of legacy space appears anywhere in the record.

A registry is easy to misread as a warehouse. The metaphor is everywhere: ARIN administers address space, so its chief executive administers a stock, and the interesting questions become queue order and service uptime. That reading describes the queue. It does not describe the instrument. The pages that actually govern what ARIN may do to a holder are not inventory documents at all. They are a policy manual, a transfer procedure, and a contract.

The sharpest sentence sits in the current Number Resource Policy Manual, inspected as Version 2025.1 dated 3 March 2026: number resources are nontransferable unless ARIN expressly and in writing approves a transfer request. Nothing about custody, nothing about possession. The registry's authority over where a block goes is exercised as an approval — a written act, on a request, against criteria. The same policy adds that the receiving entity must sign a Registration Services Agreement covering all transferred resources unless it already has a current one on file. For larger blocks the recipient must show utilisation or projected need, and the minimum IPv4 transfer is a /24.

The transfer procedure page makes the sequencing explicit and separates two events that outsiders routinely merge. Approval comes first. Completion comes after the applicable fees and, where applicable, a signed agreement — to be submitted within ninety days. On the source side ARIN lists a current registered holder, no dispute over the block, the /24 floor, and a twelve-month restriction tied to recent ARIN IPv4 transfers or allocations. Read those requirements together and the mechanism is clear: ARIN is not the party that hands over the addresses. It is the party that decides whether the handover is recognised.

Then there is the population that makes this more than procedure. ARIN defines a legacy number resource as IPv4 space or an ASN issued before its 22 December 1997 inception and never brought under an ARIN agreement, per the Legacy Resource FAQs. Those holders sit in the register without a signed relationship. And ARIN's legacy guidance says they may request a transfer through ARIN Online among the transactions that do not require an ARIN agreement. The registry will open the door for someone with whom it has no contract.

What that costs was stated in plain prose long before anyone called it a risk. A 20 April 2011 ARIN announcement said the transferor of legacy space did not need a current RSA or LRSA to initiate an 8.3 transfer, and warned in the same breath that verification could take longer — or fail — without an agreement, with an officer attestation required to begin vetting. The 2011 notice shows a prior procedure, not today's standard wording. The trade it describes has not gone away.

A signature changes the shape of that trade. The Registration Services Agreement, inspected as Version 14.0 dated 15 August 2025, defines its Included Number Resources to cover ARIN-issued resources together with pre-ARIN legacy resources specifically identified as subject to the agreement. It grants the holder a right to transfer the registration of those resources pursuant to ARIN policies. And it permits ARIN to refuse transfers or additional allocations where utilisation does not comply with policy. Both halves matter. The holder gets a procedural right it did not have before. ARIN gets a documented basis to refuse — and it gets that basis because the holder signed it into existence.

The older form shows how narrow the bargain can be drawn. The historical Legacy Registration Services Agreement Version 2.2, dated 28 May 2010, covered specifically enumerated resources rather than everything an organisation held, allowed ARIN to review utilisation whenever a transfer or additional space was requested, and permitted assignment of the agreement or related rights only with ARIN's written permission and consistency with transfer policy. That is a document that fences precisely what it names — and leaves everything unnamed outside.

The date that should be on every legacy holder's calendar is 31 December 2023. The legacy fee cap expired then. Active LRSAs entered before 1 January 2024 retain fee limits for legacy resources covered before that date, and no additional legacy resources may be added to an LRSA after 1 January 2024. The FAQ states the consequence for anyone arriving later: for requests received on or after that date, an organisation bringing legacy resources under agreement signs the current RSA and is invoiced under current Registration Service Plan fees. The grandfathering shelter is real, but it is closed.

A holder who stayed outside the tent did not preserve an option to enter on 2010 terms. It preserved only the unsigned record.

So what can be said about John Curran's tenure on this boundary, and what cannot? The directory row records him as ARIN's president and chief executive. The documents above are his institution's instruments, and they describe an executive position whose leverage is a signature and an approval, not a seizure. No dated statement by Curran on this boundary was obtained for this briefing, so none is quoted, paraphrased or implied. The record here is contract and policy text, and it is enough to support one claim about the office and nothing about the man's private view.

The negative finding deserves the same precision as the positive one. Across the transfer page, the policy manual, the legacy pages, and the two agreements reviewed, no passage shows ARIN reclaiming, revoking or reclassifying a registration on its own initiative without a contract or a policy basis. That is an absence in the pages read. It is not proof that no such power exists elsewhere, and nobody should quote this briefing as saying ARIN cannot act. Likewise, nothing here establishes allocation volume, the share of address space still held unsigned, transfer counts, or the outcome of any particular dispute.

Strip the metaphor and the accountability question changes. If ARIN's power runs through approvals and signatures, then the risk carried by the unsigned record is not that the registry will take the addresses. It is that the holder cannot prove its own chain when it finally needs to move them, and that the buyer inherits that gap after the money has changed hands. A registry that cannot compel is a registry that can only withhold recognition — which is a slower, quieter and considerably more expensive kind of power.