Summary

  • Public RIR transfer lists are records of recognised completed changes, not populations of transfer attempts. They can show which resources moved, between which named organisations and on what processing date. They generally do not show requests rejected, withdrawn, administratively closed, still pending, reopened or changed on review.
  • A rejection rate is meaningless until the unit and denominator are fixed. One commercial transfer may create source and recipient tickets, several prefix rows and two RIR case files. The defensible base is a deduplicated transfer case accepted for substantive review, with inquiries, incomplete intake and broker pre-screening reported separately.
  • Rejection reasons should be published as de-identified aggregates using a stable hierarchy: source authority, resource eligibility or lock, recipient eligibility, inter-RIR incompatibility, dispute or legal hold, sanctions duty, data-integrity concern, agreement or fee condition, and other reason subject to review. Each reason must map to the rule applied.
  • Withdrawn is not a harmless residual category. A party may leave because the deal failed commercially, because evidence was unavailable, because a registry request made completion impractical, because a counterpart RIR would not proceed or because the case was incorrectly opened. Voluntary, induced, expired and duplicate closures must be separated.
  • Pending cases need stock-flow reconciliation: opening pending plus new accepted and reopened cases must equal approvals, rejections, withdrawals, other closures and ending pending after documented corrections. Inter-RIR counterparts must reconcile the same commercial case rather than publish incompatible totals from linked tickets.
  • Appeals complete the feedback loop. Registries should publish how many review requests were filed, admitted, dismissed for scope, withdrawn, affirmed, remanded, modified or reversed, linked to the original de-identified reason and policy version. Number Resource Society can maintain the open definitions and aggregate comparison without deciding individual transfers.

The public record begins after the policy has selected its winners

Open a transfer statistics page and the market appears orderly. A block moved from one organisation to another. A date is shown. The source and recipient regions may be visible. A transfer type distinguishes a policy transfer from a merger or another organisational change. Add the rows and one can describe recognised activity over time.

Now ask a different question: how many parties tried to make a comparable transfer and were refused?

The page usually cannot answer. Nor can it say how many applicants left after repeated evidence requests, how many source and recipient cases failed to reconcile, how many requests were closed as incomplete, how many were still unresolved at the reporting boundary or how many denials changed after review. The transfer that did not enter the registry's completed list has almost no public statistical existence.

This is not a technical omission at the edge of the market. It changes the meaning of every conclusion drawn from the visible rows. A rising number of completions could mean access improved. It could also mean demand rose while the approval share fell. A stable count could mean policy was predictable, or that brokers stopped filing cases they expected the registry to reject. A regional route with few transfers could be commercially quiet, structurally incompatible or informally screened before intake. The completed numerator cannot distinguish those explanations.

The common NRO transfer-log format makes the selection boundary clear. It is designed to publish transfers within and between RIRs. RIPE NCC's statistics page likewise says it publishes the Internet number resources transferred according to policy and defines the date as the day transfers were processed. These are appropriate purposes for a custody history. Neither purpose creates a denominator of attempted decisions.

The missing cases are known to the institutions. ARIN's public pre-approval guidance expressly contemplates rejection and directs an applicant that believes the justification was met to open an Ask ARIN ticket. APNIC's guide says an unacknowledged transfer request is cancelled after 30 days. RIR case systems necessarily distinguish active, complete and unsuccessful states in order to operate. What is absent is not the concept of failure. It is a public, comparable account of how often each outcome occurs and why.

Policy made from success records will flatter itself. It sees the cases that conformed and loses the cases that tested the boundary. That is why the rejected transfer matters even when the decision was correct. It is evidence about what a rule does.

The denominator must be a case, not a ticket, block or address

Before publishing a rejection share, the RIRs must agree on what is being counted. This sounds clerical. It is the point at which a transparent report can become misleading without containing a single false number.

One negotiated transfer is a commercial case. It may involve one seller, one buyer and one set of agreed resources. Inside a registry, it can create separate source and recipient tickets. A merger may be represented differently from a specified-recipient transfer. A block can be divided into many prefix rows. An inter-RIR transfer creates records at both the source and destination institutions. Additional tickets may be opened for legal identity, agreements, billing or technical cleanup.

Counting tickets inflates cases handled by more complex procedures. Counting prefixes makes a transfer of one fragmented holding look larger than a transfer of one aggregated block. Counting addresses gives large transactions enormous weight in a measure intended to describe administrative decisions. Adding both RIRs' records double counts a bilateral case.

The primary unit should be a deduplicated transfer case: one proposed change of recognised registration from an identified source to an identified recipient for a defined resource set under one commercial instruction. The public report does not need to expose those identities. The institutions need a confidential linkage key so all related tickets, prefix rows and RIR files resolve to that case.

The denominator for a substantive decision rate should then be all unique cases accepted for substantive review during a defined cohort period, followed to a terminal outcome. Acceptance means the minimum identity, resource and request elements were sufficient for the registry to evaluate the applicable transfer rule. It does not mean approval was likely.

Three adjacent populations must remain separate.

Inquiries are contacts or eligibility questions that never become requests. They reveal deterrence and confusion but often lack enough information to define a unique case. Incomplete intake consists of submissions that never reach substantive review because essential fields, authority or acknowledgement are missing. It reveals usability of the procedure. Accepted cases cross the published intake threshold and expose the substantive policy decision.

Broker pre-screening is a fourth population outside direct RIR custody. A broker may tell a buyer that its planned use will not qualify or tell a seller that a block is locked. Those cases matter for market access, but registries cannot honestly count what was never presented to them. A voluntary, independently audited broker return can estimate this attrition. It must never be merged into the RIR denominator as though staff had decided it.

This layered approach prevents two opposite manipulations. A registry cannot improve its apparent approval share by excluding accepted cases later relabelled incomplete. Critics cannot inflate rejection by counting every casual inquiry as a denied transfer. The boundary is public, prospective and testable.

An outcome taxonomy must account for every accepted case

“Approved” and “not approved” are too crude for institutional learning. The first hides corrections and partial bilateral failures. The second merges decisions, party choices and administrative closures that should have different policy consequences.

Every accepted case should end the reporting period in exactly one of these states.

Completed means the recognised registry change was carried out for the full accepted resource set. Completed with modification means the transfer occurred, but the approved resource set, recipient, route or legal form materially differed from the accepted request. Rejected means the registry issued a substantive decision that the case did not satisfy a rule or mandatory legal condition. Withdrawn by party means an authorised party ended the request before a substantive rejection. Closed incomplete means the registry ended the case because specified required evidence or action was not supplied. Expired means a published response or acknowledgement period ended without action. Duplicate or replaced means another case became the authoritative path and no independent decision should be counted. Cancelled by registry means the institution terminated the case for an administrative or technical reason not attributable to policy eligibility. Pending means no terminal state had been reached by the reporting boundary. Reopened or corrected means a prior terminal classification changed and both the original and replacement states are preserved.

The categories are deliberately factual. They do not imply that a rejection was unfair or that a withdrawal was coerced. They create the base on which those questions can be studied.

The “completed with modification” category is particularly important. Suppose a buyer sought a /16 but was approved for a smaller set after review. Calling the case simply approved hides the restriction's effect; calling it rejected hides the actual transfer. The public aggregate can report modification bands without naming the buyer or exact prefix.

Partial inter-RIR completion should not be classified as completed. If the source registry approved but the destination did not create the receiving state, the commercial case has not produced the recognised bilateral result. It belongs in pending reconciliation, rejected by counterpart, restored after failed cutover or another defined exception. A source-side approval is an event inside the case, not the case outcome.

Administrative deletion must never remove a case from history. If a duplicate is merged, the surviving case retains a reference to the excluded record. If a staff error created a case, “cancelled by registry” remains visible in the aggregate. If a rejected case is later reopened and completed, both facts matter: the policy initially stopped it, and review or new evidence changed the result.

Once this taxonomy exists, the denominator becomes auditable. Opening cohort cases can be followed until every one reaches a terminal state. Reports can distinguish provisional period outcomes from mature cohort outcomes. No case disappears merely because its ending is inconvenient.

Rejection reasons should identify the rule without identifying the applicant

The central objection to publishing failed transfers is confidentiality. Rejected applicants may have disclosed customer plans, corporate documents, disputes, legal advice, sanctions concerns or security-sensitive infrastructure. Naming a failed buyer or listing the exact prefix could damage reputation and reveal strategy. That objection is valid against case-level exposure. It is not an argument for statistical darkness.

A de-identified reason code can preserve the institutional fact while withholding the party. The hierarchy should be stable enough for comparison and specific enough to support policy change.

Source authority not established covers cases in which the offering party did not prove that it could request the registration change. Resource ineligible or locked covers holding periods, reserved status, prior receipt restrictions, voluntary locks or another rule attached to the block. Recipient eligibility not established covers the receiving organisation, contractual status, regional presence or demonstrated-use condition. Inter-RIR path unavailable covers incompatibility, absence of reciprocal procedure or counterpart refusal. Dispute or external legal hold covers competing claims, insolvency restrictions, court process or another recorded dispute. Mandatory sanctions or legal prohibition covers a legal duty distinct from ordinary policy choice. Integrity or fraud concern covers false, inconsistent or unverifiable evidence, with a higher-level public label where detail would create harm. Agreement, fee or account condition unmet covers required contracts, unpaid charges or account readiness. Technical record condition covers a defect in the resource set or current registry state that prevents a coherent change. Other substantive reason remains available but should trigger review if used often.

Each case has one primary reason and may have secondary reasons. The primary reason is the condition that independently prevented approval at closure. If the source lacked authority and the recipient also failed a need test, staff should record both but identify which decision ended the case. This avoids totals that exceed the number of rejections while preserving complexity.

Every reason code must map to the policy clause, published procedure or legal category applied at the time. The public aggregate can report the rule version without exposing the applicant. If staff rely on an unpublished interpretation, that fact should be visible as “procedure not publicly specified,” not hidden in “other.”

Reasons should not be retrofitted to flatter a rule. A codebook change requires a version, effective date and bridge from old categories to new. Historical releases remain available. If a case was initially classified as recipient ineligible and later corrected to staff error, the revision record shows both.

The value of this evidence is practical. Ten rejected cases for disputed source authority may justify stronger pre-filing verification. Ten rejections for the same ambiguous recipient test may show that the policy language or guidance is failing. Repeated counterpart incompatibility may identify a closed route that a list of completed transfers cannot reveal. Reason data turns frustration into something members can govern.

Withdrawal is an outcome, not a bin for inconvenient causation

Withdrawals are often treated as though they say nothing about policy because the registry did not issue a denial. That assumption is untenable.

A seller may withdraw because the buyer failed to fund. A buyer may withdraw because its deployment changed. Those are commercial exits. A party may also withdraw after being told that additional evidence will be required, after learning that the counterpart RIR will not proceed, after a registry interpretation changes the expected result or after the cost of continuing exceeds the value of the deal. Those are not formal rejections, but the policy environment contributed to the outcome.

The registry should not decide a party's motive unilaterally. At closure, the withdrawing party should select a broad reason, with “prefer not to say” available. Staff separately record the procedural state and any outstanding condition. The two fields can coexist: party reason “commercial agreement ended”; registry state “recipient evidence requested.” Neither claims to read the other's mind.

At minimum, the public aggregate should separate commercial withdrawal, party restructuring, evidence unavailable, policy concern identified, counterpart unavailable, duplicate/replacement, and undisclosed. A withdrawal after a draft adverse finding should not be silently merged with a buyer that changed its network plan before review began.

“Closed incomplete” must also stay distinct. If the registry asked for a document and the applicant stopped replying, staff did not necessarily reject the merits. Yet the case was not a voluntary withdrawal unless the party said so. A published response deadline can create expiry. APNIC's guide, for example, says the recipient must acknowledge within 30 days or the request is cancelled. That event should be reported as an acknowledgement expiry, not a substantive denial and not an unexplained withdrawal.

This distinction protects the institution as much as the applicant. A high share of commercial withdrawals does not prove policy failure. A high share of closures at the same evidence request may justify redesign even if no denial was issued. A high share of unacknowledged cases may show poor party coordination. Lumping all three together prevents a fair diagnosis.

Withdrawals after pre-approval need an additional flag. The policy may have approved the recipient in principle, but the block, source, inter-RIR route or deal still failed. This shows the limit of pre-approval and prevents an institution from counting it as both successful qualification and an outcome that simply vanished.

The point is not to force private commercial explanations into public view. It is to keep “the applicant left” from becoming an institutional alibi. Departure is data when a mandatory decision path sits between agreement and registration.

Pending cases must reconcile as a stock, not drift between reports

An institution can publish every terminal category and still hide pressure by allowing pending cases to float outside the arithmetic. A credible report therefore begins with a reconciliation identity.

Opening pending cases, plus new cases accepted for substantive review, plus previously closed cases reopened, must equal completed cases, completed-with-modification cases, rejections, party withdrawals, incomplete closures, expiries, duplicates or replacements, registry cancellations, transfers to another reporting cohort under a stated rule, and ending pending cases. Corrections are shown as adjustments with references to the period in which the original classification appeared.

Every term uses unique cases. Source and recipient tickets are consolidated. A case spanning several prefixes remains one case unless the commercial instruction was formally split into independently decidable transfers. If a split occurs, the report shows one parent becoming two child cases so the increase is not mistaken for new demand.

The identity must balance for each RIR, transfer type and intra- or inter-RIR class. If it does not, the report is incomplete. “Data quality” should not become a suspense account into which unresolved differences disappear. The institution should publish the discrepancy, size, cause if known and correction plan.

Pending should be divided by decision state rather than presented as one stock: awaiting source, awaiting recipient, under source-registry review, under recipient-registry review, awaiting bilateral reconciliation, under legal hold, awaiting agreement or fee, and ready for record change. The purpose is not to recreate a study of elapsed-time distributions. It is to establish who or what must act before the stock can leave pending.

Cases paused by a legal order remain in the denominator. Cases awaiting the applicant remain in the denominator. The controller field prevents their presence from being misread as registry refusal while keeping the workload and unresolved demand visible.

The cohort view and period view answer different questions. The period reconciliation shows the institution's changing caseload. A matured cohort shows what eventually happened to cases accepted in a particular quarter or year. Recent cohorts will contain unresolved cases and should be labelled provisional. Older cohorts should converge to terminal outcomes. Publishing both prevents the registry from treating the year of closure as if it were the year of application.

This simple arithmetic is one of the strongest controls available. It makes silent deletion difficult. It exposes reclassification. It forces every accepted transfer to remain visible until an outcome exists. It gives members a stable denominator without disclosing a single applicant name.

Inter-RIR cases need one outcome across two institutions

The denominator becomes harder when two RIRs participate. Each registry can correctly report its own ticket and still produce a false global picture.

Imagine a source RIR approves release, sends the case onward and closes its internal ticket as approved. The recipient RIR refuses because the buyer did not satisfy its rule. If the source counts an approval and the destination counts a rejection, an analyst may see two cases. Commercially there was one attempted transfer and no completed registry change.

The common unit must therefore exist above the tickets but below any central approval authority. The two RIRs assign a shared pseudonymous case reference derived through a protected matching method. Each retains its own private identity and evidence. Public aggregates use the shared reference only for deduplication and reconciliation.

The joint outcome taxonomy should include completed, source rejected, destination rejected, both rejected on independent grounds, party withdrawn, counterpart route unavailable, failed cutover restored, pending source, pending destination and pending reconciliation. Where confidentiality prevents a small directional cell from publication, it can be combined into a broader regional class after independent validation. The case still remains in the global denominator.

Responsibility must not be laundered through the word “counterpart.” If a destination rejects, the broad reason category and policy family should be reported by that destination. If the source never sent a complete handoff, the case should not be recorded as destination refusal. If policies are incompatible, identify incompatibility rather than assigning applicant failure.

Both institutions should sign the final joint classification. A disagreement becomes an unmatched-case count published after a defined reconciliation period. This may appear embarrassing. It is less dangerous than two public statistical realities describing the same attempted change.

The arrangement does not require one RIR to disclose confidential documents to another beyond what the transfer already requires. It requires them to agree on whether the case completed and which institution issued the terminal decision. Those are facts necessary for the registry change itself.

A cross-RIR annual statement can then answer questions that completed logs cannot: how many accepted attempts entered each directed route, how many reached recognised completion, how many failed on source conditions, how many failed on destination conditions and how many never reconciled. It shows policy incidence while remaining confined to case outcomes and decision evidence.

Pre-filing attrition belongs beside the denominator, not inside it

Even a perfect RIR report misses the transfer nobody files. Brokers, lawyers and repeat buyers learn which routes are likely to fail. They screen blocks for locks and disputes, buyers for eligibility and cross-region paths for compatibility. This saves registry work and protects clients from predictable refusal. It also means the official approval share may look high precisely because market actors filter out difficult cases.

The solution is not to force every negotiation into an RIR portal. That would burden parties and institutions with speculative filings. Nor should a registry estimate invisible demand from anecdotes. Pre-filing attrition should be a parallel, voluntary statistical layer.

Participating brokers and direct-party advisers can report quarterly counts of qualified opportunities assessed, recommended for filing, not recommended, abandoned by the client and filed. Non-recommendation reasons use a broad version of the RIR taxonomy: source authority, block restriction, buyer eligibility, inter-RIR path, dispute, integrity concern, or commercial reason. Exact parties, prefixes and terms remain confidential with the contributor or an independent auditor.

Coverage must be published. If three brokers contribute, readers need to know the share of their completed recognised cases relative to the public transfer population where that comparison is possible. The report cannot claim to measure the entire market. Large contributors should not be allowed to define the categories or suppress an unfavourable release.

Duplicate opportunities are a serious risk. The same seller may approach several brokers. A protected matching method can identify probable duplicates using confidential resource and party attributes, with manual audit for ambiguous cases. The public report should show raw and deduplicated estimates and explain uncertainty.

This evidence changes interpretation. If registries approve most accepted cases but brokers reject many plausible opportunities because a needs test or regional route is expected to fail, policy is selective before intake. If broker screening is low and RIR rejection is also low, access may genuinely be predictable. If brokers recommend filing but a particular reason dominates formal rejection, guidance may not match staff practice.

The outside layer must remain outside the official decision denominator. A broker opinion is not an RIR ruling. It is evidence about deterrence and expectation. Keeping the layers separate prevents private intermediaries from acquiring public authority while making their information available for policy evaluation.

Appeals reveal whether rejection reasons survive independent scrutiny

A rejection count records the first institutional answer. It does not show whether that answer was stable, reviewed or corrected.

ARIN's published appeal process allows an organisation to appeal a number-resource request decision after escalation through Registration Services leadership. The request must identify the original ticket and be filed within the stated period. RIPE NCC maintains a conflict arbitration procedure for specified disputes about number-resource registration services and publishes summaries of completed rulings. Its public list includes transfer disputes, authority-document questions and record reversions.

These mechanisms differ in scope and legal character. That difference makes a common outcome report more important, not less.

For every rejected transfer or pre-approval within the applicable review scope, the registry should record whether internal reconsideration was requested, whether formal appeal or arbitration was filed, and the resulting state. Public categories should include not filed, filed and admitted, dismissed as outside scope, dismissed as late, withdrawn, settled, original decision affirmed, remanded for further review, modified, reversed, and pending.

The appeal record links to the original de-identified reason code and policy version. If the decision changes because the applicant supplies new evidence that was not available initially, classify that separately from a finding that staff applied the rule incorrectly. Both result in a different outcome; only the second directly measures decision error.

Remand is not reversal. A reviewer may require a clearer explanation or another evidential step without deciding the transfer should complete. Modification may approve a smaller resource set or different legal route. Settlement may resolve the applicant's position without establishing a general interpretation. The taxonomy must preserve these distinctions.

Appeal availability also needs a denominator. Publish the number of rejected cases eligible for the review path, the number ineligible because of scope and the number filed. A small number of appeals can mean satisfaction, cost, ignorance, narrow scope or fear of exposure. The report should not choose among those explanations without evidence.

Reasoned decisions should be published where confidentiality permits. A redacted summary can state the clause, issue, outcome and rationale without naming the parties. Where a case is too distinctive to anonymise safely, include it only in aggregate and have an independent reviewer verify the classification.

The most useful measure is not a crude “registry win rate.” It is the pattern of reasons that are remanded, modified or reversed. If one evidential rule repeatedly fails review, policy or staff guidance needs repair. If most decisions are affirmed with clear reasons, the record supports consistency. Either finding is more valuable than institutional anecdotes.

De-identification is a governance discipline, not deletion of names

Rejected-transfer data are commercially sensitive even without direct identifiers. A rare block size, small region, unusual legal hold and narrow reporting period can identify a party when combined with broker listings or routing observations. Removing company names and prefixes is therefore necessary but limited public evidence.

NIST Special Publication 800-188 makes the broader point: de-identification should begin with the intended statistical use, assess release risk, choose an appropriate sharing model and test whether supposedly protected data can be re-identified. It is not one masking operation.

For transfer outcomes, the public release should use aggregated counts with minimum cell thresholds. Small cells are combined across time, direction or reason depth. Exact resource sizes become bands. Countries become broader regions when necessary. Rare legal reasons are grouped. Suppressed values must not be recoverable by subtracting overlapping tables.

The most sensitive linkage remains in a protected environment. Registry auditors can inspect case files and test classifications under confidentiality. Researchers can receive controlled access to more detailed de-identified records where the public interest and safeguards justify it. The public receives enough information to evaluate policy without receiving applicant dossiers.

The disclosure rules must be published before the results. Otherwise an institution can suppress an inconvenient category by invoking privacy after seeing the numbers. A disclosure review body with members independent of the transfer desk should approve exceptions and document why aggregation changed.

Privacy protection should be symmetrical. Completed transfer lists may already name source and recipient organisations because a recognised custody change is public. That does not justify naming rejected applicants. Conversely, confidentiality for failed cases does not justify hiding all aggregate outcomes. Different publication purposes support different data treatments.

Statistical noise may be appropriate for some broad research releases, but the core case reconciliation must remain exact and auditable. A public table can suppress or combine cells while an auditor confirms that opening cases equal terminal outcomes plus ending pending. Adding noise to the accounting identity without explanation would make institutional verification impossible.

The standard should also ban narrative clues. A quarterly report should not describe “a large mobile operator in country X” when only one firm fits. Staff presentations must follow the same rules as data releases. Confidentiality fails if the table is safe and the meeting commentary is not.

De-identification is therefore not the opposite of accountability. Done properly, it is the method that makes accountability sustainable. It allows members to know what the institution did without exposing why a particular company was vulnerable.

Comparison requires common definitions and local context

A global table will tempt readers to rank the five RIRs by approval share. That would be premature unless the input populations and rules are comparable.

Regions differ in eligible resource types, transfer routes, holding periods, recipient tests, contractual conditions and market history. A registry with a strict pre-approval gate may receive a selected set of formal cases. Another may accept broader intake and reject later. One may classify a non-response as expired; another may call it withdrawn. Inter-RIR traffic can dominate a small population and make counterpart rules decisive.

The common standard should therefore fix the lifecycle and reason definitions while preserving policy context. Every release states transfer types included, intake threshold, case-linkage method, policy versions, treatment of pre-approval, handling of mergers, inter-RIR deduplication, disclosure threshold and known gaps.

The primary comparisons are within a rule over time and across directed routes with similar case definitions. Cross-RIR comparisons can then ask whether a reason category is unusually common after accounting for scope. They should not declare one institution fairer from a single aggregate ratio.

Membership composition also matters. A region with many small applicants may see different documentation failures from one dominated by large incumbents. Public analysis can use broad applicant-size bands derived from registry service categories, provided those bands do not identify parties and do not become proxies for moral worth.

Policy changes require break markers. If a holding period changes on 1 January, cases accepted before and after that date belong to different policy cohorts even if they close in the same quarter. The report should show the rule applied, not infer it from closure date.

Staff guidance changes matter too. A policy text can remain constant while evidential expectations shift. Significant published procedural revisions receive version dates. If an unpublished interpretation changes, the transparency report identifies the effective period and retrospective effect.

Comparison becomes credible when it is modest. The data can show that one reason appears more often, that a route produces unmatched cases or that review changes a category of decisions. It cannot by itself prove motive, corruption or economic harm. Those claims need additional evidence.

The purpose is policy feedback, not a scoreboard. Common definitions let members ask better questions while local context prevents arithmetic from pretending to be judgement.

Independent assurance should test the cases the institution would rather forget

Self-reported outcome data need verification because classification affects reputation. The incentive to call a rejection “withdrawn,” an old pending case “closed incomplete” or an inter-RIR refusal “counterparty cancelled” is obvious even without bad faith. Ambiguous cases will drift toward the least damaging category.

An independent annual review should sample every terminal class, with extra attention to low-frequency and high-discretion categories. The reviewer traces each sampled case from intake through tickets, decision notices, linked RIR records, review requests and final registry state. It tests that one commercial case was not counted several times and that no accepted case vanished.

The reviewer also performs the stock-flow reconciliation from raw case events. It compares inter-RIR references with counterpart reports. It checks that policy clauses match reason codes, that reopened cases preserve prior outcomes and that appeal classifications reflect the actual disposition.

Privacy controls receive a separate test. The reviewer attempts reasonable linkage attacks using public transfer lists, broker listings, routing observations and corporate announcements. If a cell can identify a rejected party, the release design is tightened. The finding should improve protection without deleting the institutional total.

The assurance report need not disclose confidential files. It publishes methodology, sample coverage, error rates, corrected totals, unresolved disagreements and management responses. Material corrections update prior releases with revision notes rather than silently replacing them.

Members should appoint or approve the reviewer through a process independent of transfer operations. Funding cannot depend on a favourable conclusion. Registries can respond to findings, but they should not veto publication of a verified discrepancy.

The first review will probably find messy legacy data. That is not a reason to wait. The institution can mark historical coverage incomplete and begin prospective collection with stronger definitions. A year of honest, reconcilable outcomes is more useful than a decade of reconstructed certainty.

Assurance changes behaviour before it finds errors. Staff know that a withdrawal reason must match the record. Case owners know pending files remain in the opening balance. Executives know appeal reversals will link back to the original decision category. This is how measurement becomes procedural discipline rather than another annual chart.

Members cannot govern a power whose refusals are invisible

RIR members fund the registration service and participate in policy structures. They are routinely asked to judge whether a transfer rule protects uniqueness, prevents abuse, conserves resources or imposes unnecessary barriers. They cannot perform that role from successful transfers alone.

A policy may sound narrow and generate broad refusal. Another may sound strict and rarely bind because applicants qualify easily. A documentation rule may protect against fraud or merely duplicate corporate evidence. A compatibility condition may affect one directed route and leave others untouched. The answer lies in outcomes by reason, not in the elegance of policy prose.

The missing denominator also distorts representation. Repeat brokers and large operators accumulate private knowledge about which requests fail. Smaller members see only their own case and the completed public list. Policy debate then rewards the entities with enough volume to infer the hidden system. Transparency should reduce that informational hierarchy.

Publishing rejections does not require publishing private business plans. It requires the institution to admit that refusal is an exercise of power with aggregate effects. If a registry can tell a buyer it does not qualify, it can count that decision. If it can close a request for missing evidence, it can identify the evidence category. If it can defend a decision on appeal, it can report the outcome.

The discipline should extend to the board and policy community. When proposing a rule, sponsors identify the outcome category expected to change and a review date. After implementation, members see whether the prediction held. A rule intended to prevent disputed transfers should reduce or resolve source-authority conflicts; if it instead increases incomplete closures without changing verified fraud findings, the policy deserves reconsideration.

Sunset and review clauses become meaningful when the evidence exists. Without it, every side arrives with anecdotes. Staff cite successful cases. Brokers cite clients who left. Applicants cite inconsistent questions. None can establish the population.

The accountability principle is simple. The greater the discretion to stop a transfer, the stronger the duty to explain the pattern of its use. A narrow recordkeeper should be able to justify every refusal by reference to record integrity or a defined legal condition. A broader policy gate carries an even heavier evidential burden because it affects access to scarce operational assets.

Members do not need to see the rejected buyer. They need to see the rule that rejected buyers, how often it did so, whether parties abandoned cases around it and whether review upheld the decision.

NRS can make the denominator portable without becoming an appeal court

Number Resource Society can supply the common statistical infrastructure if it remains institutionally modest.

Its first contribution is an open case dictionary: commercial case, RIR ticket, accepted intake, substantive rejection, withdrawal, expiry, pending, inter-RIR match, appeal and correction. Each term includes examples and exclusions. Changes are versioned, publicly discussed and backward-mapped.

Its second contribution is a reason-code registry. Each RIR maps local policy clauses to the common high-level reasons while preserving local detail privately. Researchers can compare source authority with source authority without pretending the underlying rules are identical.

Its third contribution is reconciliation. NRS can receive signed aggregate statements and protected inter-RIR matching tokens, test that cases balance and publish unmatched totals. It does not need applicant documents or power to decide a transfer. The RIRs remain responsible for their own classifications and corrections.

Its fourth contribution is controlled research access. Under published safeguards, qualified researchers can study richer de-identified case data, test re-identification risk and examine whether particular reasons cluster around policy changes. Public findings must preserve confidentiality and distinguish observation from causation.

Its fifth contribution is portability for parties. An applicant can export its own case history, reason notice and review outcome in a common format. This lets the party compare treatment, prepare an appeal and correct an aggregate classification without exposing another applicant.

NRS should not hear individual appeals unless parties separately choose an independent dispute service with clear legal authority. It should not certify that a rejected case deserved approval. It should not require a broker to participate, publish client identities or turn a data contribution into a condition of transfer.

The design succeeds if another institution can implement the same definitions and reproduce the reconciliation. Transparency must not create a new monopoly over the evidence it was meant to free.

This is a concrete Number Resource Society proposition: common facts before common ideology. Let each region defend its policy, but require the defence to include the cases the policy stopped.

The first honest report can be small

RIRs do not need a perfect global platform before acknowledging the missing denominator. A useful first release can be produced prospectively from ordinary case management.

For one reporting period, publish opening pending, new accepted cases, reopened cases, completed, completed with modification, rejected, withdrawn, closed incomplete, expired, duplicate or replaced, registry-cancelled and ending pending. Reconcile the total. Separate intra-RIR and inter-RIR cases. State the intake threshold and exclusions.

Next, publish primary rejection reasons at the highest safe aggregation, each linked to a current rule family. Report withdrawal reasons supplied voluntarily by parties and the procedural state at withdrawal. Keep sanctions, disputes and integrity concerns broad where disclosure risk is high.

Then add inter-RIR matching. Each pair compares accepted and terminal cases, resolves duplicates and publishes unmatched totals. A common pseudonymous reference can begin with new cases while older records remain limited.

Finally, add review outcomes. Count internal reconsiderations and formal appeals, admission decisions, affirmance, remand, modification and reversal. Link each to the original reason category and identify whether new evidence or decision error caused the change.

The first year should include an independent methods review and a privacy attack test. Errors will occur. Corrections should be dated and explained. The objective is not an immaculate first table; it is a record that cannot make failed cases disappear.

Nothing in this reform requires publication of contracts, applicant names, exact rejected prefixes or sensitive business plans. The immediate question is more basic: what entered the decision system, what state did it leave in, why, and did review change the answer?

The completed transfer list should remain public. It is valuable evidence of recognised custody changes. The new outcome statement sits beside it and explains the population from which completion emerged.

Once that statement exists, policy debate changes. Members can see whether a rule rarely binds or dominates rejection. Applicants can compare a reason with aggregate practice. Review bodies can identify recurring errors. Brokers can test whether their screening expectations match formal decisions. RIRs can defend necessary refusals with evidence rather than authority.

A policy cannot learn from the cases it erases

The rejected transfer is not automatically a victim. It may involve a seller without authority, an ineligible block, a buyer that did not meet a published condition, a genuine dispute or evidence that could not be trusted. Refusal can protect the accuracy of the registry.

That is precisely why the case should be counted.

If source-authority failures are common, the market needs better proof before negotiation. If resource locks dominate, members can evaluate whether those locks still serve their stated purpose. If recipient tests reject many accepted cases, the policy community can examine their incidence. If inter-RIR incompatibility stops a route, the two institutions can no longer point only to the few cases that crossed it. If appeals reverse a reason repeatedly, the rule or its application needs repair.

A registry that publishes only completions creates an evidence system selected on its own success. It shows what passed and calls the result the market. It has no public account of whom the gate excluded, who left while it was closing or which decisions could not survive review.

The reform is not radical disclosure. It is ordinary administrative accounting adapted to confidential infrastructure. Define the case. Preserve every accepted case. Assign one terminal outcome. Record the primary reason. Reconcile pending stock. Match bilateral cases. Follow review. Protect identity through aggregation and tested disclosure controls.

The hardest part is institutional, not statistical. Rejections complicate the story an institution tells about itself. Withdrawals introduce causation it does not fully control. Pending reconciliation exposes lost or mismatched states. Appeal outcomes admit that first decisions can change.

But a membership body should want that complication. Policy that never encounters contrary evidence becomes ritual. A transfer desk that cannot show its refusals asks members to govern by faith. A public completion list without the rejected denominator is not false; it is radically incomplete.

The visible transfer tells us that one case crossed the gate. The invisible one tells us what the gate is for.

Until both are counted, nobody can seriously study the policy.

Sources