IP Transfers:
Sanctions & Regulation

Peter Tobey & Leo Vegoda
May 4. 2022

The early stages of internet development operated in a culture of independence from outside influence. In fact, as though to commemorate the spirit of the times, in 1996 John Perry Barlow wrote “A Declaration of the Independence of Cyberspace.” In it, he told governments they, “have no sovereignty where we gather.” He went on to state, “Ours is a world that is both everywhere and nowhere, but it is not where bodies live.” Regulators and politicians seemed to agree, and outside control of the development and organization of the internet was managed with a very light touch throughout the 1990s.

Since then, internet regulation has become more thorough. It is definitely not “nowhere.” It is increasingly everywhere and definitely “somewhere” in the sense its bits and pieces live in the very real, very physical world, as do its users. Servers sit in data centers. Those data centers need staff, electricity, and lots of connectivity. Plus, the web has enabled all sorts of behavior, most of it good and useful, some not so much.

Government Regulation of IP Addresses

Governments have made laws that relate to the internet and to the people who use it. They have always regulated the communications infrastructure, especially international telecommunications systems. These days law makers increasingly regulate the content that is communicated on the internet. In addition, governments band together to establish international norms in the United Nations and other international organizations. These actions generally reach far beyond content moderation or control.

As part of the regulation process, the organizations running the address registries that enable communication on the system work within these laws. Which is to say, the regional internet registries (RIRs) are impacted by laws just like the rest of us.

IP Transfer Regulations

When organizations agree to transfer addresses (whether within a region or between them), they are not transferring a physical object. Instead, they are transferring the rights for a registration in a database. It is this address data that informs the entire system as to the routing of information among machines on the internet. So, without accurate, up-to-date information, well-coordinated and synchronized across the system, information to or from a machine is stalled. It either fails to move at all or can’t get where it’s supposed to go.

The Regional Internet Registries and National Internet Registries manage those databases. This means that three organizations must agree to the transfer of use from one owner of an address to another owner. (More likely, the transfer of large blocks of addresses, but the principle is the same.)

Required Permissions for Transferring IP Addresses

The organizations transferring resources to someone else
The registry that manages “ownership” records
The recipient of the transferred resources

All three entities must ensure that they can and want to do business with each other for a successful transfer to occur. There are several layers of quality control within the process. But organizations outside the transfer group enforce other controls that often supersede those of the IP registries and the needs – or wishes – of the parties to a transfer.

Financial Controls of IPv4 Transfers

Those with IPv4 addresses transfer them to others in return for payment. The market for these intangible-but-significant assets has become very large. The recipient must pay the source of the transfer for the use of the addresses. In some cases, there are also fees paid to brokers, like IPv4.GLOBAL, for arranging and helping to complete the transfer.

All such transfers are subject to banking regulations and controls and limited by the cross-border systems available. Chief among those systems is the Society for Worldwide Interbank Financial Telecommunication (SWIFT) messaging protocol used in most international funds transfers. (There are others, including China’s CIPS but SWIFT is by far the most widely used.) If one of the banks is not able to use the SWIFT interbank transfer system, any transaction using it cannot proceed. The recipient of the transfer must also be able to send payment. Thus, blocking either party can stop a transfer of funds.

More broadly, the international banking system has rules that control illegal financial transactions. Transactions from sanctioned entities, and/or countries supporting illicit activities are selectively blocked from using the system. Under normal circumstances, ordinary crime is the main target. Numerous governments, financial institutions, and corporations impose controls to prevent money laundering and the illegal movement of funds. Banks enforce government mandates by conducting comprehensive due diligence on clients, analyzing financial transactions flowing through their operations, identifying suspicious transactions and reporting suspect transactions through SARs (Suspicious Activity Reports) to government regulators. Lastly, banks research trends and patterns in money laundering and terrorist financing activities to improve their transaction-monitoring systems. All this evolves with the changing tactics of target entities.

Difficulties arise when members of a region either run afoul of the regulations or because information about them is incomplete. In these cases, transferring parties can’t confirm an appropriate transfer of funds. This has been an issue for RIPE NCC. In November 2021 it had members who could not be invoiced because banks considered them “…high risk and would prefer not to receive any funds from them.” The RIPE NCC has said it will set up banking in Dubai, where banks are better able to evaluate risks in nearby countries, thereby allowing transfers.

The Impact of the Russia-Ukraine Conflict

The invasion of Ukraine has lead to efforts to isolate Russia from many of the world’s commercial channels. Among those efforts are financial restrictions across a number of banking networks and protocols. Of course, some commercial pathways remain open to Russian IP owners, while others are closed.

IP holders in Russia (and Ukraine) have been invoiced as normal by their RIR, the RIPE NCC. Their accounts won’t be closed if they cannot be paid in the normal timeframe. The registry in the region (RIPE NCC) states, “We continue to follow all our procedures in the same way as we did before the outbreak of war. We treat all members equally and the same requirements are made of all members in terms of due diligence checks. If we need to make any changes to our procedures, these will be clearly communicated to all members.”

However, other regulations apply. The Dutch Ministry of Foreign Affairs maintains that IP resources are economic resources and so are subject to EU sanctions. IP addresses registered to Russian organizations, then, are functioning but can’t be transferred, either sold or new ones purchased according to the registry in question, RIPE NCC.

It should be noted that Russia (and any other RIPE account) is allowed to pay in any non-crypto currency. The Euro is preferred but not required. This because the ruble remains a legal currency. However, far-reaching banking controls are now in place regarding Russia.

The Impact of Sanctions on Transfers

In addition to the above, Australian, EU, UK and US regulators have imposed financial sanctions on Russia. These sanctions freeze assets held abroad by Russia’s central bank and selected Russian commercial banks. Additionally, Russian banks are blocked from the SWIFT messaging system used to facilitate cross-border transactions among banks.

There is a wide range of other sanctions, including seizure of the foreign assets belonging to specific Russian oligarchs and political leaders. If sellers or buyers rely on sanctioned Russian banks to execute payments, their payments will be blocked. Funds at other banks will need to be employed. If this is not an option, the buyer/seller will be financially isolated and unable to pay for anything.

Finally, the world’s financial system is complex. The networks that connect banks, both sanctioned and un-sanctioned ones, are many and strange. So, regulators and governments seeking to restrict the flow of funds to and from the many banking systems and via the world’s byzantine transfer methods are currently in the process of adding controls, step by step. At the same time, sanctioned banks are trying to find ways around those controls. As of this writing, two things are clear: funds transfer to and from Russia are possible and they are becoming increasingly difficult. In any case, before considering such a transfer, consult with your banker and a qualified attorney.

IP Registry Controls

The registries want to maintain authoritative data for the user of IP addresses so that network operators can establish routing policies and communicate effectively with each other. That’s why they have developed policies enabling the transfer of IP addresses: so the transfers are under their control. Registries that are incomplete or inaccurate are less useful. Missing data makes internet crime and other attacks easier.

International Sanction Laws & IP Transfers

Registries also must comply with international sanctions laws. In 2018, ARIN’s CEO stated that its due diligence checks “includes verification of the legal entities involved and their pertinent bona fides. ARIN reviews transactions for potential conflict with applicable law and has in the past declined to process transactions that are unclear in that regard and referred parties to US Treasury/OFAC to obtain appropriate clarity or licensing as appropriate.”

The Office of Foreign Assets Control (“OFAC”) of the US Department of the Treasury, “administers and enforces economic and trade sanctions. Its work is based on US foreign policy and national security goals against targeted foreign countries and regimes, terrorists, international narcotics traffickers, those engaged in activities related to the proliferation of weapons of mass destruction, and other threats to the national security, foreign policy or economy of the United States.”

Due Diligence Checks

The RIPE NCC regularly updates the document describing the scope of its due diligence checks. It also publishes a quarterly sanctions transparency report. For instance, they reported in January 2022 that 250,000 IP addresses had been frozen in its database. These were registered to a member in Syria and a member in Iran.

Private Checks

Many private organizations perform due diligence checks on new suppliers, customers and other partners. This includes those with whom they transfer IP addresses. Such institutions and businesses want to know that their business partner will be reliable. Some want to know they are reputable. And, many in the IP transfer process have concluded that organizations based in Russia are unworthy partners in any exchange and regardless of permissions available (though there aren’t many) they will not participate with Russian entities. The checks done by institutions, firms, banks and registries do not replace the legal process. They add an extra layer of confidence that any transfer is legal and acceptable to all the participants.

Help Navigating IP Regulations & Controls

For those with any number of reservations and/or questions about the restrictions involved in transfers generally, please contact IPv4.GLOBAL by email or by phone (212) 610-5601. For specific issues – especially those revolving around sanctions against Russia, contact your attorney for guidance.

Internet Registry Jurisdictions

The five Regional Internet Registries are subject to the jurisdiction, including sanctions regime, of the countries in which they are based. These are:

AFRINIC – Mauritius
APNIC – Australia
ARIN – the US
LACNIC – Uruguay
RIPE NCC – the Netherlands, and European Union