How Sanctions Affect the RIPE NCC

We should start by noting that this is partially in response to a request from a community member in May. While we did respond back then, we did not feel able to provide as much detail as we would have liked.

Quarterly Sanctions Transparency Report

This week, we published our first sanctions transparency report. These reports will be published on a quarterly basis from now on, which will keep things straightforward in terms of communicating any developments to the membership. It will also be helpful for external parties to have clarity on where we stand with all of this.

Legal Context

While we have covered some of the legal aspects in earlier updates, it might be helpful to revisit some of this here, especially for anyone who is looking at this topic for the first time.

As an association under Dutch law, the RIPE NCC is in principle subject to Dutch and EU legislation, and the Dutch authorities are responsible for their enforcement. UN sanctions are not binding unless they are incorporated into Dutch or EU sanctions, which is usually the case. Currently, the RIPE NCC is only affected by EU sanctions regulations.

In general, EU sanctions regulations relate to:

• Prohibiting specific products and services from being provided in a specific country. RIPE NCC services are not included in these regulations.
• Financial restrictions, which consist of:
  • Freezing of funds and economic resources belonging to designated persons and entities; and
  • A prohibition on making funds and economic resources available to such persons and entities

While country-based sanctions are not relevant to us, the financial restrictions are. This is because the registration of Internet number resources is considered an economic resource. Accordingly, we are prohibited from making new Internet number resources available to any sanctioned persons or entities. We are also required to freeze any resources they already have.

Another distinction worth noting is direct vs indirect sanctions. In cases where a RIPE NCC member is subject to sanctions, they are directly sanctioned, and we have to apply the controls mentioned above. If that member owns or has control of another member, we have to treat this second member the same as the first and apply the same controls. Identifying business links between entities and determining which is the controlling party can require considerable investigation and can be disputed.

The sanctions list containing designated persons and entities is regularly updated. Failure to comply with EU sanctions regulations is an offence under criminal law. A criminal court can impose fines, and individuals may be imprisoned for up to six years.

Sanctions Prior to 2019

The applicability of EU sanctions regulations to the RIPE NCC has been known for quite a while. Following events in 2012, we received confirmation from the Dutch authorities that our services are not subject to country-specific sanctions. However, it was understood that we could not accept further membership applications from members on the EU sanctions list.

In 2014, our board approved a resolution expressing its opinion on sanctions:

"The Executive Board of the RIPE NCC believes that the means of communication should not be affected by political discussions or disputes. This includes the provision of correctly registered Internet numbering resources.

The Executive Board of the RIPE NCC is committed to taking all lawful steps available to ensure that the RIPE NCC can provide undisrupted services to all members across our service region.”

The procedural document “Due Diligence for the Quality of Registration Data” was also updated to reflect our processes in light of sanctions obligations: “If the signing party is subject to such sanctions, the RIPE NCC may refuse to sign an agreement with or to provide services to this party.”

Developments in 2019

In late 2019, we were alerted to the fact that two RIPE NCC members in Iran and one in Syria may be* on the EU sanctions list. Consistent with the 2014 board resolution above, we wanted to find a solution that meant we would remain compliant with sanctions, while preserving the ability of our members to provide connectivity. We then informed these members that they were subject to EU sanctions and that their resources had been frozen in the RIPE Database. We also initiated a substantial effort to review and strengthen our sanctions screening process to ensure that any directly or indirectly sanctioned individuals or organisations can be identified.

* A note on semantics: we say “may” because one of these cases was disputed. If there is any doubt whether an entity on the sanctions list is in fact the one in question, we assume they are and apply the same controls while we investigate. This is because the law considers compliance a binary matter. There is no grace period or special consideration granted for complicated situations.

Discussions with the Dutch Authorities

In early 2020 we asked the Dutch Ministry of Foreigh Affairs (MFA) to clarify whether Internet number resources were indeed “economic resources” under the EU sanctions regulations. In the event that they were, we also asked that the provision of Internet number resources be exempted from sanctions, or at least for them to confirm that our compliance measures were sufficient and that the resources did not have to be deregistered.

In December 2020, the MFA confirmed that they understood IP resources to be economic resources, as defined in the EU sanctions regulations, and therefore must be frozen for sanctioned entities.

The MFA's primary concern was in terms of preventing the IP resources of sanctioned entities from being transferred, as well as preventing the allocation of additional resources. However, the MFA also said it believed the RIPE NCC had taken adequate steps to ensure compliance with sanctions and, importantly, that there was no need to deregister the IP resources of the three affected members. This was announced by our Board in March.

Regarding our request for an exemption from EU sanctions regulations, the MFA stated that according to the regulation, there was no legal basis to exempt IP resources from sanctions.

Banking Issues

Financial institutions in the Netherlands have also been working on their compliance with sanctions and anti-money laundering legislation. This comes after two banks received heavy penalties for non compliance. This has resulted in increased “Know Your Customer” (KYC) efforts, which can lead to restrictions for their customers. Dutch banks do not accept payments from EU sanctioned entities and in some cases from countries they identify as “high risk”.

Syria and Iran fall into this “high risk” category, and there was a lack of clarity from our banks on whether we could accept payments from entities in these countries. This is why we postponed invoicing our members in both Iran and Syria this year. We did our best to reassure them that this was strictly an issue with our banks and would not affect the status of their memberships.

After communication with our banks to clarify their concerns, we eventually invoiced the bulk of members (386) in both countries in July. That leaves 68 members in Iran and 7 in Syria that have still not received their 2021 invoice. These are entities that may be subject to US OFAC sanctions.

The OFAC Sanctions list is maintained by the Office of Foreign Asset Control (OFAC), which is part of the United States Treasury Department. While we are under no obligation to comply with these sanctions, they are a concern for banking institutions that have operations in the US.

We are looking for a long-term solution that will allow us to receive membership fees from all members, though it may take some time. Until then, we have no option but to postpone invoicing these members. However, while we are not seeking payment at the moment, they have the same obligations as any other members. They should therefore expect to pay their membership fees eventually (and plan accordingly).

Updated Sanctions Screening Process

Our sanctions screening process has undergone substantial improvements since this issue resurfaced in 2019. In September, we published details around our sanctions screening process, which is now automated and running on an ongoing basis. This has been a sizeable project and taken a lot of resources internally, especially given the size of information that needs to be checked -- around 20,000 members in addition to a further 20,000 End Users. Each member and End User will involve a larger group of individuals and companies that have to be reviewed to establish who has control. This process is being constantly reviewed and improved, but we are confident that it is of an appropriately high standard. We have contracted an independent auditor from EY (Ernst & Young) to conduct an independent audit looking at the correctness and effectiveness of our sanctions processes.

Looking Ahead

It’s fair to say that the events beginning in late 2019, when we were first alerted to members being on the sanctions list, began a period of some internal disruption for our organisation. However, we have now reached a stable point and we are confident in where we stand.

Looking ahead, our position from 2014 is unchanged. We strongly believe that Internet resources should be kept separate from political disputes, especially in light of how fundamental connectivity has become to our societies. We are concerned that sanctions restricting the use of Internet number resources will continue to put pressure on the existing system of Internet governance. We will therefore continue to investigate the possibility of a blanket exemption from EU sanctions regulation for Internet number resources.