Request for Input regarding a transfer policy recommendation

[David Cake]

What is written seems reasonable to me. Particularly i and ii together would cover most circumstances where the transfer was for some reason fraudulent or unintended and discovered relatively quickly, which I think is an important safeguard. 

I think keep the ‘includes but is not limited to’ language. I can certainly foresee there being other issues that might occur occasionally that might merit either relaxing the restriction or keeping it despite one of the other conditions being met, such as situations where there are questions as to what is a legitimate request from the RNH where the RNH is a corporate entity or there are allegations of a transfer request being illegitimate for reasons of fraud etc, including reversing a request found to be legally illegitimate, etc. Rather than try to enumerate all possible cases, just leave a clause open that essentially means if the case is unusual enough you may do what you feel is necessary, while keeping in place norms that restrict its regular use. 

I would keep separate iii and iv. From a Registrars internal viewpoint the processes are going to look different, and the documentation required is quite different. For iii the only documentation required may be, for example, that the first transfer was to an escrow agent, and that the escrow agent is trusted to follow its own verification procedures. 

David


> On 9 Dec 2024, at 10:54 am, Ken Herman <ken at kherman.com> wrote:
> 
> Hello NCSG Members
>  
> I seek input on one of the transfer policy recommendations, specifically regarding transfer restrictions after an inter-registrar transfer.
>  
> Background Summary:
>  
> In its recommendation 18, the working group recommends requiring registrars to impose a transfer restriction of 30 days (expressed as 720 hours for clarity) following a transfer. In other words, if I transfer a domain to a new registrar, then I must wait for 720 hours before any further transfer can occur.
>  
> So far so good, and most stakeholder groups seem to accept this restriction as an important security mechanism. 
>  
> The issue has to do with provisions within the recommendation that allow for lifting the restriction under certain conditions. 
>  
> The NCSG comments for this recommendation supported the transfer restriction as well as the ability to lift it but suggested that there be specific conditions under which the restriction can be lifted and out comment enumerated those conditions. The original recommendation text simply required that the “request includes a reasonable basis for removal of the restriction”. 
>  
> The NCSG, in its comment, noted that “reasonable request” was too vague to be of value (or words to that effect).
>  
> Question:
>  
> Is it useful in a policy document to enumerate specific conditions? 
>  
> Some working group members suggest that enumerating conditions will limit the policy to those specific conditions, and therefore any additional ones may require a policy review. But others disagree, indicating that the conditions mentioned in the policy can serve as examples which provide guidance to compliance should there be a question as to whether the policy was applied correctly.
>  
> Referring to the original and revised text below, my suggestion is to retain, in 18.3, at the very least points (i), (ii) and (v). Furthermore, condense points (iii) and (iv) into one that refers to issues regarding the acquisition of domain names. Do you (a) agree with my suggested proposed text, or (b) is there some other formulation or (c) do you believe the original text to be sufficient?
>  
> The original and revised text is below. The crux of the issue is 18.3
>  
> I look forward to thoughts you may have.
>  
> Thanks
>  
> Ken
>  
>  
> INITIAL REPORT LANGUAGE
> Recommendation #18 – Transfer Restriction After Inter-Registrar Transfer
>  
> The Registrar MUST restrict the RNH from transferring a domain name to a new Registrar within 30 calendar days / 720 hours of the completion of an inter-Registrar transfer. To the extent that a Registry and/or Registrar has an existing policy and/or practice of restricting the RNH from transferring a domain name to a new Registrar for a different period of time following an inter-Registrar transfer, all policies and practices MUST be updated to be consistent with this new requirement. However, the working group recognizes that there may be situations where early removal of the 30-day restriction described in Recommendation 18 is appropriate. Accordingly, the Registrar MAY remove the 30-day inter-Registrar transfer restriction early only if all of the below conditions are met:
>  
> 18.1:  The Registrar MUST be able to demonstrate that it received a specific request to remove the 30-day restriction from the Registered Name Holder; 
>  
> 18.2:  The Registrar MUST ensure the request to remove the restriction was requested by the Registered Name Holder;
>  
> 18.3: The specific request includes a reasonable basis for removal of the restriction; and
>  
> 18.4:  The Registrar MUST maintain a record demonstrating the request to remove the restriction (regardless of outcome) for a period of no fewer than fifteen (15) months following the end of the Registrar’s sponsorship of the registration.
>  
>  
> Revised Recommendation 18:
> The Registrar MUST restrict the RNH from transferring a domain name to a new Registrar for 720 hours from the completion of an inter-Registrar transfer. Accordingly, the Registrar MAY remove the 720-hour inter-Registrar transfer restriction early only if all of the below conditions are met:
>  
> 18.1:  The Registrar MUST be able to demonstrate that it received a specific request to remove the 720-hour restriction from the Registered Name Holder;
>  
> 18.2:  The Registrar MUST ensure the request to remove the restriction was requested by the Registered Name Holder;
>  
> 18.3: The specific request includes a reasonable basis for removal of the restriction, which [includes but is not] limited to [(i) well informed, documented, clearly intentional request by the registrant; (ii) mutual agreement between the prior and current Registrar of a transfer back to the prior Registrar;] (iii) legitimate circumstances surrounding an escrow intermediary affecting the completion of the acquisition of the involved registered domain name; (iv) to complete documented registered domain name acquisition (aftermarket purchase, portfolio consolidation, or bona fide purchase); (v) intentional release of the registered domain name that had transferred to the Registrar where it becomes evident the domain name use would be in violation of the Registrar’s Acceptable Use Policy (AuP), Terms of Service (ToS), or local law or other similar governance.
>  
> 18.4:  The Registrar MUST maintain a record demonstrating the request to remove the restriction (regardless of outcome) for a period of no fewer than fifteen (15) months following the end of the Registrar’s sponsorship of the registration.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ncsg.is/pipermail/ncsg-discuss/attachments/20241211/e6c5b5e0/attachment.htm>