View source for Contractual Compliance

The Office of '''Contractual Compliance''' is an [[ICANN]] department charged with enforcing the contractual compliance of registries and registrars through complaint-driven informal and formal resolution processes, ICANN-initiated monitoring, and compliance audits. 

==History==
The history of ICANN's compliance enforcement runs parallel to the history of the organization's agreements with contracted parties: specifically, [[Registry Agreement|registry agreements]] and [[Registrar Accreditation Agreement|registrar accreditation agreements]] with registries and registrars, respectively. Contractual Compliance's role changed over time as those agreements were amended to include additional expectations, obligations, and mandates of contracted parties.

==Complaints==
Complaints commonly handled by this office include unauthorized domain name transfers or unsuccessful
transfer requests; registry violations, such as providing more favorable treatment to some registrars; renewal reminders, fees, or redemption issues; and incorrect [[WHOIS]] data or access issues.<ref>[https://www.icann.org/en/system/files/files/contractual-compliance-complaint-31mar18-en.pdf Contractual Compliance Complaints]</ref>

===Compliance Reports===
Periodic reporting of compliance performance was initiated by the department in July 2014.<ref name="perfstats">[https://features.icann.org/compliance/dashboard/report-list ICANN.org - Contractual Compliance Performance Reports], last visited December 2021</ref> The department also publishes annual reports of complaints, complaint processing, and formal resolutions of complaints.<ref name="perfstats" /> ICANN's Annual Report incorporates some of the contractual compliance information as well.  In 2017, the department began assembling quarterly reports of activities and performance. Quarterly reporting was discontinued in 2019.<ref name="perfstats" /> 

===GDPR and Registration Data Complaints===
As the EU's [[General Data Protection Regulation]] came into effect, Contractual Compliance shifted its focus around and response to complaints related to inaccuracies or misrepresentations in registration data.<ref name="gdpr">[https://www.icann.org/resources/pages/registration-data-accuracy-obligations-gdpr-2021-06-14-en ICANN.org - Registration Data Accuracy Obligations Before and After GDPR], June 14, 2021</ref> The department noted that the shifts in registrar and registry policies resulting from the implementation of GDPR resulted in changes in the number and relevance of complaints:
<blockquote>The decrease in complaint volume from a monthly average of 2,774 pre-GDPR to 1,003 post-GDPR resulted from a significant reduction in external complaints and from ICANN org no longer releasing WHOIS ARS reports beginning in June 2018.<br />

In addition, the percentage of complaints received that lacked evidence of noncompliance or fell outside of ICANN org's contractual scope increased. For example, many complainants believe that the registration data is "missing" from the public Registration Data Directory Service (or WHOIS service), privacy or proxy service data are redactions, or all non-European data should be displayed. While Contractual Compliance efforts to educate complainants on contractual requirements increased, the number of actual investigations into registrars' compliance with registration data accuracy obligations decreased.<ref name="gdpr" /></blockquote>

==Monitoring==
"Monitoring activities are ICANN-initiated, based in part on industry articles, social media postings, previous complaints, and trend analysis in an effort to proactively address any alleged failure to comply with contract terms."<ref>[https://www.icann.org/resources/pages/faqs-84-2012-02-25-en#38 ICANN.org FAQ - What is ICANN's Contractual Compliance Approach and Process?]</ref> In 2020, ICANN-initiated monitoring resulted in the submission of 1,412 complaints submitted for processing. These complaints represented roughly 8% of the total complaints submitted that year.<ref>[https://features.icann.org/compliance/dashboard/2020/complaint-count-reporters ICANN.org Contractual Compliance Dashboard - 2020 Complaints by Reporter Category]</ref>

==Auditing==
The Audit Program is a continuous, ongoing activity that follows a recurring cycle.<ref>[https://www.icann.org/resources/pages/audits-2012-02-25-en ICANN.org - Contractual Compliance Audit Program]</ref> Each audit round consists of six phases:<ref name="phases">[https://www.icann.org/en/system/files/files/audit-phases-timeline-01aug17-en.pdf Audit Phases, ICANN]</ref><br/>
# Planning Phase: ICANN plans the audit scope and timeline.
# Request for Information Phase: ICANN issues a notice of audit to the selected contracted parties, who must compile information and respond to the audit request. 
# Audit Phase: ICANN reviews, tests, and validates the responses to ensure compliance with the contractual obligations.
# Initial Report Phase: ICANN issues a confidential initial audit report to each auditee containing the initial findings and allowing the contracted party to address the findings or provide clarity.
# Remediation Phase: ICANN collaborates with the auditees to remediate issues.
# Final Report Phase: ICANN issues a confidential final audit report to each auditee. ICANN also summarizes the audit round in an overall audit report.<ref name="phases" />

===DNS Security Threat Audits===
In November 2018, ICANN Contractual Compliance launched a Registry Operator Audit for Addressing DNS Security Threats.<ref>[https://www.icann.org/en/blogs/details/contractual-compliance-addressing-domain-name-system-dns-infrastructure-abuse-8-11-2018-en ICANN.org Blog - Contractual Compliance Addressing DNS Infrastructure Abuse], November 8, 2018</ref> The audit was conducted over seven months, from November 2018 to June 2019.<ref>[https://www.icann.org/en/announcements/details/icann-publishes-registry-operator-audit-for-addressing-dns-security-threats-17-9-2019-en CC Audit of DNS Security Threats, ICANN Announcements]</ref> The report on the audit, released in September 2017, reported that of the 1207 TLDs reviewed during the audit, "approximately five percent (5%) of the audited ROs subject to Specification 11, Section 3(b) were not performing any security threat monitoring, despite having domains registered in their gTLDs."<ref name="19audit">[https://www.icann.org/en/system/files/files/contractual-compliance-registry-operator-audit-report-17sep19-en.pdf ICANN.org - Report on the RO Audit for Addressing DNS Security Threats], September 17, 2019 (PDF)</ref> The report noted that many of the non-complying registries had a limited number of registrations:
<blockquote>In most of these cases, ROs cited a low number of registrations or tightly controlled and exclusively internal registration (e.g., where the gTLD has an ICANN-approved Specification 13 .brand designation). While the audit revealed that RBLs currently do not identify any threats originating from .brand gTLDs, Compliance explained to these ROs that monitoring is a contractual obligation that does not depend on the number or type of registrations. Remediation was required in all cases.<ref name="19audit" /></blockquote>
The report stated that, incidences of noncompliance notwithstanding, most registry operators employed good practices.<ref name="19audit" />

In February 2021, Contractual Compliance launched an audit of registrars' compliance with abuse-specific requirements of the RAA.<ref name="21audit">[https://www.icann.org/en/system/files/files/compliance-registrar-audit-report-2021-24aug21-en.pdf ICANN.org - Contractual Compliance Report on the February 2021 Registrar Audit], August 24, 2021 (PDF)</ref> Of the 126 registrars audited, deficiencies were identified within three different categories of compliance requirements:

{| class="wikitable" 
|-
! Registry Agreement Requirement
! # of Registrars with Deficiencies
! % of Registrars with Deficiencies
|-
| General Abuse Reporting (RAA 3.18.1)
| 46
| 37%
|-
| Law Enforcement Abuse Reporting (RAA 3.18.2)
| 33
| 26%
|-
| Abuse Handling Procedures (RAA 3.18.3)
| 78<br />
| 62%
|}

In total, only 15 registrars passed the audit process without any notice of deficiency.<ref name="21audit" />

==Outreach==
Contractual Compliance presents frequently at [[ICANN Meetings|ICANN meetings]], and conducts seminars and other educational programs throughout the ICANN regions.<ref>[https://www.icann.org/resources/compliance/outreach ICANN.org - Contractual Compliance Outreach Activities]</ref> 

==Roles at ICANN==
* Senior Manager, Contractual Compliance Risk and Audit
* SVP, Contractual Compliance & U.S. Government Engagement
* Contractual Compliance Risk and Audit Senior Specialist
* Contractual Compliance Lead
* Sr. Manager, Contractual Compliance
* Contractual Compliance Analyst
* Contractual Compliance Specialist
* Contractual Compliance Senior Specialist

==References==
{{reflist}}
__NOTOC__
[[Category:ICANN Organization]]