Contractual Compliance

ICANN's Contractual Compliance and Consumer Safeguards department is charged by ICANN with enforcing the contractual compliance of registries and registrars through complaint-driven informal and formal resolution processes, ICANN-initiated monitoring, and compliance audits.

The history of ICANN's compliance enforcement runs parallel to the history of the organization's agreements with contracted parties: specifically, registry agreements and registrar accreditation agreements with registries and registrars, respectively. Contractual Compliance's role changed over time as those agreements were amended to include additional expectations, obligations, and mandates of contracted parties.

Complaints

Complaints commonly handled by this office include unauthorized domain name transfers or unsuccessful transfer requests; registry violations, such as providing more favorable treatment to some registrars; renewal reminders, fees, or redemption issues; and incorrect WHOIS data or access issues.

Complaint Reports

Periodic reporting of department performance was initiated by the department in July 2014. The department also publishes annual reports of complaints, complaint processing, and formal resolutions of complaints. ICANN's Annual Report incorporates some of the contractual compliance information as well. In 2017, the department began assembling quarterly reports of activities and performance. Quarterly reporting was discontinued in 2019.

Complaint Review and Rejection

It is notable that in any given year, a large percentage of complaint tickets received by Contract Compliance are rejected upon review. In 2020, for example, out of 15,739 complaint tickets received against registrars, 12,834 were closed before submission of the first notice to the subject registrar. While there are many reasons that a complaint might be closed before a first notice is sent, a majority of these complaints are closed because the complaint is deemed to be outside the scope of ICANN's authority to act. During Prep Week for ICANN 70, Contractual Compliance noted that 2,279 of the 2,676 DNS abuse complaints submitted between February 2020 and January 2021 were deemed out of scope. In the fourth quarter of 2020, 3,832 of the 7,644 complaints received against registrars and registries (excluding complaints regarding DNS abuse issues) were deemed out of scope.

As the department explains, "The volume of complaints closed before 1st Inquiry / Notice refers to complaints that are not sent to the Registrar or Registry Operator. A reason for closing a complaint before 1st Inquiry / Notice could be: complaint is invalid, a duplicate complaint is already open, requested evidence or additional information not provided by reporter, data changed, etc. ... Closure rate before first Notice means these complaints are resolved or rejected before sending to a Registrar/Registry. This is a direct result of the quality checks performed by ICANN’s Contractual Compliance department." In its Prep Week presentation at ICANN 70, compliance staff elaborated on common rationales for "out-of-scope" determinations:

• Complainant did not respond to ICANN’s request for evidence;
• Complaint was about a domain registered in a ccTLD;
• Complaint misunderstood ICANN’s role and authority;
• Complainant submitted a duplicate complaint before resolution of the original complaint; or
• Complainant submitted a complaint about an issue that was already resolved at the time the complaint was reviewed

GDPR and Registration Data Complaints

As the EU's General Data Protection Regulation came into effect, Contractual Compliance shifted its focus around and response to complaints related to inaccuracies or misrepresentations in registration data. The department noted that the shifts in registrar and registry policies in response to the implementation of GDPR resulted in changes in the number and relevance of complaints:

The decrease in complaint volume from a monthly average of 2,774 pre-GDPR to 1,003 post-GDPR resulted from a significant reduction in external complaints and from ICANN org no longer releasing WHOIS ARS reports beginning in June 2018.
In addition, the percentage of complaints received that lacked evidence of noncompliance or fell outside of ICANN org's contractual scope increased. For example, many complainants believe that the registration data is "missing" from the public Registration Data Directory Service (or WHOIS service), privacy or proxy service data are redactions, or all non-European data should be displayed. While Contractual Compliance efforts to educate complainants on contractual requirements increased, the number of actual investigations into registrars' compliance with registration data accuracy obligations decreased.

SSAD Design and Contractual Compliance

At ICANN 72, the SSAD Operational Design Phase team presented on the progress of the operational design phase for the System for Standardized Access/Disclosure. The presentation included a description of the Contractual Compliance department's role in the new system. Noting that the "alert mechanism is not an appeal mechanism,", the design team notes that compliance complaints could be filed within narrow procedural contraints in two categories:

• Procedural failures regarding alert mechanisms & complaints regarding contracted party behavior. For example, a contracted party fails to provide a sufficient rationale for a denial of an information request; or a contracted party dismisses a request without first seeking additional information from the requesting party; and
• Failure to respond to urgen requests within the timeframes listed in the contracted party's Service Level Agreement.

Although the design team anticipated that there may be changes in the scope and method of Contractual Compliance's complaint processes related to SSAD, the recommendations of the EPDP on the Temporary Specification for gTLD Registration Data anticipate that the SSAD system will have its own processes, as well as avenues of legal recourse for people requesting registration data. As such, they presently anticipate that Contractual Compliance will have limited and specific involvement with the SSAD.

Monitoring

"Monitoring activities are ICANN-initiated, based in part on industry articles, social media postings, previous complaints, and trend analysis in an effort to proactively address any alleged failure to comply with contract terms." In 2020, ICANN-initiated monitoring resulted in the submission of 1,412 complaints for processing. These complaints represented roughly 8% of the total complaints submitted that year.

Auditing

The Audit Program is a continuous, ongoing activity that follows a recurring cycle. Each audit round consists of six phases:

1. Planning Phase: ICANN plans the audit scope and timeline.
2. Request for Information (RFI) Phase: ICANN issues a notice of audit to the selected contracted parties, who must compile information and respond to the audit request.
3. Audit Phase: ICANN reviews, tests, and validates the responses to ensure compliance with the contractual obligations.
4. Initial Report Phase: ICANN issues a confidential initial audit report to each auditee containing the initial findings and allowing the contracted party to address the findings or provide clarity.
5. Remediation Phase: ICANN collaborates with the auditees to remediate issues.
6. Final Report Phase: ICANN issues a confidential final audit report to each auditee. ICANN also summarizes the audit round in an overall audit report.

Audit Rights

ICANN is authorized to audit registries and registrars based on contractual provisions within the the Registry Accreditation Agreement (RAA) and Registry Agreements (RA) with registry operators.

2009 RAA Amendment Process

ICANN's right to audit registrars for compliance with contract provisions was added to the Registrar Accreditation Agreement in 2009 during the amendment process for the RAA. The amendments permitted ICANN to audit registrars for compliance with the following contract requirements:

• maintenance of a functioning WHOIS lookup service;
• collection, verification, review, and retention of valid registrant data;
• inclusion of mandatory provisions and policies in the registrar's registrant agreement;
• inclusion of mandatory provisions and policies in the registrar's reseller agreements, as well as RAA-mandated handling of any registrant data submitted via a proxy or privacy service;
• compliance with all consensus and temporary policies in existence (at the time, the UDPR, Expired Domain Deletion Policy, and WHOIS Data Reminder Policy);
• published link to ICANN's registrant educational information;
• proof of completion of a required training course by the registrar's primary contact or designee; and
• maintenance of valid contact information on the registrar's website and within RADAR.

2013 Expansion of RAA Audit Rights

Starting in 2011, ICANN engaged in a cooperative process of negotiations with accredited registrars to review and update the RAA. The resulting amendments to the RAA were approved by the ICANN Board in June 2013. The amendments expanded ICANN's audit rights in a number of ways:

• Increased compliance requirements around notice to registrants of ICANN policies;
• Increased compliance requirements regarding contractual relationship to resellers and reseller compliance;
• Additional consumer protection measures, such as ensuring a registrar had a published complaint and dispute resolution policy;
• Technical specifications regarding WHOIS and IPv6; and
• Requirements regarding DNS abuse and security threat reporting.

Registry Agreement Audit Rights

The base Registry Agreement (RA), created in advance of the new gTLD round, grants ICANN or its subcontractor the right to perform "contractual and operational compliance audits" after "reasonable advance notice" has been provided to the registry operator.

Prior to the creation of the base RA, audit provisions tended to be limited to financial records and technical reports. For example, Verisign's Registry Agreement to manage the .com domain contained no mention of compliance audits until its amendment in December 2012.

2007 Announcement of Compliance Audit Processes

ICANN's earliest posted report of registrar compliance dates from October 2006. That report indicated that ICANN intended to introduce audit processes for registrars, "similar to the registry audit program already in place." In March 2007, Contractual Compliance announced its intention to begin auditing the contractual and operational compliance of both registries and registrars. Three days earlier, ICANN's CEO at the time, Paul Twomey, announced that review and revision of ICANN's Registrar Accreditation process was necessary to ensure consumer protection and enforcement goals. The announcement was prompted in part by the termination of RegisterFly due to a large volume of customer complaints. Some commentators criticized ICANN at the time for failing to act sooner. ICANN executives at the time identified the lack of enforcement mechanisms apart for revocation of accreditation hampered ICANN's capacity to respond.

At the time of the announcement, there were no contractual provisions for such audits, except to the extent that individual registry agreements might grant a right to audit technical records of registry operators. However, review of the RAA was discussed at ICANN 28 in Lisbon at the end of March. In June 2007, the ICANN Board initiated its Consultation on Registrar Accreditation Agreements. This process resulted in the 2009 amendments to the RAA.

Initial Audits

Contractual Compliance performed periodic compliance audits starting in 2007. The audits were initially conceived as multiple periodic phases of review. The first registrar audit report presented a proposed schedule for 2007 and beyond:

Quarter	Registrar Audits	Registry Audits	Notes
Q1	WHOIS Data Problem Report Findings Primary Contact Information	Code of Conduct Non-Discriminatory Access
Q2	Registrar Fees Website Compliance	Registry Fees Performance Specifications
Q3	WHOIS Server Accessibility Registrar Data Retention*	WHOIS Data Accuracy	*New Audit Process
Q4	Insurance Verification WHOIS Data Acuracy* Inter-Registrar Transfer Policy*	Data Escrow Registration Restrictions	*New Audit Process

The initial report noted that the level of activity and work required for each audit varied from quarter to quarter. Audits related to this plan continued for roughly two years, with additional reports being issued in July 2008 and February 2009. The last report apparently related to this program was issued in December 2009.

Three-Year Audit Program, 2012-2014

In advance of the New gTLD Program, Contractual Compliance launched a three-year audit of all ICANN-accredited registrars and TLDs launched before 2013. One-third of all active gTLD registries and registrars were audited over each of the three years. The audit excluded ccTLDs, .arpa, .mil, .gov, and .edu. At ICANN 45 in Toronto, Contractual Compliance presented on the specifics of the program and its process. The registry audits resulted in "observation reports" to each participating registry. The audit results for registrars are summarized below:

Year	Breach Notices (Registrars)	Terminations (Registrars)	Report
2012	12	3	Year One Audit Report (PDF)
2013	11	3	Year Two Audit Report (PDF)
2014	10	10 (including 5 self-terminations)	Year Three Audit Report (PDF)

New Registry Agreement Audit Program

Starting in July 2014 Contractual Compliance performed a compliance audit on all registries that had signed the new base Registry Agreement that was approved for the New gTLD Program. The department presented an overview to registries in May 2014. At ICANN 50, Contractual Compliance provided an update on its activities, including its work with registries to prepare for the audit.

In all, 14 registry operators were selected for the first audit: 10 operators of ASCII TLDs (.berlin, .ceo, .guru, .link, .menu, .onl, .ruhr, .uno, .wed, and .xyz), and 4 operators of internationalized domain names. Of the 14 registry operators, 10 passed the audit with no notice of deficiencies. Four registry operators were required to address deficiencies. The deficiencies ranged from failure to have valid abuse contact information to internal process gaps such as not having an active business continuity plan.

Subsequent Audit Reports

Contractual Compliance continued the New Registry Agreement Audit Program through March 2018. A summary of audit findings follows:

Report Date	Subject TLDs	Total TLDs	Remediation Required*	Report
2015	.bio, .capetown, .cooking, .gent, .moscow, .ovh, .tokyo, .wales, .wang; IDN: xn---io0a7i (网络)	10	10	2015 Audit Report (PDF)
January 2016	.airtel, .amsterdam, .bank, .bnpparibas, .firmdale, .gdn, .lat, .pro, .rio, .ski	10	10	January 2016 Audit Round Report (PDF)
January 2017	.army, .bet, .dubai, .family, .feedback, .insurance, .jprs, .kiwi, .moi, .party, .scb, .shopping, .sina, .sucks, .surgery, .top, .university, .wtf, .xxx IDNs: xn---mxtq1m (政府), xn---vuq861b (信息)	21	21	January 2017 Audit Round Report (PDF)
September 2017	.airforce, .bingo, .creditcard, .dentist, .gripe, .lawyer, .ltd, .pharmacy, .poker, .srl	10	6	September 2017 Audit Round Report (PDF)
March 2018	.accountant, .bid, .brussels, .cam, .cricket, .date, .download, .faith, .loan, .men, .party, .racing, .review, .science, .stream, .trade, .webcam, .win IDNS: xn---ses554g (网址), xn---zfr164b (政务)	20	20	March 2018 Audit Round Report (PDF)

*The public audit reports provide some statistical information regarding the audit process, but in most cases the reports are not clear regarding whether the initial reports to registry operators always included deficiencies. As a result, the "remediation required" number is not reliable. An exception is the report from the September 2017 audit round, where the executive summary of the public report explicitly states that four of the registries received no initial findings of deficiency.

DNS Security Threat Audits

In 2018, Contractual Compliance announced that it intended to broaden the scope of its audit RFIs to include questions specific to RAA Section 3.18, which deals with registrars' threat prevention, reporting, and response processes. At the same time, the department updated its Registry Operators audit plan to "[review] processes and procedures related to preventing, identifying and handling of abusive domains. Specifically, testing is focused on verification of existence of technical analysis (security threats) reports and review for reports’ completeness in comparison to publicly available sources." Since approval of the first base Registry Agreement for new gTLDs, there have been DNS security-related requirements for registry operators. The July 2013 base Registry Agreement contained abuse mitigation provisions requiring registry operators to publish contact information for abuse reporting, and to take action to remove orphan glue records "when provided with evidence in written form that such records are present in connection with malicious conduct." Other provisions address issues of technical security and baseline operational standards.

The alterations to scope were part of a previously announced initiative to increase attention to security threats, partially in response to community and stakeholder group concerns that ICANN was not doing enough to respond to threats to the DNS infrastructure.

2019 Registry Operator Audit

In November 2018, ICANN Contractual Compliance launched a Registry Operator Audit for Addressing DNS Security Threats. The audit was conducted from November 2018 to June 2019, and reviewed data and reports from 1207 TLDs. The report on the audit, released in September 2019, reported that of the 1207 TLDs reviewed during the audit, "approximately five percent (5%) of the audited ROs subject to Specification 11, Section 3(b) were not performing any security threat monitoring, despite having domains registered in their gTLDs." The report noted that many of the non-complying registries had a limited number of registrations:

In most of these cases, ROs cited a low number of registrations or tightly controlled and exclusively internal registration (e.g., where the gTLD has an ICANN-approved Specification 13 .brand designation). While the audit revealed that RBLs currently do not identify any threats originating from .brand gTLDs, Compliance explained to these ROs that monitoring is a contractual obligation that does not depend on the number or type of registrations. Remediation was required in all cases.

The report stated that, incidences of noncompliance notwithstanding, most registry operators employed good security practices.

2021 Registrar Audit

In February 2021, Contractual Compliance launched an audit of registrars' compliance with abuse-specific requirements of the RAA. Registrars were selected for audit if they at least 5 domains listed in the the Security Threat Reports received during the 2019 Registry Operator Audit, or listed in the November 2020 OCTO Abuse Reports based on metrics from Reputation Block Lists (RBLs). During the RFI phase, one registrar was terminated for unrelated reasons, leaving a total of 126 registrars in the audit pool. The registrars being audited managed over 90% of all registered second-level domains at the time of the audit. Of the 126 registrars audited, deficiencies were identified within three different categories of compliance requirements:

Registry Agreement Requirement	# of Registrars with Deficiencies	% of Registrars with Deficiencies
General Abuse Reporting (RAA 3.18.1)	46	37%
Law Enforcement Abuse Reporting (RAA 3.18.2)	33	26%
Abuse Handling Procedures (RAA 3.18.3)	78	62%

In total, only 15 registrars passed the audit process without any notice of deficiency. Of the remaining 111 registrars, 92 cured all reported deficiencies before the end of the audit's remediation phase. Nineteen registrars were unable to cure all deficiencies within the audit timeframe and negotiated due dates with Contractual Compliance for completion of their work to cure.

2022 Round of Audits

On April 4, 2022, Contractual Compliance sent pre-audit notifications to Registry Operators for 28 gTLDs. The selected Registry Operators received a Request for Information containing the audit questions.
The selection criteria for the 28 gTLDs included:

• not previously audited in a standard full-scope RA Audit
• at least 100 domains
• highest abuse score as reported by publicly available Reputation Blocklists (excluding spam)

When these criteria resulted in multiple gTLDs operated by the same Registry Operator, ICANN selected one gTLD to represent the Registry Operator.

Outreach

Contractual Compliance presents frequently at ICANN meetings, and conducts seminars and other educational programs throughout the ICANN regions.

ICANN CC Staffers

• Leticia Castillo Sojo, Jonathan Denison, Roger Lim: Directors, Contractual Compliance
• Yan Agranonik: Senior Manager, Contractual Compliance Risk and Audit
• Jamie Hedlund: SVP, Contractual Compliance & Consumer Safeguards, Managing Director
• Joseph Restuccia: Contractual Compliance Risk and Audit Senior Specialist
• Amanda Rose: Contractual Compliance Lead
• Zuhra Salijanova: Sr. Manager, Contractual Compliance
• Mehdi Kurdmisto, Genie Chou, Mariana Solano, Dickson Chew, HuiYing Lim, Leah Symekher, Laine Tan, Amanda Weddle: Contractual Compliance Analysts
• Nicholas Axelrod-McLeod, Charmaine Lim, Bryan Tan: Contractual Compliance Specialists
• May Kim, Holida Yanik, Selim Manzak, Jinzaemon Kimoto: Contractual Compliance Senior Specialists
• Pamela Howard: Performance Measurement & Reporting Senior Manager
• Cynthia Tinsley: Contractual Compliance Executive Assistant

General Data Protection Regulation

Internationalized Domain Name