Contractual Compliance

The Office of Contractual Compliance is an ICANN department charged with gathering information from and enforcing the contractual compliance of registries and registrars through complaint-driven informal and formal resolution processes, ICANN-initiated monitoring, and random auditing.

History

The history of ICANN's compliance enforcement runs parallel to the history of the organization's agreements with contracted parties: specifically, registry agreements and registrar accreditation agreements with registries and registrars, respectively. Contractual Compliance's role changed over time as those agreements were amended to include additional expectations, obligations, and mandates of contracted parties.

Periodic reporting of compliance performance was initiated by the department in July 2014. The department also publishes annual reports of complaints, complaint processing, and formal resolutions of complaints. ICANN's Annual Report incorporates some of the contractual compliance information as well. In 2017, the department began assembling quarterly reports of activities and performance. Quarterly reporting was discontinued in 2019.

GDPR and Registration Data Complaints

As the EU's General Data Protection Regulation came into effect, Contractual Compliance shifted its focus around and response to complaints related to inaccuracies or misrepresentations in registration data. The department noted that the shifts in registrar and registry policies resulting from the implementation of GDPR resulted in changes in the number and relevance of complaints:

The decrease in complaint volume from a monthly average of 2,774 pre-GDPR to 1,003 post-GDPR resulted from a significant reduction in external complaints and from ICANN org no longer releasing WHOIS ARS reports beginning in June 2018.
In addition, the percentage of complaints received that lacked evidence of noncompliance or fell outside of ICANN org's contractual scope increased. For example, many complainants believe that the registration data is "missing" from the public Registration Data Directory Service (or WHOIS service), privacy or proxy service data are redactions, or all non-European data should be displayed. While Contractual Compliance efforts to educate complainants on contractual requirements increased, the number of actual investigations into registrars' compliance with registration data accuracy obligations decreased.

Complaints

Complaints commonly handled by this office include unauthorized domain name transfers or unsuccessful transfer requests; registry violations, such as providing more favorable treatment to some registrars; renewal reminders, fees, or redemption issues; and incorrect WHOIS data or access issues.

Auditing

The Audit Program is a continuous, ongoing activity that follows a recurring cycle. Each audit round consists of six phases:

1. Planning Phase: ICANN plans the audit scope and timeline.
2. Request for Information Phase: ICANN issues a notice of audit to the selected contracted parties, who must compile information and respond to the audit request.
3. Audit Phase: ICANN reviews, tests, and validates the responses to ensure compliance with the contractual obligations.
4. Initial Report Phase: ICANN issues a confidential initial audit report to each auditee containing the initial findings and allowing the contracted party to address the findings or provide clarity.
5. Remediation Phase: ICANN collaborates with the auditees to remediate issues.
6. Final Report Phase: ICANN issues a confidential final audit report to each auditee. ICANN also summarizes the audit round in an overall audit report

DNS Security Threat Audits

In November 2018, ICANN Contractual Compliance (Compliance) launched a Registry Operator Audit for Addressing DNS Security Threats. The audit was conducted over seven months, from November 2018 to June 2019. The report on the audit, released in September 2017, reported that of the 1207 TLDs reviewed during the audit, "approximately five percent (5%) of the audited ROs subject to Specification 11, Section 3(b) were not performing any security threat monitoring, despite having domains registered in their gTLDs." The report noted that many of the non-complying registries had a limited number of registrations:

In most of these cases, ROs cited a low number of registrations or tightly controlled and exclusively internal registration (e.g., where the gTLD has an ICANN-approved Specification 13 .brand designation). While the audit revealed that RBLs currently do not identify any threats originating from .brand gTLDs, Compliance explained to these ROs that monitoring is a contractual obligation that does not depend on the number or type of registrations. Remediation was required in all cases.

The report stated that, incidences of noncompliance notwithstanding, most registry operators employed good practices.

In February 2021, Contractual Compliance launched an audit of registrars' compliance with abuse-specific requirements of the RAA. Of the 126 registrars audited, deficiencies were identified within three different categories of compliance requirements:

Registry Agreement Requirement	# of Registrars with Deficiencies	% of Registrars with Deficiencies
General Abuse Reporting (RAA 3.18.1)	46	37%
Law Enforcement Abuse Reporting (RAA 3.18.2)	33	26%
Abuse Handling Procedures (RAA 3.18.3)	78	62%

In total, only 15 registrars passed the audit process without any notice of deficiency.

Roles at ICANN

• Senior Manager, Contractual Compliance Risk and Audit
• SVP, Contractual Compliance & U.S. Government Engagement
• Contractual Compliance Risk and Audit Senior Specialist
• Contractual Compliance Lead
• Sr. Manager, Contractual Compliance
• Contractual Compliance Analyst
• Contractual Compliance Specialist
• Contractual Compliance Senior Specialist

General Data Protection Regulation