Contractual Compliance

ICANN's Contractual Compliance and Consumer Safeguards department charged by ICANN with enforcing the contractual compliance of registries and registrars through complaint-driven informal and formal resolution processes, ICANN-initiated monitoring, and compliance audits.

The history of ICANN's compliance enforcement runs parallel to the history of the organization's agreements with contracted parties: specifically, registry agreements and registrar accreditation agreements with registries and registrars, respectively. Contractual Compliance's role changed over time as those agreements were amended to include additional expectations, obligations, and mandates of contracted parties.

Complaints

Complaints commonly handled by this office include unauthorized domain name transfers or unsuccessful transfer requests; registry violations, such as providing more favorable treatment to some registrars; renewal reminders, fees, or redemption issues; and incorrect WHOIS data or access issues.

Compliance Reports

Periodic reporting of compliance performance was initiated by the department in July 2014. The department also publishes annual reports of complaints, complaint processing, and formal resolutions of complaints. ICANN's Annual Report incorporates some of the contractual compliance information as well. In 2017, the department began assembling quarterly reports of activities and performance. Quarterly reporting was discontinued in 2019.

GDPR and Registration Data Complaints

As the EU's General Data Protection Regulation came into effect, Contractual Compliance shifted its focus around and response to complaints related to inaccuracies or misrepresentations in registration data. The department noted that the shifts in registrar and registry policies in response to the implementation of GDPR resulted in changes in the number and relevance of complaints:

The decrease in complaint volume from a monthly average of 2,774 pre-GDPR to 1,003 post-GDPR resulted from a significant reduction in external complaints and from ICANN org no longer releasing WHOIS ARS reports beginning in June 2018.
In addition, the percentage of complaints received that lacked evidence of noncompliance or fell outside of ICANN org's contractual scope increased. For example, many complainants believe that the registration data is "missing" from the public Registration Data Directory Service (or WHOIS service), privacy or proxy service data are redactions, or all non-European data should be displayed. While Contractual Compliance efforts to educate complainants on contractual requirements increased, the number of actual investigations into registrars' compliance with registration data accuracy obligations decreased.

Monitoring

"Monitoring activities are ICANN-initiated, based in part on industry articles, social media postings, previous complaints, and trend analysis in an effort to proactively address any alleged failure to comply with contract terms." In 2020, ICANN-initiated monitoring resulted in the submission of 1,412 complaints for processing. These complaints represented roughly 8% of the total complaints submitted that year.

Auditing

The Audit Program is a continuous, ongoing activity that follows a recurring cycle. Each audit round consists of six phases:

1. Planning Phase: ICANN plans the audit scope and timeline.
2. Request for Information (RFI) Phase: ICANN issues a notice of audit to the selected contracted parties, who must compile information and respond to the audit request.
3. Audit Phase: ICANN reviews, tests, and validates the responses to ensure compliance with the contractual obligations.
4. Initial Report Phase: ICANN issues a confidential initial audit report to each auditee containing the initial findings and allowing the contracted party to address the findings or provide clarity.
5. Remediation Phase: ICANN collaborates with the auditees to remediate issues.
6. Final Report Phase: ICANN issues a confidential final audit report to each auditee. ICANN also summarizes the audit round in an overall audit report.

RAA Audit Rights

2009 Amendment Process

ICANN's right to audit registrars for compliance with contract provisions was added to the Registrar Accreditation Agreement in 2009 during the amendment process for the RAA. The amendments permitted ICANN to audit registrars for compliance with the following contract requirements:

• maintenance of a functioning WHOIS lookup service;
• collection, verification, review, and retention of valid registrant data;
• inclusion of mandatory provisions and policies in the registrar's registrant agreement;
• inclusion of mandatory provisions and policies in the registrar's reseller agreements, as well as RAA-mandated handling of any registrant data submitted via a proxy or privacy service;
• compliance with all consensus and temporary policies in existence (at the time, the UDPR, Expired Domain Deletion Policy, and WHOIS Data Reminder Policy);
• published link to ICANN's registrant educational information;
• proof of completion of a required training course by the registrar's primary contact or designee; and
• maintenance of valid contact information on the registrar's website and within RADAR.

2013 Expansion of RAA Audit Rights

Starting in 2011, ICANN engaged in a cooperative process of negotiations with accredited registrars to review and update the RAA. The resulting amendments to the RAA were approved by the ICANN Board in June 2013. The amendments expanded ICANN's audit rights in a number of ways:

• Increased compliance requirements around notice to registrants of ICANN policies;
• Increased compliance requirements regarding contractual relationship to resellers and reseller compliance;
• Additional consumer protection measures, such as ensuring a registrar had a published complaint and dispute resolution policy;
• Technical specifications regarding WHOIS and IPv6; and
• Requirements regarding DNS abuse and security threat reporting.

Registry Agreement Audit Rights

The base Registry Agreement, created in advance of the new gTLD round, grants ICANN or its subcontractor the right to perform "contractual and operational compliance audits" after "reasonable advance notice" has been provided to the registry operator.

DNS Security Threat Audits

In 2018, Contractual Compliance announced that it intended to broaden the scope of its audit RFIs to include questions specific to RAA Section 3.18, which deals with registrars' threat prevention, reporting, and response processes. At the same time, the department updated its Registry Operators audit plan to "[review] processes and procedures related to preventing, identifying and handling of abusive domains. Specifically, testing is focused on verification of existence of technical analysis (security threats) reports and review for reports’ completeness in comparison to publicly available sources." Since approval of the first base Registry Agreement for new gTLDs, there have been DNS security-related requirements for registry operators. The July 2013 base Registry Agreement contained abuse mitigation provisions requiring registry operators to publish contact information for abuse reporting, and to take action to remove orphan glue records "when provided with evidence in written form that such records are present in connection with malicious conduct." Other provisions address issues of technical security and baseline operational standards.

The alterations to scope were part of a previously announced initiative to increase attention to security threats, partially in response to community and stakeholder group concerns that ICANN was not doing enough to respond to threats to the DNS infrastructure.

2019 Registry Operator Audit

In November 2018, ICANN Contractual Compliance launched a Registry Operator Audit for Addressing DNS Security Threats. The audit was conducted from November 2018 to June 2019, and reviewed data and reports from 1207 TLDs. The report on the audit, released in September 2019, reported that of the 1207 TLDs reviewed during the audit, "approximately five percent (5%) of the audited ROs subject to Specification 11, Section 3(b) were not performing any security threat monitoring, despite having domains registered in their gTLDs." The report noted that many of the non-complying registries had a limited number of registrations:

In most of these cases, ROs cited a low number of registrations or tightly controlled and exclusively internal registration (e.g., where the gTLD has an ICANN-approved Specification 13 .brand designation). While the audit revealed that RBLs currently do not identify any threats originating from .brand gTLDs, Compliance explained to these ROs that monitoring is a contractual obligation that does not depend on the number or type of registrations. Remediation was required in all cases.

The report stated that, incidences of noncompliance notwithstanding, most registry operators employed good security practices.

2021 Registrar Audit

In February 2021, Contractual Compliance launched an audit of registrars' compliance with abuse-specific requirements of the RAA. Registrars were selected for audit if they at least 5 domains listed in the the Security Threat Reports received during the 2019 Registry Operator Audit, or listed in the November 2020 OCTO Abuse Reports based on metrics from Reputation Block Lists (RBLs). During the RFI phase, one registrar was terminated for unrelated reasons, leaving a total of 126 registrars in the audit pool. The registrars being audited managed over 90% of all registered second-level domains at the time of the audit. Of the 126 registrars audited, deficiencies were identified within three different categories of compliance requirements:

Registry Agreement Requirement	# of Registrars with Deficiencies	% of Registrars with Deficiencies
General Abuse Reporting (RAA 3.18.1)	46	37%
Law Enforcement Abuse Reporting (RAA 3.18.2)	33	26%
Abuse Handling Procedures (RAA 3.18.3)	78	62%

In total, only 15 registrars passed the audit process without any notice of deficiency. Of the remaining 111 registrars, 92 cured all reported deficiencies before the end of the audit's remediation phase. 19 registrars were unable to cure all deficiencies within the audit timeframe, and negotiated due dates with Contractual Compliance for completion of their work to cure.

Outreach

Contractual Compliance presents frequently at ICANN meetings, and conducts seminars and other educational programs throughout the ICANN regions.

Roles at ICANN

• Senior Manager, Contractual Compliance Risk and Audit
• SVP, Contractual Compliance & U.S. Government Engagement
• Contractual Compliance Risk and Audit Senior Specialist
• Contractual Compliance Lead
• Sr. Manager, Contractual Compliance
• Contractual Compliance Analyst
• Contractual Compliance Specialist
• Contractual Compliance Senior Specialist

General Data Protection Regulation