RIPE NCC Audit & Compliance:
A Practical Guide

If your organisation holds Internet number resources in the RIPE NCC service region, you will at some point engage with the RIPE NCC's registry accuracy processes. This may come in the form of a routine Assisted Registry Check, or — less commonly — a targeted investigation triggered by a specific concern.

This guide explains both processes, what the RIPE NCC is looking for, and how to prepare so that the engagement is constructive and efficient. It is written from the perspective of someone who has overseen these processes from within the RIPE NCC — and who now advises organisations on how to engage with them effectively.

Two Distinct Processes

It is important to understand that the RIPE NCC operates two separate registry accuracy processes. They differ in their triggers, scope, and implications.

Both processes serve the same underlying goal: maintaining the accuracy and integrity of the RIPE Registry. The RIPE NCC is mandated by the RIPE community to conduct regular audits of LIRs and ensure consistent, fair implementation of community-developed policies. Understanding which process you are engaged in — and why — is the first step toward handling it well.

The Assisted Registry Check (ARC)

The ARC is the RIPE NCC's primary mechanism for maintaining periodic contact with its members and ensuring registry data remains accurate. It replaced the older allocation-triggered audit process, which became less frequent as IPv4 free pool allocations dried up.

The RIPE NCC's stated goal is to complete thousands of ARCs annually — with a 2025 target of 2,400 checks, supported by additional staffing and increasing automation. The re-verification period for legal registration data is also being shortened from five years to two, meaning members can expect more frequent contact from the RIPE NCC going forward.

What Triggers an ARC

ARCs are predominantly periodic. The RIPE NCC works through its membership systematically rather than targeting specific organisations. You do not need to have done anything wrong to receive one — it is a routine part of being a RIPE NCC member.

What the RIPE NCC Checks

The ARC review covers three broad categories:

Registry data consistency. Is your LIR's legal name, postal address, and contact information accurate and current? Are the details in your LIR Portal account consistent with your organisation's actual registration? The RIPE NCC cross-references member data against external business registries (using providers such as Altares Dun & Bradstreet) and expects these to match.

Resource consistency. Are your IPv4, IPv6, and ASN registrations in the RIPE Database accurate and up to date? Do your assignments and sub-allocations reflect real, current use? Are your sponsored resources — independent assignments issued through your LIR to end users — properly documented, with valid contractual relationships still in place?

Routing and reverse DNS consistency. Do your route objects in the RIPE Routing Registry match your actual BGP announcements? Are there lame reverse DNS delegations that need attention? The RIPE NCC can also offer RIPE Atlas reachability testing as part of this process.

What to Expect During the Process

The ARC typically begins with an email to all registered contacts for your LIR. You designate one contact person to engage with the RIPE NCC for the duration of the check. The RIPE NCC then schedules a call with an IP Resource Analyst (IPRA), during which the checks are reviewed together.

A typical ARC takes two to four weeks from initial contact to completion, assuming prompt cooperation. Larger or more complex operations with extensive resource holdings may take longer. The process is designed to be collaborative — the RIPE NCC offers personalised support to help resolve any issues found.

Possible Outcomes

In most cases, the ARC concludes with minor corrections: updating contact details, cleaning up stale database objects, or resolving rDNS issues. If unused or unjustified resources are identified, the RIPE NCC may ask you to return or deregister them. This is not punitive — it is the registry functioning as designed.

Non-cooperation is taken seriously. Persistent failure to engage or to justify resource holdings can escalate, potentially leading to deregistration of resources. In extreme cases involving sustained non-cooperation, LIR closure is a possibility — though this is rare and represents a last resort.

Registry Investigations

Separate from the routine ARC process, the RIPE NCC conducts targeted investigations when a specific concern is identified. These are less common but carry higher stakes.

What Triggers an Investigation

Investigations are event-driven rather than periodic. Common triggers include:

• Third-party reports — a complaint from another member, a network operator, or an external party flagging potential misuse or policy non-compliance.
• Internal monitoring — the RIPE NCC's own Registry Monitoring team detecting anomalies, suspicious patterns, or data inconsistencies through automated systems or routine screening.
• Sanctions screening — the RIPE NCC screens members against applicable EU sanctions lists and flags accounts that require further due diligence.
• Transfer-related checks — transfers of Internet number resources trigger additional scrutiny to ensure policy compliance and prevent fraudulent mutations.

The scope of an investigation is typically narrower but deeper than an ARC. The RIPE NCC may be examining a specific allocation, a particular transfer, or a pattern of resource usage that appears inconsistent with policy requirements.

How Investigations Differ from ARCs

Where an ARC is collaborative and advisory in tone, an investigation is more formal. The RIPE NCC may request specific documentation, justification for resource usage, or evidence that policy requirements are being met. Response timelines may be firmer, and the process is managed by the Registry Monitoring team rather than the standard Registration Services team.

The potential outcomes are also more consequential. If the investigation concludes that a policy violation has occurred, the RIPE NCC may require corrective action — which can range from updating registry records to returning resources. Serious or repeated violations can lead to LIR closure.

How to Prepare

Whether you are expecting a routine ARC or responding to an investigation, the preparation fundamentals are the same. Organisations that maintain good registry hygiene as a matter of course will find either process straightforward.

Keep Your Registry Data Current

Ensure your LIR Portal account reflects your organisation's current legal name, address, and contact details. Verify that the registration data matches what appears in your national business registry. With the RIPE NCC now using automated monitoring of company registration changes, discrepancies are likely to be flagged more quickly than in the past.

Audit Your Resource Registrations

Review your IPv4 and IPv6 assignments and sub-allocations in the RIPE Database. Are they accurate? Do they reflect current use? Pay particular attention to:

• Assignments to customers or end users that no longer exist or no longer need the space
• Sponsored resources where the underlying contractual relationship has ended
• Allocations from completed projects, cancelled deployments, or expired quarantine periods
• Objects with a status of AGGREGATED-BY-LIR — be ready to provide underlying assignment statistics if asked

Check Your Routing Consistency

Verify that your route objects match your actual BGP announcements. Identify and resolve any lame reverse DNS delegations. Tools like RIPEstat and the RIPE Database's own consistency checks can help you spot issues before the RIPE NCC does.

Document Your Justifications

For any resources that might require justification — particularly larger allocations or those received through transfers — ensure you can demonstrate the basis on which they were allocated and evidence of current use. Network diagrams, addressing plans, and customer assignment records are all relevant documentation.

Respond Promptly and Constructively

This is the single most important piece of advice. The RIPE NCC's processes are designed to be constructive. Engaging promptly, providing complete information, and demonstrating willingness to resolve any issues identified will almost always lead to a positive outcome. Delays, incomplete responses, or adversarial engagement make everything harder — for both sides.

Common Mistakes to Avoid

Panicking. Receiving an ARC notification does not mean you have done something wrong. It is a routine process that all members go through. Approach it calmly and professionally.

Providing incomplete information. If the RIPE NCC asks for documentation, provide it fully and promptly. Partial responses lead to follow-up requests, which extend the process and can create an impression of reluctance.

Not understanding the policy basis. If you receive a request related to a specific policy requirement, take the time to read and understand the relevant RIPE policy document before responding. The RIPE NCC implements policies developed by the RIPE community — understanding the policy framework helps you engage on the right terms.

Ignoring the process. Non-responsiveness is the fastest path to escalation. Even if you need more time to gather information, acknowledge the RIPE NCC's communication and indicate when you will be able to respond substantively.

Assuming it will go away. The RIPE NCC's commitment to registry accuracy is only increasing — with more ARCs, shorter re-verification cycles, and expanded automation. Registry engagement is becoming more frequent, not less.

The Broader Context

The RIPE NCC's investment in registry accuracy is accelerating. The 2025 Activity Plan calls for thousands of ARCs, a dedicated Registry Monitoring team with expanded resources, more extensive sanctions screening, and automation that detects changes in company registration details. The re-verification period for legal data is being shortened from five to two years — meaning more frequent touchpoints between the RIPE NCC and its members.

For organisations holding Internet number resources, this means that maintaining accurate, well-documented registry data is no longer optional good practice — it is an operational requirement that will be checked regularly. Organisations that treat registry compliance as an ongoing discipline rather than a periodic fire drill will find these engagements routine and productive.