Revising ICP-2 : ICANN’s Draft RIR Governance Document (Apr 2025)

Introduction

The Internet Corporation for Assigned Names and Numbers (ICANN) and the Number Resource Organization (NRO) have initiated a major revision of ICP-2 (Internet Coordination Policy 2) — the global policy that defines the criteria and processes for the recognition and potential derecognition of Regional Internet Registries (RIRs). A newly drafted governance framework was published on April 14, 2025, aiming to update ICP-2 for the first time since 2001. In this article, we explain what ICANN, the Address Supporting Organization (ASO), and ICP-2 are; why the AFRINIC crisis prompted this revision and what the new draft “Governance Document for the Recognition, Maintenance, and Derecognition of Regional Internet Registries” is about. We will also deep into history of the ICP-2 development, explain the proposed changes in comparation with the original ICP-2 and discuss the current status of ICP-2 implementation.

ICANN, the ASO, and ICP-2: Background

ICANN (the Internet Corporation for Assigned Names and Numbers) is the global non-profit coordinator for Internet unique identifiers (like domain names , ASNs and IPv4 or IPv6 addresses). Within ICANN’s multistakeholder structure, the Address Supporting Organization (ASO) is one of ICANN’s three Supporting Organizations (SOs). The purpose of the ASO is to review and develop recommendations on Internet Protocol (IP) address Policy and to advise the ICANN Board on matters related to the allocation, assignment, and management of IP addresses.

The RIRs coordinate their global activities through the Number Resource Organization (NRO), which was formally established in 2003 via a Memorandum of Understanding (MoU) signed by the four then-existing RIRs (APNIC, ARIN, LACNIC, and RIPE NCC). The RIRs are responsible for administering and allocating IP addresses/AS numbers in their respective regions, as part of the global Internet Numbers Registry System defined in RFC 7020, while the NRO, as the coordinating body for the five RIRs , fulfils the role, responsibilities and functions of the ASO. The ASO and NRO are two separate bodies, while they are closely linked. Each of them have distinct responsibility. These functions and responsibilities are outlined in the ICANN-ASO MoU. The NRO has a Number Council (NRO NC) — an elected body of 15 volunteers from the five RIR regions which serves as the ASO Address Council (ASO AC) within the ICANN structure. ASO AC within the ASO manages the ASO’s global policy development process. While similar in name, the ASO and the ASO AC are distinct groups and have separate responsibilities. The ASO AC participates in the Global Policy Development Process (GPDP) and provides recommendations to the ICANN Board, including on matters such as the recognition of new RIRs. The ASO does not itself create policies for Internet number resources, but ensures that the GPDP is properly followed across all RIR regions.

Policy Development Process – Overview

Internet Coordination Policy-2 (ICP-2) – Criteria for the Establishment of New Regional Internet Registries is one of the first ICANN policy documents developed through the ASO, with the assistance of APNIC, ARIN, and RIPE NCC. It was recommended by the ASO AC and accepted by the ICANN Board of Directors on June 4, 2001, as a statement of essential requirements for the recognition of new Regional Internet Registries (RIRs). The policy serves as a framework for evaluating applications for the recognition of new RIRs. ICP-2 outlines the fundamental principles and criteria that an organization must meet to be recognized as a new RIR. While APNIC, ARIN and RIPE NCC were established prior to ICP-2’s adoption in 2001, this was the procedural document under which 2 new RIRs were established and recognised: LACNIC in 2002 and AFRINIC in 2005.

The main idea of regional distribution of number resources, as well as the core principles and criteria for Regional Registries included in the original ICP-2, were actually written down in October 1992 in RFC1366, more than 20 years before the ICP-2’s adoption . RFC 1366 was updated several times and was eventually replaced by RFC7020 in 2013. The three main principles carried over from RFC 1366 into the original ICP-2 were that a Regional Registry must be:

Unbiased
Widely recognized by network providers and subscribers within the geographic region (such as ISPs and The Operators Community)
A single regional registry per geographical region at this level.

The RIR must be neutral and independent from governments and other organizations. It must have broad community support within its geographic region to be eligible to fulfill its obligations. There must be only one regional registry per geographical region to ensure efficient and fair sub-allocation of address space and to prevent unnecessary fragmentation.

In total, the original ICP-2 identified ten basic principles, and the remaining ones are:

Bottom-up self-governance structure for setting local policies;
Technical expertise. The new RIR must be technically capable of providing the required allocation and registration services to the community in its region;
Adherence to global policies regarding address space conservation, aggregation and registration;
Activity plan. The new RIR should provide a published activity plan containing activities that are clearly within the purview of an RIR, and which is explicitly supported by the community;
Funding model. The new RIR should be established as a not-for-profit association;
Record Keeping. All RIRs must maintain proper records of all registry activities;
Confidentiality.

As can be seen from the principles listed above, the existing ICP-2 focuses solely on how to establish a registry and the criteria it must meet at the time of recognition — it addresses neither the full operational lifecycle of an RIR, including continued compliance, nor what should happen if a registry later fails to meet those criteria.

Just a curious fact:

The RIPE NCC was formally established in April 1992, a few months before RFC 1366 was published. After the policy came out, the RIPE NCC already met all the criteria, so it quickly began allocating subnets within its region. That same year, the RIPE NCC Internet Numbers Registration Procedure (ripe-065) was published. RIPE NCC became the first RIR. ICANN was only incorporated in 1998, and the original ICP-2 was implemented by ICANN in 2001, when three of the five existing RIRs were already operational: RIPE (since 1992), APNIC (since 1993) and ARIN (since 1997).

The last RIR was established and recognised under the current ICP-2 in 2005; and the document has remained unchanged for almost twenty-five years. The Internet has changed significantly since then, and the ongoing crisis in AFRINIC has made it clear that it is time to revise the policies — not only to define how a Regional Internet Registry is created, but also to ensure that it continues to meet its responsibilities over time. In cases where a Regional Internet Registry can no longer meet the required criteria, the policy must also include the possibility of de-recognizing it. For this reason, in 2023 the NRO Executive Council has formally tasked the ASO AC with two objectives: first, to review and revise ICP-2 so that it applies not only to the recognition of new RIRs, but to the full operational lifecycle of a Regional Registry — including continued compliance and potential de-recognition; and second, to strengthen and modernize the criteria themselves to reflect today’s realities.

AFRINIC’s Governance Crisis and the Need for Revision

In recent years, a serious governance crisis at AFRINIC — the RIR for Africa and the sole source of numbering resources for network operators on the continent— revealed weaknesses in the existing policies. Starting from 2020, AFRINIC faced lawsuits, financial and organizational problems, and accusations of mismanagement. Since 2023, it has had no functioning Board of Directors or CEO, and core services have been breaking down: membership applications have not been processed, and even existing members have been unable to obtain IP address allocations. Concerned that AFRINIC could collapse, the Bankruptcy Division of the Supreme Court of Mauritius placed the organization under the control of a court-appointed Official Receiver. This legal receivership effectively froze any major changes at AFRINIC and was intended to prevent its complete failure. To this day, AFRINIC remains unable to carry out its core responsibilities.

The AFRINIC situation highlighted the need for a global policy to oversee the full lifecycle of RIRs — including the potential de-recognition of a RIR as a last resort. Akinori Maemura, Chief Policy Officer at the Japan Network Information Center (JPNIC) and former member of the ICANN Board of Directors, linked the decision to revise ICP-2 with AFRINIC during the Cooperation Special Interest Group (SIG) session at APNIC 58. He noted:

“Now we have a problem with AFRINIC malfunctioning, and this needs to be fixed. We realized that while we have criteria for recognizing an RIR, we forgot to define how to maintain its functionality — and what to do if it fails. This is what we are trying to address in the ICP-2 revision.”

In October 2023, responding to these concerns, the NRO Executive Council formally requested that the ASO AC initiate a process to update ICP-2 and “provide a stronger RIR framework to meet current needs.” The request outlined two tasks:

Review draft ICP-2 Implementation procedures
Strenghten ICP-2

Since then, the ASO AC has begun work on these tasks.

The ICP-2 Revision Process (2023–2025)

The effort to revise ICP-2 has been conducted in an open, collaborative manner across 2024 and 2025. The ASO AC took the lead in managing the project, coordinating closely with all five RIR communities and ICANN.

The first milestone was to agree on high-level principles for the new policy. By mid-2024, the ASO AC produced a “Proposed ICP-2 Version 2 Principles” document outlining 24 core principles to guide the revision. The NRO NC invited the global RIR communities to provide feedback on each proposed principle through a questionnaire, which was open from 8 October to 6 December 2024. Respondents were able to rate each principle on a scale from ‘Strongly Disagree’ to ‘Strongly Agree’, with space to leave comments on individual principles and general feedback at the end.

The 24 proposed principles offered for discussion were:

Authority: Any proposal to recognize a Candidate RIR or to derecognize an RIR must originate from the NRO EC after a majority vote in favor of the proposal. ICANN shall have final authority to decide whether to adopt the proposal
Amendment: ICP-2 may be amended upon the agreement of ICANN and all RIRs
Rectification: If an amendment to ICP-2 conflicts with an RIR’s existing policies, practices, or bylaws, the amendment shall prescribe a reasonable but specific grace period for the RIR to bring its conflicting policies, practices, or bylaws into conformity with ICP-2 before the RIR may be considered non-compliant.
Coverage: All RIRs shall jointly ensure that all areas on the globe continually receive RIR services.
Service Region: The Region for which an RIR is responsible shall cover a large multinational geographic area and shall not overlap with that of another RIR.
Recognition: A Candidate RIR must meet or demonstrate that it can meet all the requirements to be recognized as an RIR.
Operation: An RIR, once recognized, must continually meet all the requirements specified in ICP‑2 in an auditable fashion.
Derecognition: An RIR that does not continue to meet all the requirements specified in ICP-2 may be derecognized as an RIR.
Community Support: Resource Holders in the Region that the Candidate RIR proposes to serve must broadly support recognizing the Candidate RIR as the RIR responsible for serving that Region.
Community Commitment: A Candidate RIR must demonstrate that its community is willing to support the RIR, both financially and by actively participating in its governance.
Independence: An RIR must be financially stable and independent.
Not-for-Profit: An RIR must operate on a not-for-profit basis.
Corporate Governance: An RIR must follow corporate governance procedures consistent with best practices in its jurisdiction.
Member-Controlled: The majority of an RIR’s governing body must be elected by the RIR’s Members, and the governing body must maintain effective control over the RIR.
Community-Driven: An RIR must maintain a community-driven policy development process that is open, transparent, neutral, and publicly documented.
Neutrality: An RIR must operate and apply its policies in a manner that is neutral and consistent.
Transparency: An RIR must maintain and publish comprehensive records of its governance, activities, and finances.
Audit: An RIR must participate in regular audits by an external and independent auditor to ensure that it is continuing to comply with ICP-2.
Service: An RIR must provide stable, reliable, secure, accurate, and accountable allocation, registration, and directory services, as well as related technical services, using standard protocols and specifications for cross-RIR compatibility.
Continuity: An RIR must maintain continuity procedures and redundancies and participate in record sharing that would enable another RIR to perform its RIR services, if necessary.
Anti-Capture: An RIR must maintain governance rules and controls to prevent itself from becoming captured.
Ecosystem Stability: Each RIR must cooperate to ensure the ongoing operation and stability of the global Internet number registry system
Handoff: A Derecognized RIR must cooperate with ICANN and other RIRs to ensure the smooth transfer of its operations to a successor or interim entity designated in any derecognition decision.
Remedial Bias: ICANN and all other RIRs must provide all reasonable support, if requested, to assist an RIR to cure any failure to comply with ICP-2 before derecognizing the RIR

As we can see from the list above, these draft principles cover RIR governance, the Internet number ecosystem, lifecycle obligations, recognition criteria, and operational requirements. Importantly, they also introduce principles for potential de-recognition of an RIR that fails to meet the criteria — making this version fundamentally different from the original ICP-2, which focused solely on the principles for recognizing new RIRs.

On 24 February 2025, the NRO NC published a qualitative analysis and summary of the community responses to the questionnaire, as part of the effort to update ICP-2: 298 responses were received, while almost half the submissions appeared to be duplicate texts, possibly AI-generated: there was a set of responses that were all essentially identical with slight variations and wording and were consolidated for a linguistic analysis using a deep learning model called BERT. The analysis results showed that around 150 of the 298 responses fell into clusters of closely related answers. After manual review, similar responses were filtered and treated as a single input. This led to objections from the community, with some arguing that individuals who are not fluent in English might have used translation tools, which could result in similar phrasing. However, the authors clarified that the detected pattern was not based on English language structure alone, but on the overall similarity of entire responses.

The report highlighted broad community consensus on many of the proposed principles, while also identifying areas that need further clarification. Concerns were raised that implementing ICP-2 is likely to be complex and will require careful attention to detail — both in its application and in the updated policy text itself. There were also calls for further discussion on how RIRs should operate in regions where external factors, such as sanctions or conflicts, may limit their ability to provide services. One respondent even suggested that outer space could be considered a region in the future.

What’s Next for the ICP-2 Revision?

As of April 2025, The ICP-2 revision process has moved from principle-setting to concrete policy drafting. On April 14, 2025, the NRO NC published the first full draft of the ICP-2 replacement policy, titled “Governance Document for the Recognition, Maintenance, and Derecognition of Regional Internet Registries.” The draft RIR Governance Document based on new principles listed above is organized into sections defining key terms, outlining roles and responsibilities, specifying the process for RIR recognition or derecognition, detailing the ongoing commitments of RIRs, and describing the effects of derecognition and how amendments to the policy can be made. The name itself signals the expanded scope: unlike the original ICP-2, which only defined basic principles for recognizing new RIRs, this is now a full policy framework. It covers not just how RIRs are created, but how they are expected to operate, be governed, and — if needed — be de-recognized. It’s no longer just about the starting point; it’s about the full lifecycle.

Now the draft “RIR Governance Document” is in a public consultation phase. The NRO has invited feedback from all RIR communities, with a deadline of 27 May 2025 for comments. Over the coming weeks, there will be dedicated webinars and information sessions (some coinciding with RIR meetings and the ICANN 83 meeting in June 2025) to explain the draft and answer questions.

After the consultation window closes, the ASO AC (NRO NC) will compile the feedback and likely hold another workshop to discuss any adjustments to the draft. If significant changes are suggested by the community, those will be incorporated as the draft is refined. The aim is to ensure that the policy language has consensus support from the people it will affect – i.e., RIR members and the Internet number resource community at large.

Conclusion

The ICP-2 revision is entering its final phase, with community input helping to shape the remaining details. This update marks a major step forward in strengthening the governance of the global Internet infrastructure. By learning from the AFRINIC crisis, the community is building a more resilient system — one that can support not only continued stability in IP address distribution, but also ensure accountability and transparency across all regions.

The new document is no longer just a set of recognition principles. It introduces a full policy framework that covers the entire lifecycle of an RIR — from creation to ongoing operations, and, if necessary, de-recognition. This gives the system both room to grow (for example, if a new RIR emerges in the future) and a mechanism to respond to critical governance failures, all while preserving the bottom-up, community-led model that has defined Internet governance for decades.

Looking ahead, if the Governance Document for RIRs is adopted, we may see more structured reporting from RIRs to their communities — knowing that independent audits could happen. Either way, the new ICP-2 would provide a clear framework that can be activated if any RIR — including AFRINIC or others — faces serious trouble in the future.

The existence of a de-recognition mechanism could have a preventive effect, motivating RIRs to follow best practices and avoid triggering audits or intervention. Ultimately, this revision reflects the Internet community’s commitment to evolving governance models and ensuring they continue to serve future generations. Broader participation, active engagement, and open policy development remain key to keeping the Internet stable, inclusive, and truly global.

Author: Anastasia Kleiman