Sanctions screening in IPv4 and ASN deals: what EU companies should check

IPv4 addresses and ASNs are bought, sold and leased across borders, often between parties who never meet. For an EU company, that makes sanctions screening a standard part of every deal rather than an afterthought. This guide covers why the rules apply, which lists to use, who to screen and how to build the checks into a transaction.

Why sanctions rules reach IP resources

EU sanctions, formally called restrictive measures, are adopted by the Council of the EU. They apply within the EU, to companies incorporated in a member state wherever they operate, to EU nationals, and to any business done wholly or partly in the EU.

Asset-freeze measures prohibit making funds or economic resources available, directly or indirectly, to listed persons and entities. “Economic resources” is defined broadly, and IP addresses and ASNs have clear economic value, so it is prudent to treat transfers, leases and payments involving them as within scope. Some regimes, including those concerning Russia and Belarus, also go well beyond asset freezes and restrict particular services, which matters if a lease is bundled with hosting or IT services.

The registry is part of the picture too. The RIPE NCC is an association established in the Netherlands, is bound by EU sanctions and applies them to its registry services. Check its published sanctions information before planning a transfer that involves a party with any sanctions exposure.

Which lists to screen against

For an EU company, the starting point is:

• The EU Consolidated Financial Sanctions List, maintained by the European Commission, covering persons and entities subject to EU financial sanctions
• The EU Sanctions Map, which shows which regimes and sectoral measures apply to a given country
• National measures and guidance from your member state’s competent authorities; in Germany, the Deutsche Bundesbank handles financial sanctions and BAFA handles export controls

Other regimes can matter when your business has a link to them, for example US sanctions lists published by OFAC where US persons or US-dollar payments are involved, or the UK sanctions list for UK counterparties. Lists change frequently, so screen against current data at each stage of a deal, not a copy saved at onboarding.

Who to screen

Screening only the name on the contract misses much of the risk. In an IPv4 or ASN deal, check:

1. The counterparty entity, by full legal name, registration number and registered address, verified in the company register.
2. Beneficial owners. Making resources available to an entity owned more than 50% by, or otherwise controlled by, a listed person is generally treated as making them available to that person. Ask for an ownership chart, check it against transparency and company registers where you have access, and follow it to the natural persons at the top.
3. Directors and authorised signatories, who may themselves be listed or act for listed persons.
4. The registered resource holder. The organisation in the RIPE Database should match the seller or lessor. If it does not, find out why and screen the actual holder.
5. Payers and payees. Payments from a third party, or to an account in another name or jurisdiction, need an explanation, and those parties need screening too.
6. Lessees’ users and upstreams. When you lease space out, know who will announce it and where it will be used. A lessee can be clean while its customers or upstream networks are not.

Red flags in IP resource deals

Some warning signs come up repeatedly in this market:

• reluctance to disclose owners, or ownership charts that end in trusts or nominee shareholders
• recent changes of holder, directors or ownership shortly before the deal
• a RIPE Database holder that differs from the contracting party with no clear reason
• requests to pay through third parties, unusual jurisdictions or cryptocurrency
• address space or an ASN with routing history through networks in sanctioned jurisdictions
• geolocation or registry data pointing to a country under sectoral measures
• pressure to complete quickly or to skip documentation

None of these proves a breach on its own, but each needs a documented explanation before you go ahead.

Building screening into the deal

Screening works best as a routine step at fixed points rather than a one-off check:

• At onboarding: screen the entity, owners, directors and signatories, and record the date, the lists used and the result.
• Before transfer or lease start: screen again, since lists may have changed since onboarding.
• At each payment: your bank screens too, but do not rely on it to catch what you missed.
• During a lease: re-screen at regular intervals and whenever the lessee notifies a change of ownership or control.

Name matches are common, so resolve possible hits with identifiers such as registration numbers, addresses or dates of birth before drawing conclusions. If a match is confirmed, stop the transaction and follow the reporting obligations in the relevant regulation, which in practice means contacting the national competent authority.

Contracts should support the process. Useful clauses include sanctions representations and warranties, an obligation to notify changes in ownership or control, a right to suspend or terminate if a party becomes listed, and a duty to cooperate with registry checks. Keep the screening records with the deal file; they show the diligence behind your decision if it is ever questioned.

This article is general information, not legal advice; for a specific transaction, take advice from a lawyer who specialises in sanctions.

How TACS can help

Our ASN background check includes sanctions screening of holders alongside registry and routing history, so you see the full picture before committing. If you are planning a transfer or lease and want to talk through the checks it needs, Contact us.