Any organization that buys, sells, or leases IPv4 address blocks needs a clear chain of custody. It’s that simple. Regulators, the Regional Internet Registries (RIRs), and acquiring companies increasingly ask for documented proof of legitimate ownership, and a broken custody trail can invalidate a transaction or trigger a post-transfer audit. This guide covers the documentation you’ll need, why it matters, and how to build an audit-ready record for every transfer.<\/p>\n
IPv4 addresses are worth real money now \u2014 often $30 to $50 per address \u2014 and that kind of value attracts scrutiny. During mergers and acquisitions, due diligence teams routinely verify that the address blocks sitting on a balance sheet are actually held by the selling entity. Legally held, that is. If your documentation can’t trace custody from the original RIR allocation through every intermediate transfer, the asset may get written down or the deal renegotiated. Neither conversation is pleasant.<\/p>\n
Compliance auditors also check against the RIR policies of ARIN, RIPE NCC, APNIC, LACNIC, and AFRINIC. Each registry requires that transfers happen between documented resource holders, with legitimate need demonstrated where applicable. And here’s where things get messy: gaps are common. A legacy block used under a handshake agreement decades ago, for instance. Auditors follow guidelines like SOC 2 and ISO 27001 too, which require proof that network assets are inventoried and controlled. A well-maintained chain of custody satisfies these requirements in one package \u2014 and it reduces your legal exposure if a third party later claims a block.<\/p>\n
A custody trail you can defend rests on a consistent document set. For each hop in the ownership history, keep the following:<\/p>\n
Leases call for a bit more: the lease agreement, permitted-use schedules, and any renewal or termination notices. Keep everything in both signed PDF and text-searchable formats. Auditors appreciate being able to verify quickly \u2014 and you’ll appreciate the shorter audit.<\/p>\n
Practical tip:<\/strong> Marketplaces with verified sellers, such as IP4 Market, pre-validate ownership documentation before listing. That gives buyers a head start on a clean, audit-ready custody trail.<\/p>\n<\/div>\n It happens to seasoned teams too. An audit comes apart over something almost embarrassingly small. I’ve seen it more than once. The usual suspects: intra-company transfers nobody wrote down, where a block moved between subsidiaries with no bill of sale, no assignment letter, nothing. And legacy documentation from the pre-RIR era, back when IANA allocated blocks directly or companies received space before formal registry policies even existed. Try reconstructing that paper trail twenty years later.<\/p>\n Other problems show up again and again:<\/p>\n Auditors see any break in the documentary trail as a possible title defect. Fix these gaps before the audit starts, not in the middle of it. The difference can be weeks of remediation work.<\/p>\n You don’t have to do all this verification by hand. The RIR databases themselves are the obvious starting point: ARIN’s Whois and RESTful API, RIPE NCC’s database lookups, APNIC’s MyAPNIC records. All of them show current registration data, transfer history where it’s been reported, and resource certification status.<\/p>\n Then layer RPKI validation on top. ROAs published through the RIR confirm that whoever is registered actually authorizes your route announcements \u2014 and a valid chain of custody should line up with your RPKI configuration. If it doesn’t, that’s a red flag worth chasing down.<\/p>\n Marketplace tools fill in the rest. Established platforms keep transaction logs for every block traded through them: escrow confirmations, seller verification records, RIR transfer approvals. IP4 Market, for instance, checks seller ownership documentation before a listing even goes live, and handles escrowed transfers for buyers. Part of your diligence, in other words, is already done and documented before you lift a finger.<\/p>\n A practical workflow:<\/strong> confirm registry registration, check RPKI status, review transfer history in RIR records, ask the seller for their acquisition documents, and route payment through escrow. Five steps. Each one leaves you a timestamped artifact for the custody file.<\/p>\n<\/div>\n What keeps documentation audit-ready isn’t some heroic one-time cleanup. It’s boring, disciplined habits:<\/p>\n Here’s the thing: a complete chain of custody isn’t just for auditors. These address holdings are often worth millions, and missing paperwork invites disputes that can drag on for years. Organizations with verified, complete records move through RIR transfers and compliance reviews without friction; the ones with gaps watch deals stall or die outright. Treat the custody documentation the way you’d treat financial records \u2014 with the same rigor, the same retention discipline \u2014 and lean on RIR tools and trusted marketplaces to strengthen the evidence base. Do that, and your address portfolio stays audit-ready for the long haul.<\/p>\nDocumentation Gaps That Fail Audits<\/h2>\n
\n
Using Marketplaces and RIR Tools to Verify Ownership History<\/h2>\n
Best Practices and Conclusion: Audit-Ready IPv4 Records<\/h2>\n
\n