IPv4 Escrow Process: How Transfers Stay Secure

By Savvas Bout, Founder of Prefixx. Last updated 20 October 2026.

Because of the large value of IP address space in dollars per IP address, the transfer of IPv4 addresses carries significant financial risk. That risk includes paying large sums of money for addresses that you have not seen printed on paper and cannot verify, for money paid to unknown individuals, through a month or more-long registry process.

IPv4 escrow is meant to fill this gap and guarantee that in the transfer of IP address space, neither party will walk off with the money and the IP addresses. This is already the case with the bulk of all IPv4 sales. In those transactions, the buyer writes a check or wires money on trust and the seller transfers control of IP address routing space before payment clears.

This in-depth post describes the escrow process for IPv4 transactions in detail. It explains what a proper escrow for an IPv4 purchase agreement looks like from signing the agreement to confirmation of transfer at the relevant RIR(s) and release of funds.

It also describes where deals go wrong and how the process differs for transactions that involve transfers at ARIN, RIPE NCC and APNIC. This is a must read for anyone looking at brokers to buy IPv4 addresses on their behalf or trying to structure their first transaction. It outlines exactly what you need to ask.

What is the IPv4 escrow process and why it exists

Escrow for IPv4 transactions functions similarly to that of real estate transactions. Funds of the buyer are held by a neutral third party until the transaction has been completed, and then the payment is released to the seller.

Without Escrow, there is no secure handoff point for a transaction to complete. The buyer would wire funds before confirmation of transfer of IP addresses by the seller, and the seller would attempt to complete the transfer of IP addresses before confirmation of payment by the buyer. Escrow resolves this impasse.

Why the trust gap exists

IPv4 address space is an intangible property. There is no physical delivery of the property and no deed is signed in a physical location. The property is transferred by means of a change to a database record at one of the five RIRs (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC).

Approval of a registry update by the RIR typically takes days to several weeks. Until the update is approved by the RIR (i.e. until the transfer has propagated through the various layers of the Internet) the buyer of IP has no IP addresses to use with them while the seller of IP still has those IP addresses in their name. In such a case each party has real financial risk while they wait for the other party to move first.

Why the secondary market made escrow standard

The five RIRs used to give out IPv4 addresses for free in big blocks, but they have all depleted their free pools by now. Today all newly assigned IPv4 address space is sold by the RIRs in the secondary transfer market. All such blocks have a market value and the sellers and buyers are mostly unknown to each other and may be based even in different countries.

The way Escrow functions, it mirrors the timelines of the transfer so that funds are released only upon confirmation by the RIR that the transfer has taken place. The funds cannot be released to neither party and the IP addresses taken by the other party. It is standard protection.

How a typical escrow arrangement works

One of the most used third-party escrow agents for IPv4 transactions is Escrow.com. There are other agents as well. Here is a general overview of the process:

• Buyer deposits funds with the escrow agent.
• Seller and broker submit transfer paperwork to the relevant RIR.
• RIR approves transfer and updates registry records.
• Escrow agent releases funds to the seller.

At Prefixx, every transaction we broker runs through escrow from day one. Our team handles the RIR paperwork on both sides. If you want to understand how we structure a specific deal, contact us and a consultant will walk you through it. With the structure clear, the next step is understanding exactly how each stage unfolds in practice.

How to sell IPv4 via escrow: step-by-step payment timeline

The process for IPv4 escrow is very similar. Funds are locked prior to transfer commencement and released upon full completion as confirmed by the registry in question. This is not a situation where one relies solely on the word of a broker. Here is a step by step description.

The six-stage sequence

1. Terms agreed. Buyer and seller confirm address block, price and RIR. Deal documented before any money is moved.
2. This option is funded by escrow. That means the buyer pays for this option by depositing funds in a third party’s escrow account. The seller has no access to these funds until the option expires or another event occurs.
3. The transfer has been submitted by the broker with all required documents. For the above transfer, at Prefixx we prepare the LOA, the RPKI ROA and the IRR route objects as part of our white-glove service, thus the buyer and the seller will not have to deal with these documents.
4. RIR Review, the Registry checks if the IPv4 address space in question is eligible to be assigned, reviews documentation provided by the applicant to prove ownership and satisfies other policy requirements. Review by ARIN and RIPE NCC typically takes a few days to several weeks, depending on current volume of applications and quality of submitted documentation.
5. Registry confirmation received. The escrow agent receives verified confirmation that the transfer completed successfully and the new block is now listed under the buyer's organization in the RIR database.
6. Funds released. Once verification confirmation has been received, payment to the seller is released by the escrow agent.

What happens if the RIR rejects the transfer

While rare, a transfer may be rejected by an RIR if the documentation provided is incorrect.

Why preparation quality matters

Most RIR delays and rejections are caused by incomplete or incorrect paperwork. Tixx quality control checks all blocks for ownership, transfer eligibility and routing quality before listing them on the Tixx exchange.

Verifying all this in advance of listing minimizes the chance of a rejection that would undo the transaction and cause delays to both parties. Knowing the sequence of events is not enough; one also needs to know what each party needs to confirm at each step.

What each party confirms at every checkpoint

Paying money with escrow is more than just using a payment channel. The release of money is bound to real events of registration. All parties are bound by certain obligations at each check point. Money will only be released if all conditions have been met.

Seller and buyer confirmations

1. The seller confirms that he is the owner of the block of shares and that he is eligible to sell them under the policies of the relevant RIR. The seller confirms that the block of shares is held in his name free of any encumbrances and that the shares are transferable under the policies of the relevant RIR. This confirmation must be provided prior to the payment of any funds.
2. Buyer confirms funds and routing details. The buyer deposits funds into escrow and provides their ASN and LOA destination. Without these routing details, the transfer paperwork cannot be prepared. Note: Submitting incomplete routing information at this stage is the most common cause of delays.

Broker and escrow agent confirmations

1. Tixx quality control is run on every block. Tixx by Prefixx checks for ownership, blacklists, routing health and RIR status. A health report and transfer readiness score is provided for each block which must pass this check before it can be sold to a buyer.
2. Documentation required to complete transfer of IP number space to RIR. After Tixx has cleared the necessary block(s), we prepare and submit the LOA, RPKI ROA and IRR route objects for the relevant space to the respective registry. The acknowledgment of the transfer request by the RIR now marks the next step to be completed.
3. Escrow Agent confirms receipt of payment and all conditions outlined in the documents have been satisfied. Funds are released from escrow to the Seller only upon confirmation by the RIR of the complete transfer of the Name. No Registry Event is created and no Release made.

Why the sequence matters

Note that each of these confirmations serves as a gate to the next step in the process.

How block size and registry region affect the escrow timeline

Escrow mechanics for registries of any size (number of blocks) remain the same. The RIR review window is simply embedded within the escrow hold period. Knowing where time goes can be key to buyer/seller expectations for the transfer process.

How each RIR adds its own review window

ARIN’s transfer policy is separate from that of RIPE NCC and APNIC. Each organization has its own set of documentation requirements as well as the amount of time that it takes for a member of staff to review applications. ARIN requires a needs justification for /22+ transfers.

RIPE NCC transfers are approved according to the RIPE NCC transfer policy and additional documentation may be requested by staff. APNIC approval for inter-regional transfers is via a separate approval process with its own time frames. LACNIC inter-regional transfers are typically dealt with by an intermediary and thus are not transferred directly from registry to registry.

For Intra-RIR transfers (i.e. where the block is completely within one RIR’s space), all approvals are through one approval system (e.g. ARIN’s). Inter-RIR transfers (e.g. a block registered at ARIN being moved to a holder in the RIPE NCC’s space) require approval from both RIRs and will not complete until both have completed their respective review processes. Time is required for the cross-registry coordination to complete. The funds held in escrow will not release until both sides have completed.

Block size and documentation complexity

A /16 holds more addresses than a /24. However, the underlying escrow mechanism for the larger block of addresses does not change. What changes is the documentation for the larger block of addresses and possibly the more detailed justification under the ARIN policies that are required. The LOA, RPKI ROA and IRR route objects for the larger block of addresses will cover more prefixes, thus requiring more work in preparation of the objects for the escrow.

Prefixx runs Tixx quality control on every block before the transfer begins. Ownership verification, blacklist status, routing hygiene and RIR standing are confirmed upfront. Catching issues before escrow opens avoids delays mid-process.

Regional pricing variation

Block size and registry region also affect market prices. For example, a /24 under ARIN can trade at a different price than an identical /24 under RIPE NCC in the same month. The prices for such blocks are not published anywhere officially.

Prices are influenced by regional demand, market supply and the transfer policy of the respective registry. Prefixx offers personalized offers valid for 72 hours that reflect the current market situation. As not all deals close perfectly, it is also important to know what happens if a deal falls through.

Failure cases: what happens when an IPv4 transfer falls through

The majority of IPv4 transfers complete without issue but in the rare instances where they don’t, the failure mode is far more important than the failure itself. The structure of the escrow holds the key to whether a failure results in financial loss for one party or not. Below we detail the four scenarios that can play out and how they complete.

When the RIR rejects the transfer

A transfer can be denied by a registry for a number of reasons including a seller not meeting eligibility requirements, a block being placed on policy hold. Alternatively, A recipient organization failing a needs-justification check against. ARIN policy. The funds of the buyer are held in escrow until the transfer has been approved or denied. If the transfer is denied the entire amount of the funds are returned to the buyer.

Tixx quality control is useful here. Prior to opening up escrow for a transfer, Tixx verifies the ownership information, transfer eligibility, RIR status, and other routing information. We catch any ineligibility issues here before they ever hit the registry.

When documentation breaks down

A seller unable to provide clean LOA documentation or WHOIS information inconsistent with the domain name creates a hold. While the seller attempts to resolve the matter, the hold will keep the escrow account open. If the matter cannot be resolved within the specified time frame, the transaction will be cancelled and all funds will be returned to the buyer.

This also applies to scenario four: Tixx discovers a blacklist hit after the transfer of a block of stock. Tixx checks twelve different DNSBLs before any buyer is blocked by a reputation-related issue. Post-transfer complaints regarding the condition of stock that has been re-sold are extremely exceptional since Tixx verifies the reputation of potential buyers in advance of any sale.

When the buyer does not fund

If a buyer fails to deposit funds into escrow within the agreed upon time frame for funding, the transaction will cancel. The seller’s property will go back on the market and the seller will not suffer any loss and we will not collect any commission.

We operate under a no-win-no-fee commission structure of three to eight percent paid by the seller only. Our interests are therefore aligned to ensure a clean close. The failure modes for a purchase transaction are distinct from those for a lease transaction where no transfer of registry is involved.

IPv4 blocks in escrow for leases vs purchases: key differences

It is important to note that the way Escrow works for IPv4 sales (i.e. buying IPv4 addresses) is very different from the way Escrow works for IPv4 leasing. The mechanics, the trigger events, and the degree of protection for the money of both parties can be quite different from deal to deal. Additionally, Thus important to clarify before the actual closing of a deal.

How escrow works in a purchase

In a straight purchase, escrow is the vehicle for settlement. Buyer pays money prior to RIR transfer commencement and that money is held by the escrow agent until receiving RIR confirms that transfer has completed. There is no uncertainty as to trigger point: transfer confirmed, funds released.

The RIR transfer process itself takes some time. Each of the RIRs (ARIN, RIPE NCC and APNIC) has their own set of queues and policy requirements for processing transfers. Blocks smaller than a /24 are typically not transferable under the RIRs’ policies, so there’s a floor on what can be transferred through this process.

Why leases work differently

A lease does not involve any transfer of RIRs, as a lessee acquires routing capabilities, not any resources that would be owned.

We guarantee a non-revocation clause in every lease, RPKI ROA publication, signed LOA, reverse DNS delegation, and white-glove onboarding. Provisioning takes less than 24 hours to complete. These contractual and routing-layer guarantees give our lessees confidence in their arrangement with Prefixx.

Side-by-side comparison

If you need address space quickly and do not require registry ownership, a lease is the faster path. If long-term control and balance-sheet ownership matter, a purchase with escrow-secured settlement is the right structure. For a detailed breakdown of both paths, see our lease vs. buy page. Whichever path you choose, the routing paperwork must be ready before escrow opens, and that preparation is where deals most often stall.

Documentation the broker prepares before escrow opens

Before the escrow opens, it is important to ensure the routing documents are in order. A paper transfer of a block of IP addresses is not complete without clean authorization documents. All three core documents are thoroughly prepared for every deal by Prefixx.

Document preparation

1. Letter of Authorization (LOA). A Letter of Authorization (LOA) is a signed letter from the current address holder that authorizes the transfer and allows the buyer’s upstream provider to announce the new route. Without an LOA most transit providers will refuse a new prefix outright.
2. RPKI Route Origin Authorization (ROA). A ROA is a cryptographic binding of a prefix to an originating ASN within a RIR’s RPKI infrastructure. Announcements not covered by a valid ROA are discarded by RPKI-enforcing routers. Prefixx can create or update a ROA so that from the word go the announcements by your buyers are valid.
3. IRR route objects. These are Internet Routing Registry entries which state which ASN is allowed to announce a prefix. Often upstream providers filter on IRR information before they even start to check RPKI information. So both have to be up to date and consistent. Prefixx registers or updates the route object in the corresponding IRR database.

BYOIP deployment

1. Cloud BYOIP programs all require same documentation as standard transfer (LOA and ROA). LOA must list the cloud provider name (e.g. AWS, GCP, Azure, OCI, Cloudflare). ROA must cover the originating ASN that the cloud platform assigns to the customer. Prefixx can assist in preparing this documentation for cloud BYOIP in addition to standard transfer documentation.

Why documentation quality matters

The mechanics of the escrow protect your money while the quality of the documentation protects your routing. A block with stale or missing ROA information can be left in escrow-verified limbo whilst your buyer’s traffic goes down the drain.

Note: Do not attempt to manage RPKI or IRR objects directly with the RIR before coordinating with your broker. Conflicting records created mid-transfer can delay the announcement and trigger RPKI invalids that propagate across the global routing table. That is why having a single team handle both the escrow coordination and the routing paperwork matters.

Why choose Prefixx for escrow-secured IPv4 transactions

Every IPv4 transaction Prefixx handles is escrow-secured from day one. Before escrow opens on any IPv4 block, our Tixx quality control process checks ownership, blacklist standing and routing hygiene. Problems surface before money moves, not after. That discipline has been built into every deal since we were founded in 2018.

• Zero buyer fees. Sellers pay a 3 to 8% commission only on a successful close. Buyers pay nothing. No win, no fee.
• Tixx QC on every block. Each IPv4 address block is vetted for ownership, transfer eligibility, blacklists and routing hygiene before the transaction proceeds.
• Registered across all major RIRs. We broker transfers under ARIN, RIPE NCC and APNIC, with LACNIC facilitated. Our team handles the RIR submission that triggers escrow release.
• White-glove documentation included. LOA, RPKI ROA and IRR route objects are prepared by our consultants. The paperwork layer is never left to the buyer or seller to figure out alone.
• Human-in-the-loop on every deal. Senior consultants manage each IPv4 transaction end to end. This is not an automated marketplace.

Whether you want to buy IPv4 addresses, sell IPv4 address space, or understand how the transfer process works across registries, our team is ready to walk you through it. Contact us to discuss your IPv4 blocks and get a personalized offer.

Key takeaways: how IPv4 escrow protects buyers and sellers

IPv4 escrow holds funds until the RIR confirms the address block transfer is complete. The release trigger is a registry event, not a broker instruction. That single rule protects both sides of every IPv4 transaction: the buyer keeps leverage until routing is verified, and the seller knows payment is already secured.

Documentation quality matters just as much. An LOA, RPKI ROA, and IRR route object prepared correctly determine whether the IPv4 block actually routes after the deal closes. Tixx pre-sale checks reduce the risk of a failed transfer by vetting ownership, blacklist status, and routing hygiene before any IPv4 addresses change hands.

Lease transactions work differently. Protection comes from a non-revocation guarantee and a clean LOA rather than escrow. If you are ready to buy, sell, or lease IPv4 address space, contact us and we will walk you through the right model for your deal.

Frequently asked questions

Who holds the funds during an IPv4 escrow transaction?

A neutral third-party escrow agent holds the buyer's funds throughout the transfer process. Neither the seller nor the broker can access the money until all transfer conditions are satisfied. Prefixx structures every transaction this way, so funds are protected from the moment the buyer deposits through to RIR confirmation.

What triggers the release of escrow funds in an IPv4 transfer?

The escrow agent releases funds once the RIR confirms the address block has been officially transferred into the buyer's name. That confirmation is the single objective trigger, not a handshake between buyer and seller. Until the registry record reflects the new holder, the funds stay locked.

What happens to my money if the RIR rejects the IPv4 transfer?

If the RIR rejects the transfer, the escrow agent returns the funds to the buyer in full. Rejection is rare when a broker has properly vetted the block beforehand. Prefixx runs Tixx quality control on every block before a deal reaches escrow, checking ownership, transfer eligibility, and RIR standing, which eliminates most rejection risk before funds are ever deposited.

Does escrow work the same way for inter-rir IPv4 transfers?

The escrow structure is the same, but the timeline is longer. An inter-RIR transfer involves two registries, each running its own approval process, so the window between fund deposit and release is wider. Prefixx handles ARIN, RIPE NCC, and APNIC cross-registry transfers directly, with LACNIC facilitated, and coordinates the escrow timing to match each registry's process.

Is escrow used for IPv4 leases as well as purchases?

Escrow in the classic sense applies to purchases, where title changes hands and a registry transfer must complete. Lease transactions are structured differently: the lessor retains ownership, so there is no RIR transfer to trigger a release. Prefixx secures lease arrangements through contractual protections, including a non-revocation guarantee, rather than through a transfer escrow.

What documents does a broker need to submit before escrow can close?

Before escrow can close, the broker must confirm that the RIR transfer is approved and complete.

How long does the IPv4 escrow process typically take from start to finish?

For a same-registry transfer, the full cycle from signed agreement to escrow release commonly runs two to four weeks, with most of that time sitting inside the RIR's own review queue. Inter-RIR transfers take longer because both registries must approve the move. Block size, paperwork completeness, and how quickly the RIR processes its queue all affect the final timeline.

The purpose of the escrow process is so that neither party has to trust the other with the transfer of large sums of money and blocks of IP addresses, often worth five to six figures. The process is set up so that funds and IP address space move in sync. If one step is missed in the right order, then you may end up with IP address space of no value or be waiting weeks for a refund.

A deal closing smoothly depends on two things: the health of the block of IP addresses before it enters escrow, and both parties’ ability to confirm all their conditions precisely on time. (Note that the timing of the registries (ARIN and RIPE NCC) also varies by region, and problems with a block’s reputation can cause immense delays that no escrow service can solve).

If you are buying or selling IPv4 space and want every checkpoint handled by people who do this daily, Prefixx runs escrow-secured transactions with Tixx quality control on every block before the deal opens. Reach out to get a vetted listing or a transfer assessment.