ICANN requires Netpia to pay accreditation fees and correct compliance issues
ICANN has issued a formal breach notice to Netpia, a long-standing South Korean domain name registrar, citing multiple compliance shortfalls that must be resolved promptly. The notice, dated September 25, identifies unpaid accreditation fees and several technical and policy gaps that prevent Netpia from meeting ICANN’s requirements for accredited registrars.
Key compliance failures identified
The breach notice highlights several specific areas where Netpia is out of compliance. First, ICANN states that the registrar is behind on its accreditation fee payments. Second, the company has not fully implemented a proper Registration Data Access Protocol (RDAP) service to replace or complement traditional WHOIS functionality. Third, ICANN notes the absence of an approved method for requesting non-public registration data, an important mechanism for handling sensitive requests under applicable policies and privacy rules.
In addition to protocol and data-access issues, ICANN’s assessment found that the public-facing registrar website is missing required information, including designated abuse contact details. Providing clear abuse contacts and complaint channels is a baseline requirement for registrars so that security researchers, hosting providers, and members of the public can report malicious activity or other registration problems.
Deadline to cure the breach
ICANN has given Netpia until October 16 to address the cited deficiencies. That cure period requires the registrar to resolve outstanding payments, implement the necessary RDAP services and data-request mechanisms, and update its public-facing materials to include all required contact and policy information. Failure to cure the breach within the specified timeframe could lead to further enforcement action by ICANN.
About Netpia and its registration footprint
Netpia operates under IANA number 130, making it one of the older accredited registrars globally. Despite its long history in the domain industry, Netpia maintains a relatively modest portfolio in gTLDs. As of May, the registrar managed fewer than 6,000 .com domain registrations, a small share compared with larger providers such as GoDaddy and MarkMonitor.
The company’s smaller size does not exempt it from ICANN’s contractual and technical obligations. All accredited registrars—regardless of registration volume—must follow the same baseline requirements for RDAP availability, data-handling procedures, documented abuse contacts, and timely payment of accreditation fees.
Why the identified issues matter
RDAP is the modern protocol ICANN promotes to improve access to registration data in a structured, secure, and privacy-aware way. When a registrar hasn’t implemented RDAP, it complicates automated queries and official processes that rely on standardized, machine-readable responses. Likewise, lacking an approved channel for requesting non-public registration data creates legal and operational friction for parties requiring privileged access for investigations, law enforcement, or rights protection.
Missing abuse contact information also undermines internet security and abuse mitigation efforts. Clear abuse reporting channels help quickly surface and remediate phishing, malware distribution, spam, and other malicious activity tied to domain names.
Next steps and potential outcomes
Netpia must demonstrate remediation by the October 16 deadline to avoid escalation. Remediation typically involves submitting evidence that fees have been paid, deploying functional RDAP endpoints consistent with ICANN’s technical requirements, establishing a documented process for handling non-public data requests, and updating public-facing website content to include required contact and policy information.
If Netpia cures the breach within the allowed period, ICANN will close the matter. If the company does not comply, ICANN’s enforcement process can include additional notices, potential suspension of accreditation privileges, or other measures intended to protect the integrity of the domain name system and ensure consistent adherence to contractual obligations.
ICANN’s breach notice serves as a reminder that even long-established registrars must maintain up-to-date technical capabilities, transparent contact channels, and current financial standing to continue operating as accredited participants in the domain ecosystem.