FAQ

No.

There is currently no mechanism to pre-verify registrant data via EPP, and no EPP flag or attribute that suppresses a verification request.

Registrars may perform their own internal verification during the ordering workflow, but any verification request raised by us must still be explicitly confirmed.

Verification may be triggered in the following situations, including but not limited to:

• new domain registrations,
• change of registrant (owner change),
• substantiated suspicion of inaccurate or incomplete registrant data, and
• substantiated DNS abuse indications.

Other circumstances may also trigger verification where required by applicable regulation or based on a risk-based assessment.

Email notification:

Cases overview:

Case feedback:

We will identify cases where the registrant must be verified by ID to ensure that the registrant details are accurate and that the domain is not being used for abusive purposes.

The verification request will indicate that registrant verification is required, but will not prescribe specific data elements or verification methods.

How the registrar performs the verification is determined by the registrar’s local law, internal procedures, and applicable regulatory obligations.

No.

We use risk levels internally to determine whether verification is required. They do not change the registrar’s required actions or verification flow.

From the registrar’s perspective, all verification requests are handled in the same way regardless of the internal risk classification.

We do not prescribe specific documents or documentation requirements.

Documentation and verification methods vary by country, and we do not have visibility into or expertise in the documentation frameworks applicable in all jurisdictions.

Registrars are responsible for verifying the registrant in accordance with their local law, internal procedures, and applicable regulatory obligations. If the registrar is satisfied that the registration details are accurate and legitimate, we will consider the verification requirement fulfilled.

No.

We do not define specific matching requirements between registration data and individual corporate documents. The assessment of whether the registrant details are accurate is performed by the registrar based on its own verification procedures.

We rely on the registrar’s confirmation that the registrant has been satisfactorily verified.

No.

We will not request copies of verification documentation and do not require registrars to retain identification documents on our behalf.

We may, if necessary, inquire at a high level about the verification process a registrar uses and the types of documentation typically requested, but there are no specific plans for audits.

The verification notification email contains a registrar-specific magic link.

The link provides access to the verification interface, where the registrar can view and manage all verification cases associated with that registrar.

For security reasons, the magic link is intended for registrar use only and must not be shared with registrants or third parties.

No.

Risk assessments and risk indicators are used internally to determine whether verification is required. The underlying reasons or signals leading to a medium or high risk classification are not disclosed.

From the registrar’s perspective, the relevant information is whether verification is required.

The magic link does not have a short, per-click expiry.

Access is controlled at the registrar level and may be rotated or invalidated if required for security reasons. Registrars should treat the link as confidential and restrict access to authorised personnel.