In cross-border IP due diligence, domain names are often the asset the business depends on most and documents least. Before an acquisition, the buyer should confirm who the registrant actually is, whether the registration data is accurate, who controls the registrar accounts, whether any dispute is pending and whether local rules allow the domains to move to the new owner. This guide is for deal teams, in-house counsel and investors buying companies in Europe and Latin America.
Key takeaways
- The registrant on record, not the person who pays the invoice, is the legal holder of a domain; it is often a founder, an employee or an agency.
- In the EU, Article 28 of the NIS2 Directive requires registries and registrars to keep accurate and complete registration data, with verification procedures.
- A pending UDRP case freezes the domain: it cannot be transferred to a new holder until 15 business days after the proceeding ends.
- ICANN’s Transfer Policy imposes a 60-day lock on moving to another registrar after a change of registrant, unless the holder opted out beforehand.
- Some ccTLDs have local presence rules: .eu requires an EU or EEA connection, and foreign companies holding .br names need a local attorney-in-fact.
Why domain names fall through the cracks in IP due diligence
Trademarks and patents sit in official registers that a reviewer can search by owner. Domains do not. They are registered through hundreds of registrars, often years ago, by whoever was setting up the website. Common findings in a data room include domains held in a founder’s personal name, names registered by a marketing agency under its own account, country-code domains held by a former distributor, and renewals paid by a card that will be cancelled at closing.
The impact is operational, not just legal. Email, payment pages, customer logins and app back-ends depend on the main domains. Losing control of one after closing can stop the business, so the review should treat domains as critical infrastructure as well as IP.
Who really owns the domain? Registration data and NIS2
Three roles matter: the registrant (the legal holder), the registrar account holder (who can log in and change settings) and the contacts that receive notices. They are frequently different people.
In the EU, Directive (EU) 2022/2555 (NIS2) addresses accuracy directly. Article 28 requires member states to make TLD registries and registrars:
- collect and maintain accurate and complete registration data, including the domain name, registration date, and the registrant’s name, email and telephone number (Article 28(1) and (2));
- have policies and procedures, including verification, to keep that data accurate (28(3));
- publish non-personal registration data without undue delay after registration (28(4));
- give legitimate access seekers specific data on a lawful and duly justified request, replying within 72 hours (28(5)).
Member states had to transpose NIS2 by 17 October 2024 (Article 41). For a buyer, the point is practical: inaccurate or outdated registrant data is a compliance issue for the registrar and a title problem for you. It can also weaken the target’s position in a dispute, because under paragraph 2 of the UDRP Policy every gTLD registrant represents that its registration statements are complete and accurate.
IP due diligence for domain names: the checklist
| Item | What to check | Ask the seller for | Risk if missed |
|---|---|---|---|
| Inventory | All domains linked to the target’s marks, products and markets | A full list by extension, registrar and expiry date | Critical names outside the deal perimeter |
| Registrant | That the holder of record is a target company | Registration data extracts or registrar statements | Name held by a founder, employee or agency |
| Account control | Who holds credentials, two-factor authentication and recovery email | Account list and access protocol at closing | Lock-out or hijacking during handover |
| Expiry and renewal | Expiry dates, auto-renewal, payment method | Renewal calendar | A key domain lapsing after closing |
| Local eligibility | Presence rules for .eu, .br and other ccTLDs | Evidence of local entity or attorney-in-fact | Name that cannot be held by the buyer |
| Disputes | Pending UDRP, ccTLD or court cases, as complainant or respondent | Case list and correspondence | Transfer blocked or name lost |
| Third-party use | Licences, distributor or agency arrangements over domains | Agreements and side letters | Partner claims or uncooperative holders |
| Enforcement backlog | Infringing domains targeting the target’s marks | Monitoring reports, open matters | Unbudgeted recovery work |
What happens if a domain dispute is pending?
Paragraph 8 of the UDRP Policy prevents the holder from transferring the domain to a new holder (unless the transferee agrees in writing to be bound by the decision) or moving it to another registrar while a proceeding is pending and for 15 business days after it ends. Paragraph 4(k) also leaves either party free to take the dispute to court. In practice, a pending case can delay the transfer schedule in a share or asset deal and should be disclosed and covered by specific warranties or an indemnity.
Check public case databases of WIPO and the other providers by domain and party name, and ask the seller about ccTLD procedures such as those for .es, .mx or .br, which follow their own rules.
How to transfer the domains at closing
In a share deal, the registrant company usually stays the same, so the work is about account control and data. In an asset deal, each domain needs a change of registrant. Under ICANN’s Transfer Policy (updated 21 February 2024, mandatory since 21 August 2025):
- A material change of registrant must be confirmed by both the prior and the new registrant through a secure mechanism.
- After a change of registrant, the registrar must impose a 60-day lock on moving the domain to another registrar, unless the holder opted out before requesting the change.
- A domain cannot move to another registrar within 60 days of its creation.
If the buyer wants to consolidate the portfolio with its own registrar, sequence the steps (registrar move first, then change of registrant, or use the opt-out) so the lock does not delay integration.
Country-code domains follow national rules. Under EURid’s eligibility rules, a .eu holder must be an EU or EEA citizen, resident, undertaking or organisation, so a buyer without an EU or EEA connection must plan who will hold the names. In Brazil, CGI.br Resolution 2008/008 grants foreign companies only a provisional registration, through a locally established attorney-in-fact, legalised documents and an undertaking to establish activities in Brazil within 12 months.
What this means for your business
- Ask for the domain inventory in the first information request, not at signing.
- Verify registrant data independently instead of relying on the seller’s list.
- Make pre-closing transfers of names held by individuals or agencies a condition precedent.
- Agree an access handover protocol for credentials and two-factor devices.
- Plan the post-closing structure for .eu, .br and other ccTLDs with presence rules.
Our domain name review for IP due diligence runs these checks across extensions and markets, as part of our wider cross-border IP due diligence and portfolio structuring.
Where deal teams get domain due diligence wrong
- Treating the invoice as proof of title. Paying the renewal does not make you the registrant.
- Reviewing only the main .com and missing the ccTLDs where the target sells.
- Discovering the 60-day lock at integration and delaying the migration of email or websites.
- Ignoring pending disputes. A UDRP complaint against the target’s domain can block the transfer, and our IP disputes and enforcement team can assess its exposure.
- Assuming all ccTLDs are global. Presence rules can force a local holding structure.
Frequently asked questions
What should IP due diligence check for domain names?
At minimum: a full inventory, the registrant of record for each name, who controls the registrar accounts, expiry dates, local eligibility rules for ccTLDs, pending disputes, licences or agency arrangements, and infringing domains targeting the target’s marks. Each finding should feed into warranties, conditions precedent or the post-closing integration plan.
Does NIS2 affect domain names in an acquisition?
Indirectly. Article 28 of NIS2 requires EU registries and registrars to keep accurate and complete registration data and to verify it. Outdated holder details on the target’s domains can create compliance queries and title doubts, so the data should be corrected before or at closing. Within the same META Channel group, our regulatory team also advises on NIS2.
Can a domain be transferred while a UDRP case is pending?
Not freely. Under paragraph 8 of the UDRP Policy, the holder cannot transfer the domain to a new holder, unless the transferee agrees in writing to be bound by the decision, or move it to another registrar while the proceeding is pending and for 15 business days after it ends. The deal timetable should allow for this.
Can IP Global Guard review the domains in our target’s portfolio?
Yes. We review registrant data, account control, disputes and ccTLD eligibility across Europe, Latin America and Africa, coordinating local correspondents where national rules require it, and we report findings in a format the deal team can use for warranties and the closing checklist, from a single point of contact.
How IP Global Guard supports domain due diligence
A domain review is quick when it starts early and painful when it starts at closing. IP Global Guard, the IP services line of META Channel Corporation Limited, handles IP due diligence, domain portfolios and disputes with one strategy and one billing relationship across more than 25 jurisdictions; see our coverage in Europe, Latin America and Africa.
Share the deal timeline and the target’s main brands and markets. We will scope the domain review, tell you what to request from the seller and flag what could hold up closing. Talk to our IP due diligence team.
This article is general information, not legal advice, and does not replace a transaction-specific review.
Sources
- EUR-Lex, Directive (EU) 2022/2555 (NIS2), Articles 28 and 41 (14 December 2022)
- ICANN, Uniform Domain Name Dispute Resolution Policy (updated 21 February 2024)
- ICANN, Transfer Policy (updated 21 February 2024)
- EURid, Rules for .eu domain names (eligibility since 2 August 2021)
- CGI.br, Resolution CGI.br/RES/2008/008/P, domain name registration procedures (28 November 2008)
