Hello team, A smaller group remained on the call after the main team wrapped up today to discuss how to adjust the 'evidence of fraud' reason for a registrar to NACK a transfer out. The updated text that we propose to be used in this area is: "Evidence of (a) fraud or (b) the domain presents an active DNS Security Threat as defined here: https://www.icann.org/dns-security-threat." We wanted to balance two things: 1. Registrars must be able to NACK transfers out in appropriate circumstances, such as when the RNH is using the domain for something illegal or that threatens the healthy functioning of the DNS. 2. Registrants need predictability (e.g. avoiding situations where a registrar changes the relevant agreement in a sudden or surprising manner), and freedom of choice for their provider. We considered referring to DNS Abuse, but with the awareness that ICANN has defined "DNS Security Threat" at the link mentioned above, and since the 5 categories of harm are essentially the same (compared to the DNS Abuse Framework), we decided to go with "DNS Security Threat". We also considered that there should be evidence of such a threat, and that it should be active as opposed to resolved (e.g. a domain that was compromised and used for abuse, but has since been restored to appropriate usage). We hope that this proposed language will be acceptable to the broader team, and look forward to feedback. I would particularly like to know if the (a) and (b) structure makes it clear that evidence is required in both cases (fraud or security threat). Thanks, -- Sarah Wyld, CIPP/E Policy & Privacy Manager Pronouns: she/they swyld@tucows.com