All, Please take a few minutes to *read and respond* to this email, and the *proposed changes* discussed here, so that we can finalize the OFAC Recommendation and send it to the Plenary. There are three remaining proposed changes as far as I can tell. These changes are below. *Please indicate whether you support adding any of proposed changes 1, 2 and/or 3 to the OFAC Recommendation. * To make it easy, please respond along the lines of “I [support/do not support] adding change 1” or “I would support change 1 with the following revisions.” If you think it would help others, please explain your conclusion. In addition to the changes, I have attached two documents: · A draft of the OFAC Recommendation that incorporates the proposed changes suggested by Kavouss. Where unclear, I placed a change where it seemed most likely intended to be. · A document with virtually all of the emails devoted to these proposed changes, arranged chronologically by topic. *The proposed changes suggested by Kavouss are as follows:* 1. The first proposed change appears intended to be added to the Issue and Recommendation “Application of OFAC Limitations by Non-US Registrars.” The first part reads: *There are several reports in the media that US-Based and Non-US registrars have asked registrants to transfer out their domains immediately because they might get affected by US sanctions.* *Examples of that are related to Godaddy*[1]* and Online Nic,*[2]* which made pressure against registrants having citizenship of Sanction countries.* Kavouss asked that the second part be inserted into the corresponding Recommendation: Registrars should be reminded that they should not normally examine zero risk policy in regard of penalties imposed by OFAC. 2. The second proposed change relates to an action taken by Resello, a Dutch registrar. It’s also unclear where this would go (it does not seem to fit in the section “Application of OFAC Limitations by Non-US Registrars.”) Perhaps it would go into a new section, possibly entitled “Policy of not Doing Business with Iranian Customers/Resellers (Unconnected to OFAC/Sanctions) by a Non-US Registrar”: *An individual domain Name Iranian National reseller residing outside Iran sent a request to <sales@resello.com <sales@resello.com>> in an online form, asking to become reseller of Domain Name in Iran (to sell domains to Iranian people).* *He received the following reply:* *Quote* *“On Tue, Sep 19, 2017 at 9:48 PM, Resello Sales <sales@resello.com <sales@resello.com>> wrote:* *Dear reseller (XXX)* *Unfortunately our policy restricts doing business with Iranian customers/resellers, even if they aren't living in Iran, but have an Iranian passport.* *Kind regards,* *Mark Assenberg”* *It is worth mentioning that Resello is a subsidiary company for following holding:* *Yourholding* *Ceintuurbaan 28* *8024 AA Zwolle* *+31 38 453 0752* *The name is Yourholding and they are based in Netherlands. So they are not US-Based company.* *They do not want to explain why they don't want to provide service to Iranian. They say, they is our internal policy decision.* *It is important to make it clear that none of Registrars and service providers which are not US Nationals or not based in USA cannot make internal policies to avoid giving services to a given citizens. This is a global business not a personal decision of a company or its managers. They must fully observe the expected behaviour and responses.* *It is important to emphasize that non-US based companies should not to replicate the rules inside USA.* *[Recommendation]* *The group in attempting to address the case mentioned above thought that the above situation might have been arised as result of misinterpretation of applicability of OFAC Regulation to the case.* *The Group concluded that there was no relation between the case and OFAC Regulation and its applicability.* *The Group also did not find any provision in RAA to obligate the Resello to get into a business with the domain name reseller to provide the requested domain name did not find also any provision in the RAA to allow the registrar to reject / deny the request.[3] The group therefore considered / recommends that there is a need that ICANN further examine the matter with a view to address the silent point in the RAA.* 3. The third suggested change is intended to change the Recommendation relating to General Licenses. After Kavouss suggested several changes (including the language in blue), I added the red language to reflect Kavouss’s changes in a way that seemed to read better in the text. After the red language was added, Kavouss continued to request that the language in blue be added as well. ICANN should then pursue one or more OFAC general licenses at the earliest possible time, unless significant obstacles were discovered in the “study” process. If there are significant obstacles, ICANN should report them to the [empowered] community and seek its advice on how to proceed. If unsuccessful, ICANN would need to find other ways to accomplish the ultimate goal -- enabling transactions between ICANN and residents of sanctioned countries to be consummated with a minimum of “friction.” It is critical that ICANN communicate regularly about progress toward securing general licenses, in order to raise awareness in the ICANN community and with affected parties. * The role of ICANN, to make awareness about such situation is critical and should not be undermined.* Finally, there have been a number of questions asked about each of these suggested changes, which have largely gone unanswered. I’ve rephrased and listed them here, since it could be helpful for the Subgroup to consider them (or see if any members might answer them). (I am not suggesting these questions need to be answered to evaluate the proposed changes.) *On suggested change 1*: 1. Do you have the “reports in the media” referred to in the proposed change? a. If the Subgroup has not seen the reports in the media, can the Subgroup Report refer to them, or the activities reported in them? b. For US registrars, considering that they have to comply with OFAC, is this an issue for this Subgroup? c. For non-US registrars, why isn’t the current text of this section of the OFAC Recommendation sufficient? (It discusses possible mistaken application of OFAC sanctions by non-US registrars because they think contracting with ICANN imposes OFAC compliance obligations on them)*.* 2. Since GoDaddy and OnlineNIC are both US-based registrars, does it make sense to refer to them?who are required to comply with OFAC sanctions. a. Do you know what “made pressure against” refers to? b. Are there any example of this “pressure”? With non-US registrars? 3. What does it mean to say “Registrars should be reminded that they should not normally examine zero risk policy in regard of penalties imposed by OFAC”? a. If this refers to the exercise of business or legal judgment of registrars, do you believe it is appropriate for the Subgroup Report to comment on this? b. What proposed issue does this Recommendation resolve/remediate? *On suggested change 2*: 1. Is this an example of a non-US Registrar complying with OFAC sanctions? Where is the connection to OFAC? 2. What section of the RAA is being violated by this business decision (i.e., a registrar deciding not to do business with citizens of a given country (whether it is Canada, Haiti, Iran or otherwise))? 3. If Resello's business decision does not seem to be related to OFAC, US jurisdiction or to any ICANN-related jurisdiction, does the Subgroup approve this as an “Issue” or our group to make a Recommendation on? If so, what recommendation? 4. Is this possibly an EU sanctions issue (the registrar is Dutch) 5. If this is possibly an EU sanctions issue, should we get into interpreting EU sanctions? 6. Why is the current language of the Recommendation insufficient? It reads: a. "ICANN needs to bring awareness of these issues to registrars. ICANN should clarify to registrars that the mere existence of their RAA with ICANN does not cause them to be required to comply with OFAC sanctions. ICANN should also explore various tools to remind registrars to understand the applicable laws under which they operate and to accurately reflect those laws in their customer relationships." 7. What connection does this have to OFAC sanctions or to ICANN's "jurisdiction" -- in the US or elsewhere? *On suggested change3:* 1. Why is the language already added to the text (in red) insufficient? 2. What situation does “make awareness about such situation” refer to? 3. Is there a concern that something will be “undermined”? What does this refer to? ------------------------------ [1] NOTE TO SUBGROUP: GoDaddy is a U.S.-based registrar incorporated in Delaware as GoDaddy, LLC and headquartered in Scottsdale, Arizona. [2] NOTE TO SUBGROUP: OnlineNIC is a U.S.-based registrar incorporated in California as OnlineNIC, Inc. and headquartered in San Leandro, California. [3] Resello’s “General Terms and Conditions,” for resellers state in Article 1.1 that “acceptance by Resello … may be refused without reason.” https://www.resello.com/agreement