Originally published at https://monstadomains.com/blog/cctld-policy-changes/
Your country code registry can rewrite the rules on your domain without asking ICANN, without a public comment period, and without sending you an email. That is not hypothetical. A run of ccTLD policy changes landed through 2026, and the largest of them takes effect on 1 October. Colombia’s .CO registry told registrars they can no longer auction expired domains. India’s registry warned investors that trading .IN names risks suspension. Across Europe, registries began verifying registrant identity because a directive required it. None of these ccTLD policy changes passed through ICANN’s rulemaking process, and none of them needed to.
The .CO Registry Ended Expired Domain Auctions
The clearest of this year’s ccTLD policy changes came out of Colombia. In June, the .CO registry issued a notice to its registrar channel that reads as plainly as registry notices ever get. Registrars “will be required to adhere strictly to the .CO domain lifecycle and must not facilitate or execute changes in ownership of domain names that have expired and have not been renewed by the original registrant, unless expressly authorized by the .CO Registry.” The deadline is no later than 1 October 2026, as first reported by Domain Name Wire.
Read that again. Today, when a .CO domain expires and nobody renews it, the registrar pushes it into an auction, either its own or a partner’s. GoDaddy Auctions alone handles expiring inventory from Tucows, Squarespace and dozens of other registrars. That entire pipeline now needs explicit registry permission. Registrars have been told to contact .CO to “discuss authorization and alignment with this policy,” which is registry language for negotiating terms that have not been made public.
Who actually loses here
GoDaddy carries the most exposure, having run the .CO backend before the contract moved to Team Internet and CCI Reg. But ccTLD policy changes like this one land hardest on ordinary registrants who let a name lapse and assumed they could buy it back later. Under the new rule that path may simply close, or route through a registry-run process with premium pricing attached. Anguilla’s .ai registry already auctions expired names itself through Namecheap. That model is the obvious template.
India Warned Investors Off Trading .IN Names
NIXI, the National Internet Exchange of India and operator of the .IN namespace, reminded the market this year that auctioning and speculative trading of .IN domains is prohibited under registry policy. It attached teeth: names found in breach face suspension and other sanctions. There is no appeal to ICANN here, because ICANN has no jurisdiction over how India runs its own country code.
Two registries on different continents, moving in the same direction within months of each other. That is the signal worth tracking across this round of ccTLD policy changes. Country code operators are reclaiming control of the secondary market that grew up around their namespaces, and they are doing it through channel policy rather than public consultation. The ccTLD policy changes arriving now are decisions already made, announced to registrars, and passed down to you as updated terms.
NIS2 Turned European ccTLD Policy Changes Into Identity Checks
The European track works differently and matters more. Since the EU’s NIS2 Directive took effect, European ccTLD registries have been rolling out registrant verification requirements. The stated purpose is data accuracy rather than restricting who may register, but the practical outcome is identical for anyone who values privacy. More registries now expect verifiable contact details, and more of them actually check.
This is where ccTLD policy changes stop being an investor story and become a privacy story. Verification requirements do not arrive as a single headline announcement. They arrive registry by registry, quietly, as revised terms buried in a registrar’s ccTLD documentation. We covered the wider pattern in our look at registrar ID verification, and the European country code track is the same pressure applied through a different legal instrument.
Local presence rules stack on top
Verification is only one layer. Several country codes already require a physical address inside the registry’s jurisdiction. .CA is limited to Canadian citizens, permanent residents, Canadian corporations and trademark holders. .EU and .ES restrict eligibility to registrants inside the European Economic Area. Trustee services can satisfy some of these rules, but a trustee is a third party holding your real details on file, which is a trade worth making deliberately rather than by accident.
Why ccTLD Policy Changes Move Faster Than ICANN Rules
Generic TLDs like .com sit inside ICANN’s contractual and policy machinery. Change there is slow, documented and, whatever its flaws, public. Country code registries sit outside that structure entirely. Each is run by a national authority with its own mandate: DENIC for .de, AFNIC for .fr, auDA for .au, CIRA for .ca. They set eligibility rules independently and revise them on their own timetable. That structural gap is the reason ccTLD policy changes can outpace anything happening at ICANN.
The independence is not automatically bad. Some country code operators have resisted takedown pressure that a gTLD registry would have folded under within days. But it does mean the ccTLD policy changes affecting your domain may never appear anywhere you are watching. There is no equivalent of ICANN’s public comment archive for most country codes, and no obligation to notify individual registrants before terms shift underneath them.
Dispute Filings Show Where The Pressure Comes From
WIPO handled over 6,200 domain name cases in 2025, its highest caseload on record. Of the 80,000 cases it has resolved across 25 years, nearly 10,000 involved country codes. Filings rose specifically for .CO, .AU, .IO, .MX, .IE and .UA, with .CO sitting at the top of the ccTLD table.
That number explains a great deal. .CO is simultaneously the most disputed country code and the one that just pulled expired auctions in-house. Registries facing rising dispute volume have every incentive to tighten who holds names and how ownership moves between parties. The ccTLD policy changes of 2026 are, in part, a response to a secondary market that produced more conflict than the registries were willing to underwrite.
What These ccTLD Policy Changes Mean For Privacy
If you run a site under a country code because it reads well or matches your audience, these ccTLD policy changes reach you in two concrete ways.
Your exit options narrow first
When a registry controls what happens to expired names, letting a domain lapse stops being a quiet way to close a project down. The name may be relisted under registry terms, and recovery may cost far more than renewal ever did. A deliberate lapse has long been a legitimate way for people to wind down work without a public transfer record. These ccTLD policy changes make that route less predictable, so plan the ending of a project as carefully as the start.
Verification arrives without warning
A country code that accepted minimal detail at registration can add checks at renewal or transfer. If your registrar holds accurate identifying data because a registry demanded it, that data exists and can be compelled. Choosing where a name lives now matters as much as choosing the name itself. Running a WHOIS lookup on your own domains takes five minutes and tells you exactly what is already public.
What To Do Before The October Deadline
Respond to what actually changed rather than to domain anxiety in general. Check whether any .CO name you hold is near expiry, and renew it rather than relying on auction recovery after 1 October. Audit your country code portfolio for local presence and verification terms you may have agreed to years ago. Where a ccTLD is not load-bearing for your project, ask whether a generic TLD with predictable policy serves you better.
For anything genuinely sensitive, the safer default is a namespace with stable rules and a registrar that never collected identifying data to begin with. MonstaDomains supports domain registration without ID checks, paid in crypto, because data we never hold cannot be produced when ccTLD policy changes arrive. That is the only defence that survives a registry rewriting its terms without telling you.
The Takeaway
Three things to carry away from this. Country code registries answer to national authorities rather than ICANN, so ccTLD policy changes can land with no consultation and no notice to registrants. The .CO expired auction rule taking effect on 1 October removes a recovery route many owners assumed was permanent. And NIS2-driven verification is spreading through European country codes one registry at a time, turning what looked like a market story into an identity one.
If your namespace is drifting toward more verification than you signed up for, moving somewhere that asks for nothing is a reasonable next step, and our domain transfer process takes only a few minutes.
