Quick answer
What are the ICANN transfer policy changes?
On 7 June 2026 the ICANN Board adopted the Transfer Policy Review (resolution 2026.06.07.04). It brings 30-day locks instead of 60, a one-time Transfer Authorization Code valid 14 days, and no 60-day change-of-registrant lock. As of 19 October 2026 no effective date is published, so transfers at TransferOffshore still follow today's rules.
The decision in brief
| What was adopted | The recommendations of the GNSO Transfer Policy Review PDP Final Report (47 recommendations) |
|---|---|
| Adopted by | ICANN Board, 7 June 2026, resolution 2026.06.07.04; resolutions published 9 June 2026 |
| Effective date | None published as of 19 October 2026; implementation is “subject to prioritization” |
| Next steps | An Implementation Review Team and a standalone Change of Registrant Data (CORD) Policy |
| Lock after creation or transfer | From a 60-day “may deny” to a mandatory 30 days (720 hours) |
| Auth code | Renamed TAC: one-time use, valid 14 days (336 hours), issued within 120 hours |
| Change-of-registrant lock | The 60-day lock and its opt-out are removed |
| Still in force today | The Transfer Policy updated 21 February 2024, including both 60-day rules |
What did the ICANN Board adopt on 7 June 2026?
It adopted the full set of recommendations from the Transfer Policy Review, and asked ICANN's President and CEO to implement them, “subject to prioritization”. The resolution number is 2026.06.07.04, and the approved resolutions were published on 9 June 2026.
The recommendations come from a GNSO working group that reviewed the whole Transfer Policy. Its Final Report, dated 4 February 2025, holds 47 recommendations. The Board flagged one of them, Recommendation 21, for further talks with the GNSO Council: it would let registrars deny a transfer for DNS abuse.
Which recommendations change what?
The main changes, from the Final Report text. “Rec” is the recommendation number.
| Rec | Change | Today |
|---|---|---|
| 3 | Registrars must block transfers for 720 hours (30 days) after the creation date, replacing 60-day rules in registry and registrar agreements | 60 days, a reason a registrar may use |
| 6 | The Transfer Authorization Code (TAC) must be set and issued within 120 hours | Auth code within 5 calendar days |
| 9 | The TAC is valid for 336 hours (14 days), enforced by the registry | No fixed lifetime for gTLDs |
| 11 | A Notification of TAC Issuance goes to the registrant within 10 minutes | No such notice required |
| 12 and 13 | The registry verifies the TAC; it is one-time use and reset once accepted | The code can stay the same |
| 15 | The Gaining FOA (gaining registrar's authorisation form) is eliminated | Enforcement deferred since 2018 |
| 17 | The losing registrar's notice becomes a “Transfer Confirmation”; the 5-day window becomes 120 hours | 5 calendar days |
| 18 | Mandatory 720-hour (30-day) lock after an inter-registrar transfer; early removal only on a documented registrant request | 60 days, a reason a registrar may use |
| 19 | A Notification of Transfer Completion from the losing registrar within 24 hours | Not required |
| 21 to 24 | Denial reasons rewritten: the registrant's express objection becomes a must-deny; DNS abuse a may-deny | Must / may / may-not lists of the current policy |
| 25 to 28 | Change of Registrant becomes Change of Registrant Data (CORD); the 60-day lock and its opt-out are removed; a CORD notice is added | 60-day lock with optional opt-out |
| 34 to 47 | Rules for bulk and full-portfolio transfers between registrars (BTAPPA) | Existing BTAPPA process |
When will the new transfer rules take effect?
Nobody can say yet: as of 19 October 2026, ICANN has published no effective date. The resolution sets no timeline. An Implementation Review Team still has to turn the recommendations into policy text, and the standalone CORD policy has to be written.
One blog suggests a phase-in of about 18 months. ICANN has not confirmed this figure, so treat it as a guess. When ICANN publishes a date, this page will show it.
Do not confuse the review with another date. Realtime Register announced gTLD transfer changes from 4 August 2026. That notice concerns registrant-only approval, without an admin contact, under the Registration Data Policy. It is not the Transfer Policy Review.
What stays the same until then?
Everything in the current policy, updated 21 February 2024 and mandatory since 21 August 2025:
- a registrar may deny a transfer within 60 days of creation or of a previous transfer, and many do;
- a change of registrant sets a 60-day lock, with an opt-out the registrar may offer;
- the losing registrar has 5 calendar days, then the transfer is approved by default;
- the auth code must be given within 5 calendar days and has no fixed lifetime;
- a gTLD transfer adds one year, with the total capped at 10 years.
The last rule is not touched by the review: the Final Report still shows one year added at transfer. Today's process is explained in how domain transfers work.
What will the changes mean for people moving domains?
Shorter waits, stricter codes, and fewer emails to answer. In practice:
- New domains move sooner. A domain registered or transferred 30 days ago will be free to move, instead of 60 days at many registrars today. But the 30 days will be mandatory, with no registrar discretion.
- Codes expire. A TAC lasts 14 days and works once. Request it only when you are ready to submit, and ask for a new one if it runs out.
- Owner updates stop blocking moves. Editing the registrant's name or email will no longer set a 60-day lock. You will receive a CORD notice instead.
- More notices. You will get an email within 10 minutes of a TAC being issued, and another within 24 hours of the transfer completing. An unexpected TAC notice is an early warning.
- Portfolios need tighter batches. With 14-day codes, plan each batch so that every code is submitted within its window. The bulk transfer guide covers batching.
The code itself is explained on what an auth code is, and today's locks on why a domain cannot be transferred.
How did the Transfer Policy Review get here?
| Date | Step |
|---|---|
| 31 January 2025 | The working group reaches full consensus |
| 4 February 2025 | Final Report sent to the GNSO Council (47 recommendations) |
| 12 March 2025 | GNSO Council approves the report, unanimously |
| 28 April to 16 June 2025 | Public comment before the Board's decision |
| 2 July 2025 | Summary report of the public comments |
| 7 June 2026 | ICANN Board adopts the recommendations (resolution 2026.06.07.04) |
| 9 June 2026 | Approved resolutions published |
| After that | Implementation Review Team and CORD policy; effective date not announced as of 19 October 2026 |
Questions about the new transfer rules
Is the 30-day transfer lock in force now?
No. The ICANN Board adopted it on 7 June 2026, but as of 19 October 2026 no effective date has been published. Until then, the current policy applies. A registrar may deny a transfer within 60 days of registration or of a previous transfer, and many registrars do.
What is a TAC?
TAC stands for Transfer Authorization Code, the new name for the auth code or EPP code. Under the adopted rules it must be issued within 120 hours, it is valid for 14 days, and it works only once. The registry enforces the lifetime and resets the code after a valid use.
Will a transfer still add a year to my domain?
Yes, as far as the Final Report shows. The review does not change the rule that a gTLD transfer adds one year to the expiry date, capped at 10 years. Country-code domains keep following their own registries, which ICANN's policy does not cover.
Does the change-of-registrant lock disappear?
Yes, once the new rules take effect. Recommendation 26.4 removes the 60-day lock after a change of registrant, together with its opt-out. The process becomes Change of Registrant Data (CORD), with a notice to the registrant instead of a lock. Until then, the 60-day lock still applies.
Why did the Board flag Recommendation 21?
Recommendation 21 would let registrars deny a transfer for DNS abuse. The Board flagged it for further discussion with the GNSO Council when it adopted the recommendations on 7 June 2026. Its final form may therefore differ from the Final Report text.
Should I wait for the new rules before moving my domains?
No. No effective date is known, and a domain held back by today's 60-day rule only has to wait until day 61. Every other domain can move under today's rules. A gTLD transfer still takes up to 5 days and adds one year, at $12.49 for .com.
Sources (5)
- Approved resolutions, regular meeting of the ICANN Board, 7 June 2026 — ICANN (checked 2026-10-19)
- Transfer Policy Review PDP Final Report — ICANN GNSO (checked 2026-10-19)
- Transfer Policy Review Working Group Final Report for ICANN Board consideration (public comment) — ICANN (checked 2026-10-19)
- Transfer Policy (updated 21 February 2024) — ICANN (checked 2026-10-19)
- ICANN updates gTLD transfer policy from 4 August 2026 — Realtime Register (checked 2026-10-19)
Today's rules already let you move
Enter the domain and its auth code. Up to 5 days on gTLDs, nameservers kept, no ID, paid in crypto.