Step-by-step: structure escrow for a .co domain purchase

A .co domain looks clean in WHOIS, the seller is motivated, and the price is agreed. Then the transfer completes — and a prior UDRP complaint surfaces, or the registration traces back to a contested chain of title. That sequence plays out in our practice more than buyers expect.

To structure escrow for a .co domain purchase, a buyer must complete due diligence on chain of title and prior dispute history before funds are released, use a neutral third-party escrow account keyed to verified transfer confirmation, and confirm that the domain is not subject to a registrar lock, a UDRP hold, or a pending ccTLD proceeding. The .co zone operates under ICANN-accredited registrars and the UDRP applies, so a tainted domain carries live arbitration risk into the buyer's hands. A well-structured escrow typically runs two to four weeks from signed purchase agreement to completed transfer.

This guide walks each step in order, flags the trap inside it, and explains what distinguishes a clean transaction from one that closes with inherited risk.

Why does .co domain escrow carry distinct risks?

The .co registry — operated by Neustar on behalf of Colombia — is a full ICANN-accredited zone, and the UDRP applies to it in the same way it applies to .com. That means a domain with a history of bad-faith registration can be the subject of a live or future UDRP complaint even after it changes hands. A buyer who acquires such a domain does not automatically shed the risk.

Panels have consistently examined whether a new registrant acquired a domain with actual or constructive knowledge of an existing trademark dispute. Where a purchase price is grossly above renewal cost and the domain closely mirrors a well-known mark, the acquisition itself can become evidence of bad faith in a subsequent complaint. The .co zone amplifies this exposure because the suffix is widely used as a commercial shorthand — "company", "Colombia", or a truncated brand — meaning trademark conflicts arise frequently and the targets are often high-profile marks.

There is a second structural risk. Because the .co registry uses the standard ICANN transfer protocol, a poorly documented transfer can stall at the registrar level or, worse, be reversed by a prior owner alleging account compromise or unauthorized transfer. Without escrow keyed to a confirmed registrar ACK (acknowledgment), the buyer may have paid but not received clear title. We have seen this scenario arise in cross-border .co transactions where the seller's registrar was in a different jurisdiction than the buyer's.

If you are evaluating a .co domain purchase and are uncertain about the chain of title or dispute history, contact info@cognomenlaw.com before the transaction closes.

Step 1: Confirm the legal framework and who holds transfer authority

Before any escrow structure is designed, establish who actually controls the domain. The registrant of record in RDDS (the successor to WHOIS) is the legal holder — but beneficial ownership, purchase options, and corporate restructurings can mean the RDDS name and the true decision-maker diverge. Require the seller to produce a current RDDS printout, registrar account confirmation, and any corporate authorization if the registrant is an entity rather than a natural person.

For .co specifically, verify that the registrar is ICANN-accredited and not a reseller whose underlying registrar may be a different entity. This matters for the escrow structure: the entity that initiates the transfer at the registrar level must be the one that instructs the escrow agent. A mismatch between the contractual seller and the registrar-account holder is one of the most common causes of delayed or failed transfers. Confirm the registrar's identity from the RDDS record, not from what the seller tells you.

The trap in this step: sellers occasionally list a domain through a broker while the registrar account belongs to a different corporate entity — a subsidiary, a predecessor company, or even an individual officer. If that entity is not a party to the purchase agreement, transfer consent cannot be given by the seller, and the escrow agent will correctly refuse to release funds against a defective delivery.

How do you run a chain-of-title and prior-dispute check for a .co domain?

A chain-of-title check examines the full registration history: original registrant, every change of registrant, and whether any prior owner was the subject of a UDRP complaint, a court action, or a registrar suspension. The .co zone does not publish a unified transfer history, so this review draws on RDDS historical data, WIPO and Forum case search databases, and registrar-level WHOIS history services.

The steps are sequential and each one feeds the next:

1. Run a WIPO and Forum case search on the exact domain string. Both providers maintain publicly searchable case archives. A prior complaint — even one that was denied or withdrawn — signals that the domain attracted trademark attention. A prior transfer order means the current registration may itself be the result of a recovery action, and you need to know by whom and why it was subsequently re-registered.
2. Check historical RDDS records using a reputable WHOIS history service. Note every registrant change and the approximate date. Rapid succession changes — particularly within 90 days — suggest either a reseller chain or an attempt to obscure prior bad-faith use.
3. Search ICANN's registrar data for any active dispute tag, transfer lock, or registry-level hold on the domain. A domain currently under a UDRP complaint will have a registrar lock that prevents transfer. If the domain is locked, the transaction cannot close until the complaint is resolved.
4. Review trademark databases for marks that match or closely resemble the domain string, in the jurisdictions most relevant to the intended buyer and seller. A .co domain with a string identical to a registered trademark in Colombia, the European Union, or the United States carries elevated UDRP exposure post-acquisition.
5. Assess the prior use record of the domain. Screenshots of prior landing pages, archive.org captures, and prior ownership records together form the "use" leg of any future UDRP analysis. A domain that previously pointed at a pay-per-click parking page monetizing a competitor's brand is tainted even if the current owner has cleaned it up.

The trap in this step: buyers routinely stop at step one — a WIPO case search — and declare the chain clean. A clear WIPO search does not mean the domain has not been the subject of a court proceeding, a registrar abuse complaint, or a URS action in a new-gTLD equivalent. It also does not reveal use-history problems visible only in archive captures. A prior-dispute check that stops at WIPO is incomplete.

For more on verifying chain of title before a domain purchase, see our chain-of-title verification service.

Step 2: Draft the purchase agreement before opening escrow

The purchase agreement is the document that governs what "delivery" means and what happens if delivery fails. It must be executed and agreed before the escrow account is opened — not after. An escrow agent holding funds against an unsigned or ambiguous agreement has no clear instruction set when disputes arise.

A well-drafted .co domain purchase agreement covers:

• The domain string precisely as it appears in RDDS, including the extension — do not abbreviate or paraphrase.
• Representations by the seller: that the domain is free of liens, locks, pending complaints, and known adverse claims; that the seller has full authority to transfer; and that no UDRP or ccTLD proceeding has been filed or threatened.
• Conditions precedent to escrow release: the buyer's receipt of a registrar-level transfer confirmation (an ACK from the gaining registrar), not merely a push notification from the seller's side.
• Dispute resolution for the transaction itself: which law governs the agreement and what mechanism resolves a seller-default or a failed transfer. Note that a UDRP complaint addresses domain ownership disputes between a brand owner and a registrant — it does not resolve a contractual dispute between buyer and seller over a failed sale.
• A sunset provision: if transfer is not confirmed within a stated period (commonly 30 days), the escrow agent is instructed to return funds automatically, not to hold them open indefinitely.

The trap in this step: sellers sometimes propose to "push" the domain in the registrar interface before the purchase agreement is signed, asking the buyer to trust the push and pay simultaneously. This is structurally unsafe. A push without a concurrent escrow instruction creates a moment — however brief — when the domain has left one registrar account and not yet reached the other, with no neutral holder of the funds. Decline any structure that bypasses escrow.

Step 3: Select the escrow agent and structure the escrow mechanics

A neutral escrow agent holds the purchase price until the agreed delivery conditions are met and releases funds only upon verified confirmation. For domain transactions, the standard practice uses a specialist domain escrow service rather than a general financial escrow, because domain escrow services understand registrar mechanics, can verify transfer confirmation directly, and hold appropriate authorizations.

When structuring the escrow for a .co domain purchase, the mechanics run as follows:

1. The buyer deposits the agreed purchase price with the escrow agent.
2. The escrow agent confirms receipt to both parties and issues a transfer instruction window — typically five to ten business days for the seller to initiate the registrar transfer.
3. The seller initiates the transfer at the registrar level using the domain's authorization code (EPP auth code). The gaining registrar — the buyer's registrar — initiates the ICANN transfer protocol.
4. Under ICANN's transfer policy, the gaining registrar sends a transfer authorization request. The registrant of record (the seller) must approve it, or it auto-approves after a specified period. The key point: the escrow agent does not release funds until the gaining registrar confirms the transfer is complete.
5. On confirmed ACK from the gaining registrar, the escrow agent releases funds to the seller.
6. If the transfer is not confirmed within the agreed window, the escrow agent returns funds to the buyer per the sunset provision in the purchase agreement.

The trap in this step: some sellers — particularly individual registrants unfamiliar with formal transactions — resist using a third-party escrow service, proposing instead that the buyer pay first and receive the domain second, or use a personal PayPal-style payment that offers no registrar-level verification. Escrow is non-negotiable for any transaction above a de minimis amount. The entire protection of the buyer rests on the escrow agent's independence.

In a recent matter involving a .co domain — a mid-five-figure transaction, spring 2025 — we identified through pre-closing due diligence that the seller's registrar account was held by a dissolved entity. Funds had already been tendered to escrow. We paused the release, required corrected documentation establishing successor authority, and completed the transfer without loss approximately three weeks later. The escrow structure made the pause possible.

To weigh the due diligence and escrow structure for a specific .co acquisition, email info@cognomenlaw.com. We assess chain of title, dispute history, and transaction mechanics.

Step 4: Manage the transfer window and confirm clean title

Once the escrow account is funded and the purchase agreement is signed, the active transfer period begins. This stage is where most procedural failures occur, and it requires direct communication between the buyer's legal counsel and both registrars — not just the seller.

Confirm the following before instructing the escrow agent to release funds:

• The gaining registrar has sent a formal transfer confirmation (the ACK email or API confirmation), not merely a "domain is pending" notification.
• The RDDS record for the domain now shows the buyer — or the buyer's designated registrant — as the registrant of record.
• No new UDRP complaint, registrar lock, or registry hold has been placed on the domain during the transfer window. Check the RDDS status flags: a domain showing "clientTransferProhibited" or "serverTransferProhibited" after the transfer should be flagged immediately.
• The transferred domain's registrar account reflects the buyer's contact email, not the seller's. A domain that transferred but retains the seller's email on the gaining registrar account is not fully under the buyer's control.

The trap in this step: buyers often treat a push notification from their registrar's dashboard as conclusive proof of transfer. It is not. The RDDS record is the authoritative reference. Dashboard notifications can reflect an internal account move without a confirmed inter-registrar transfer. Always verify against RDDS before releasing escrow.

Once clean title is confirmed — RDDS correct, no locks, no pending complaints, ACK in hand — the escrow agent releases funds and the transaction is complete. Retain all transfer documentation: the purchase agreement, the escrow confirmation, the RDDS screenshot at closing, and the gaining registrar's ACK. These records are essential if the domain is later the subject of a UDRP complaint: they demonstrate the acquisition price, the due diligence performed, and the registrant's good faith at the time of transfer.

What happens if a UDRP complaint is filed after you buy the .co domain?

A new registrant who acquires a .co domain in good faith and can document the clean acquisition is well-positioned to defend a subsequent UDRP complaint. The good-faith defense draws on Paragraph 4(c) of the UDRP — specifically, whether the registrant has a legitimate interest in the domain — and the documentary record from the transaction is central to that defense.

What decisions turn on, in our experience, is the combination of the acquisition price, the due diligence record, and the post-acquisition use. A buyer who paid a demonstrably commercial price, conducted a verifiable prior-dispute search, and began using the domain for a genuine business purpose is in a materially stronger position than one who paid close to renewal cost for a domain matching a well-known mark and has not used it since. Panels have consistently held that passive holding of a domain identical to a well-known trademark — with no plausible good-faith use — can constitute evidence of bad faith even without active misuse.

The second scenario is an inherited complaint: a UDRP was filed against the prior registrant, the domain changed hands mid-proceeding (something the purchase agreement's representations should have disclosed), and the complaint names or is redirected to the new registrant. This is rare but not unheard of. When it occurs, the buyer's options include providing evidence to the panel of the clean acquisition and arguing that the prior bad faith is not imputed to the new registrant, or — if the complaint was clearly abusive — pursuing a finding of Reverse Domain Name Hijacking.

We regularly advise buyers who receive a complaint shortly after closing on a .co domain. In one matter — a .co acquisition, late 2024 — a complaint was filed within six weeks of a transfer. We built the respondent's record around the purchase agreement, the escrow records, and the pre-acquisition due diligence file. The panel denied the complaint. The escrow documentation was the spine of the defense.

For a deeper treatment of URS and suspension as a parallel risk in related gTLD zones, see our FAQ on URS domain suspension.

Decision matrix: escrow structure versus direct transfer

The right structure depends on the transaction size, the counterparty, and the dispute risk the due diligence has surfaced. Here is the practical breakdown:

If the domain is a premium .co with a mid-four-figure or higher price tag and any prior trademark overlap in the string, a full escrow structure — independent escrow agent, prior-dispute check, purchase agreement with representations, ACK-triggered release — is the only appropriate structure. The cost of escrow services is a fraction of the downside risk. Timeline: two to four weeks from signed agreement to confirmed transfer.

If the domain is a lower-value .co, the registrant is a known commercial seller with a verifiable history, and the prior-dispute check is clean, a simplified escrow structure — using a reputable domain escrow platform with a shorter instruction window — may be proportionate. However, the purchase agreement's representations and the ACK condition remain non-negotiable regardless of transaction size. Timeline: seven to fourteen days.

A direct transfer without escrow — where the seller transfers first and the buyer pays on receipt, or vice versa — is appropriate only in transactions between counterparties with an existing commercial relationship and documented mutual trust, with legal counsel on both sides who have confirmed the chain of title independently. In any other context, direct transfer is a structural risk that escrow eliminates at modest cost.

The UDRP does not adjudicate contractual disputes between buyer and seller. If a transfer fails and the seller retains the funds, the remedy is a contractual or consumer-law claim in the applicable jurisdiction — not a WIPO complaint. That is exactly the outcome escrow is designed to prevent.

Related at COGNOMEN

• Domain purchase, sale, and escrow services — full transaction support across gTLDs and ccTLDs
• Chain-of-title verification — pre-acquisition dispute history and ownership checks
• URS suspension FAQ — understanding rapid suspension risk in new gTLDs

Author: Cordelia Roe — UDRP complainant practice & gTLD recovery; domain transactions and brand protection. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

Domain in disputeYour sideI want to recover a nameI received a complaint — I need a defensePortfolio / brand protectionWhat happenedEmailI agree to the processing of my enquiry as described in the privacy policy.Assess my case

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.