How to structure escrow for a .app domain purchase

How to structure escrow for a .app domain purchase. UDRP and ccTLD domain recovery and defense across .app. Email the firm to assess your case.

A technology brand identifies the perfect .app domain – its own product name, registered by a third party who wants a five-figure payment to walk away. The deal looks straightforward. It rarely is. Behind the transfer sits a chain of prior owners, at least one potential trademark dispute, and a payment structure that, if poorly drafted, leaves the buyer exposed the moment the funds clear.

To structure escrow for a .app domain purchase, you need three things working in sequence: a clean chain-of-title check confirming the domain carries no active UDRP complaint, prior adverse decision, or tainted registration history; a properly documented escrow arrangement that holds funds until ICANN transfer is confirmed at the registry level; and a purchase agreement that addresses the seller's representations, dispute indemnities, and what happens if the transfer fails. The WIPO filing fee for a .app complaint starts at USD 1,500 for a single-panel case – a figure that frames the risk a buyer inherits if due diligence is skipped.

This page covers the full structure: the legal environment governing .app, the pre-acquisition checks that matter, how to build the escrow mechanics, what evidence decides whether a prior dispute history is a dealbreaker, and how COGNOMEN approaches each stage.

Why .app carries distinct risk compared with other gTLDs

.app is a generic top-level domain operated under a registry agreement with ICANN and subject to the UDRP in exactly the same way as .com or .net. What sets it apart is its mandatory HTTPS requirement and its strong association with software products and mobile applications – meaning that virtually every valuable .app domain corresponds to an existing product name, brand, or developer identifier somewhere in the world.

That overlap creates pressure. A buyer acquiring productname.app may be buying a domain that a trademark owner has already targeted, considered filing against, or quietly put on watch. The prior registrant may have received a cease-and-desist letter that was never disclosed. In our practice, we see .app transactions where the seller is motivated precisely because the domain has become legally uncomfortable to hold – and where the buyer, absent counsel, has no way of knowing that.

The UDRP applies to .app through the registry's accreditation with ICANN. That means any complainant with relevant trademark rights can file at WIPO, the Forum, CAC, or ADNDRC within days of a transfer completing. The new owner – the buyer – becomes the respondent. The complaint follows the domain, not the seller. That is the fundamental risk the escrow structure must address.

The transfer itself takes place through the registrar system. A change of registrant (also called a WHOIS/RDDS update) triggers a 60-day transfer lock at the registrar level under standard ICANN policy. Buyers who do not account for this in the escrow timeline – specifically in the condition for fund release – sometimes find themselves in a locked domain they cannot move and a dispute they did not anticipate.

What does pre-acquisition due diligence on a .app domain actually cover?

Thorough due diligence on a .app acquisition goes beyond a WHOIS lookup and a trademark search. It covers five distinct lines of inquiry, each capable of surfacing a reason to renegotiate the price, restructure the escrow, or walk away.

Chain-of-title review is the first and most consequential step. Who registered the domain, and when? Has it changed hands before? Was there a prior UDRP complaint – even one that was settled or withdrawn before a decision issued? A withdrawn complaint is not a clean slate. It means a trademark owner identified the domain as a target, assembled evidence, and then stood down for reasons that may have included a side payment the seller is not disclosing. We pull the public UDRP docket at WIPO and the Forum to check for any prior filing history linked to the domain or its historical registrants.

Trademark landscape mapping is the second line. The domain's literal string – or a confusingly similar version of it – may be a registered trademark in one or more jurisdictions. That does not automatically make the acquisition impermissible. But it does mean that after the buyer registers the domain in their own name, a trademark owner could immediately satisfy the first element of a UDRP complaint. We identify those marks and assess the realistic complaint risk before funds move.

Third: registrar history and lock status. Is the domain under a registrar lock, a court order, or a UDRP-related registry lock right now? A domain under any active hold cannot transfer. Attempting the transfer while a lock is in place delays the transaction, burns escrow timelines, and – if the lock reflects an undisclosed dispute – can expose the buyer to liability for attempting to defeat a pending proceeding.

Fourth: content and use history. What has the domain resolved to over the past several years? Archived content showing pay-per-click advertising using a competitor's trademark, or a website mimicking a brand, can mean the domain has an established bad-faith use history. That history does not disappear on transfer. A UDRP panel deciding a complaint against the new owner can – and panels have consistently found – consider historical use as part of the bad-faith analysis, even where the current registrant did not create that content.

Fifth: seller representations and warranty scope. Is the seller a natural person, a company, or a privacy-masked registrant whose actual identity is unclear? The purchase agreement must require the seller to represent that no active, threatened, or anticipated claim exists, that no cease-and-desist letter has been received, and that the seller has full authority to transfer without breaching any obligation. These representations need to be backed by an indemnity clause, not merely a warranty.

For a pre-acquisition due diligence assessment on a specific .app domain, contact info@cognomenlaw.com. We assess the chain of title, the trademark landscape, and the prior dispute history before funds are placed in escrow.

How should the escrow itself be structured for a .app transfer?

Escrow for a domain purchase is not the same as escrow for a real-estate transaction. The mechanics of domain transfer – a registry-level push, a registrar authorization code (also called an EPP code or auth-info code), and a mandatory ICANN notification process – require the escrow conditions to map precisely to each technical step, not merely to a signed contract.

A sound .app domain escrow has four release conditions, in sequence. First, the buyer verifies that the domain is free of any lock or pending proceeding. Second, the seller delivers the auth-info code and the domain is pushed to the buyer's designated registrar. Third, the registrar confirms the domain is in the buyer's account and the WHOIS/RDDS record reflects the new registrant. Fourth – and this is the step that is most often omitted in informal arrangements – a defined holding period expires without a UDRP complaint being filed against the now-transferred domain. That period is typically 30 days, though parties sometimes negotiate 60 days given the time a trademark owner needs to identify a new registrant and prepare a filing.

The escrow agent holds the purchase price throughout. If the transfer fails at any step for a reason attributable to the seller, the funds return to the buyer. If a UDRP complaint is filed during the holding period, the escrow is extended pending the outcome of the proceeding – or the funds are released according to whatever resolution the parties reach. The agreement needs to specify which forum's decision is definitive for that purpose.

One mechanics point that catches buyers: a change of registrant on a .app domain triggers the ICANN Registrar Transfer Policy's 60-day lock, during which the domain cannot be transferred to a different registrar (though it can still be used). The buyer must account for this. If the buyer intends to consolidate the domain into their existing registrar account, the purchase agreement should specify that the transfer goes directly to the buyer's existing registrar, avoiding a second transfer and a second 60-day lock.

In a recent matter – a .app acquisition by a software company, spring 2025 – we identified that the domain had been the subject of a withdrawn UDRP complaint two years prior. The seller had not disclosed it. We restructured the escrow to include a 60-day holding period and required the seller to provide an indemnity backed by a portion of the purchase price retained in escrow for that period. The transaction closed without incident, and the trademark owner did not re-file. That outcome was a function of preparation, not luck.

What evidence decides whether a prior dispute history is a dealbreaker?

Not every prior dispute on a .app domain makes the acquisition untenable. The question is whether the prior dispute reflects a structural conflict – a trademark that will always be able to satisfy the first UDRP element against any holder of this domain – or whether it reflects circumstances specific to the prior registrant's conduct.

If the prior complaint alleged bad faith because the then-registrant was a known cybersquatter who had registered the domain with no plausible legitimate use, and the buyer is the trademark owner itself or a licensee, the dispute history is largely irrelevant. The buyer will hold both the domain and the mark. There is no complainant left.

If, on the other hand, the trademark is held by a third party unrelated to the buyer, and the domain's string is essentially identical to that mark, the buyer is stepping into a conflict that the prior registrant failed to resolve. The question is not whether a complaint will be filed – it is when, and whether the buyer can answer it. That answer turns on what legitimate interest the buyer can document. Panels have consistently held that a bona fide offering of goods or services under the domain name, established before notice of the dispute, is the clearest safe harbor under Paragraph 4(c) of the UDRP. A buyer who acquires the domain and immediately begins building a genuine product on it is in a materially better position than one who parks it and waits.

Evidence we recommend preserving from the moment of acquisition: the purchase agreement and its effective date; the first technical deployment of the domain (SSL certificate issuance, DNS configuration records, hosting setup logs); any business registration, trademark application, or product documentation predating or contemporaneous with the acquisition; and all communications with the seller. That evidentiary record is the respondent's file if a complaint arrives.

We also assess whether the prior withdrawn complaint was accompanied by a payment. A settlement in which the prior registrant received money from the trademark owner in exchange for transfer or for withdrawing a complaint can complicate the buyer's position: it may indicate that the trademark owner considers the domain theirs by right, and that they withdrew only because the prior registrant agreed to the outcome they wanted. If the buyer now holds the domain on different terms, the trademark owner may simply file again.

If you have received details of a prior dispute on a .app domain you are considering acquiring, email info@cognomenlaw.com before the purchase agreement is signed. A focused read of the prior proceeding can clarify whether the risk is manageable or structural.

How does the UDRP apply to .app, and where should a dispute be filed?

.app domains are subject to the full UDRP, meaning a complainant must satisfy all three elements of Paragraph 4(a): confusing similarity to a trademark in which the complainant has rights; the registrant's lack of rights or legitimate interests; and registration and use in bad faith. The cumulative nature of that third element – registered AND used in bad faith – is the most frequently contested aspect of any .app dispute.

The approved forums for a .app UDRP complaint are WIPO, the Forum, CAC, and ADNDRC. WIPO and the Forum together handle the substantial majority of all UDRP filings. For a single .app domain and a single-member panel, the WIPO filing fee is USD 1,500; a three-member panel costs USD 4,000. The Forum's entry point begins around USD 1,300 for one to two domains. CAC offers a lower-cost entry for straightforward cases.

A standard .app dispute at WIPO runs approximately two months from filing to decision. The respondent has 20 days to file a response after the case commences. WIPO's expedited option, available for single-panel cases of up to five domains, targets a decision within about one month.

The choice of forum for a .app dispute involves more than price. WIPO publishes a Jurisprudential Overview that makes its panels' reasoning on recurring issues – passive holding, typosquatting, prior registration history – broadly predictable. The Forum has a larger US-based caseload and somewhat different procedural defaults. Neither is inherently better for complainants or respondents; the choice turns on the nature of the mark, the registrant's profile, and which body of published reasoning best supports the filing party's position.

There is no ccTLD-specific procedure for .app: it is a gTLD managed under ICANN accreditation, so national court routes exist in parallel with the UDRP but are not the primary forum for most disputes. A buyer who acquires a tainted .app domain and faces a UDRP complaint cannot compel the complainant to go to court instead. The complainant chooses the forum.

How does the purchase agreement address UDRP risk after transfer?

The purchase agreement for a .app domain is the document that determines who bears the cost if a UDRP complaint arrives after closing. Without specific provisions, the default answer is: the buyer bears it entirely.

A well-drafted agreement includes, at minimum, the following: a seller warranty that no demand letter, UDRP complaint, court action, or other formal claim relating to the domain has been received or threatened; a representation that the seller is not aware of any trademark owner with a plausible claim against the domain; an indemnity requiring the seller to cover the buyer's UDRP defense costs (including forum filing fees and legal fees) if a complaint is filed within a defined period based on facts predating the transfer; and a dispute-escalation clause specifying that any disagreement about the indemnity is resolved by a mechanism the parties have actually agreed on, not a default provision that may be unenforceable across borders.

Cross-border deals add complexity. If the seller is in a jurisdiction where enforcement of a contractual indemnity requires local court proceedings, the buyer's ability to recover against the indemnity is only as good as their willingness to litigate abroad. We regularly advise buyers to require a portion of the purchase price to be held in escrow specifically as an indemnity reserve for the holding period. That reserve is the practical enforcement mechanism when the seller is an individual in a remote jurisdiction.

In a second recent matter – a .app acquisition in autumn 2025 involving a developer-focused platform name – we negotiated a two-tranche escrow structure: 70% of the purchase price released on confirmed ICANN transfer, and 30% retained for 45 days as an indemnity reserve. The trademark search we ran identified a pending application in the relevant class filed by a known tech company. We extended the indemnity reserve period to 90 days by agreement. The retained sum was ultimately released without incident, but the structure meant the buyer had a funded indemnity in place throughout the risk window.

What is the decision matrix for structuring a .app domain acquisition?

The right structure depends on the domain's history, the price, and the buyer's intended use. Here is how the variables map to the approach.

If the domain is clean – no prior UDRP complaint, no identifiable trademark conflict, a straightforward registrant with a clear history – a standard single-tranche escrow with a 30-day holding period and a seller warranty is ordinarily sufficient. The due diligence workload is lighter. The purchase agreement is shorter. The timeline from agreement to confirmed transfer is typically two to four weeks.

If the domain has a prior UDRP complaint – withdrawn, settled, or decided in the registrant's favor – the structure shifts. The holding period extends to 60 days. The escrow is split into tranches, with the indemnity reserve sized to cover at least one UDRP proceeding at WIPO (filing fee plus legal costs). The seller's representations become more granular, and the indemnity period should match the realistic window during which a trademark owner is likely to identify the new registrant and file.

If the domain string is identical or nearly identical to a registered trademark held by a third party, and the buyer is not that trademark owner or a licensee, the acquisition should pause for a legal opinion before any escrow is opened. The buyer may be structuring payment for a domain they cannot safely hold. At that point, the question is not how to build the escrow – it is whether to proceed at all, or whether to approach the trademark owner directly.

If the buyer is the trademark owner recovering a domain from an alleged cybersquatter, the acquisition by purchase is an alternative to a UDRP complaint. The calculation is whether the seller's asking price is lower than the combined cost of a UDRP proceeding (forum fee plus legal fee, typically in the USD 3,000–7,000 range for a single domain at standard market rates, separate from the forum filing fee). A UDRP complaint is not guaranteed to succeed. A negotiated purchase, if priced correctly and properly documented, removes the uncertainty – but requires the same due diligence and escrow mechanics described above to avoid paying for a domain with hidden liabilities.

For any transaction involving multiple .app domains held by the same registrant, the UDRP permits a single complaint to cover all of them if they share the same registrant. That is relevant context for a buyer negotiating a portfolio purchase: a prior complainant could have done the same, and the absence of a multi-domain complaint in the prior registrant's history does not mean no one was watching.

• Domain Transactions, Due Diligence & Brand Protection – full service overview at COGNOMEN
• How to verify chain of title on a technology domain – analysis of title-check methodology and risk factors
• How to seek a reverse domain name hijacking finding – respondent-side guide to RDNH strategy