RSA (https://www.arin.net/about/corporate/agreements/rsa.pdf) clearly state that the services are subject to the terms and conditions stated in the policy manual.

There is explicit text in case of lack of payment. Not so clear what to do if there is a policy violation, but it looks like at a minimum, you will not get further services neither further resources.

Bylaws (https://www.arin.net/about/corporate/bylaws/#bylaws-of-american-registry-for-internet-numbers-ltd) don’t explicitly talk about the obligations of members. This may be related to US law, that you don’t need to explicitly say that behavior against other members is forbidden. In some countries, it is evident that if a member of an association is not following the rules (policies) or is acting against the rights of other members, it can be expelled.

As I said before, we may need another policy proposal to stated what to do.

Why a different policy proposal? Because the same policy section must be related to other policy violations (may be with warnings in case of policy violations and resource recovery only in extreme cases or repetitive misbehavior – this is the case in RIPE), if that’s not clear already in the bylaws, US laws, or RSA.

For me, it is obvious that an association MUST protect members about *any* misbehavior of other members.