TL;DR: .bank enforces a 60-day transfer lock after any contact change, including automated updates from my registrar's privacy service. I initiated what I believed was a standard inter-registrar transfer on January 12. The losing registrar approved. The registry rejected it on January 14 with code 2304 (Object status prohibits operation). No refund from gaining registrar. Seven days to diagnose because the lock reason was not exposed in EPP response detail—only visible via registry WHOIS variant with 48-hour lag.
Timeline:
- December 28: Privacy service rotation updated registrant email
- January 12: Transfer initiated, auth code accepted
- January 14: Registry rejection, no detail
- January 16: WHOIS finally shows "serverTransferProhibited"
- January 19: Lock expires, re-initiated successfully
I assumed standard 60-day lock applied to initial registration only. Incorrect. This is a post-change lock with no registrar override capability.
Question: Which other TLDs implement extended or non-obvious transfer locks? I have found references to .bank, .insurance, and some ccTLDs with local presence requirements, but no comprehensive mapping.