Inventory first: who is the registrant, who is top admin, who pays
Before asking for anything, build a list that answers three questions for every digital asset: who is the registered owner, who holds top admin rights, and whose name is on the bill. Typical items include the domains used for the website and business systems; the business email service, often on a large cloud productivity platform, and its super admin; the hosting or cloud server account; advertising accounts and business manager accounts on search and social platforms; web analytics and webmaster tools; and services tied to the domain such as payment gateways or map business listings.
Checking is not difficult. For domains, look up the registration in the registrar's public lookup, but many domains use privacy protection that hides the real registrant. In that case, work from payment records and find out whose registrar account the domain sits in. For business email, check who the super admins are in the admin console. For ad accounts, check whether the account is owned by an individual or by the company's business manager, and whose card the payment method uses. Put the results in a table and grade each row. An asset registered to a vendor or individual where the company has no admin access at all is the highest risk.
Do the inventory quietly, using whatever access the company already has. Many owners discover that the main domain was registered ten years ago by a long-departed employee using a personal email, with renewals paid by the agency and recharged on an invoice. Once you see the whole picture, decide whom to approach and in what order. The same control problem often affects tax e-filing accounts, so check those at the same time; see recovering BIR e-filing accounts from a former accountant.
Step one: get top admin access before ownership, and keep the business running
Your first request should not be an immediate transfer. Ask the other side to add a company-controlled email as top-level admin on every asset. The reason is practical. A transfer involves registrar procedures, changes of billing and sometimes a fee settlement, so it can drag on. Adding an admin takes minutes and is hard to refuse. Once the company holds top-level access, a later falling-out cannot switch the business off with one click.
Keep the request calm. Explain that the company is consolidating its digital assets under company accounts and ask for three things: add the company email as top admin; move two-factor authentication to a phone or authenticator the company controls; and provide the registration details and renewal dates for each asset. Send it by email so there is a written record. Meanwhile, prepare for continuity: back up the website files, database and mailbox data to storage the company controls, confirm the domain's expiry date, and if necessary renew in the existing account first so the domain cannot lapse in the middle of a transfer.
Once you have top access, look for anything unusual: mail forwarding to outside addresses, unfamiliar connected apps, unknown users or payment methods in the ad accounts. Silent forwarding rules are a classic warning sign of business email compromise; see what to do about business email compromise. When everything looks clean, move on to the ownership change. Keep a dated log of each permission you receive and each setting you change, because that log becomes useful evidence if the relationship later turns into a dispute over who controlled what.
Moving the domain: registrant change, transfer code and expiry management
Bringing a domain back usually takes two steps: change the registrant details to the company, then move the domain from the other party's registrar account into the company's own account. The registrant change updates the organization name, contact person and contact email to the company and a company-controlled address. Procedures differ by registrar and by extension. Some require confirmation from the current registrant, and some temporarily lock transfers after a registrant change, so follow the registrar's current rules. The second step is the transfer itself, either between accounts at the same registrar or to a different registrar. A move to another registrar normally requires the transfer authorization code from the current account and removal of the transfer lock.
A few cautions. Confirm the domain is not about to expire before you start; if it is, renew first and transfer afterwards. Do not change DNS records during the transfer, or the website and email may go down. After the transfer, check that every DNS record survived, including website, mail and verification records, then turn on auto-renewal and transfer lock and attach a company payment method. Country-code domains may have eligibility rules, such as requiring a locally registered company as registrant, so confirm the company qualifies.
If the other side refuses to give the code or cooperate, the next section explains how to escalate. While you wait, do not register a look-alike domain and move the website to it. That splits your search visibility and customer recognition and gives impersonators an opening; for impersonation sites see taking down fake websites that impersonate your company.
Business email and ad accounts: super admins, billing owner and business manager ownership
For business email, make sure the company holds super admin rights and is the billing owner. For ad accounts, make sure they belong to the company's business manager rather than to someone's personal account. On email, a super admin can manage every user, reset passwords, export data and change billing. The company should have at least two super admin accounts held by two different staff members, with the agency keeping only the limited admin rights it needs. Move billing and the payment method to the company and have invoices sent to a company mailbox. If the agency bought the email service in its own name and resold seats to you, you may have to migrate to a subscription the company opens itself. Back up all mail and contacts first, then switch the mail DNS records.
On advertising, many platforms distinguish between personal ad accounts and business manager accounts. The ideal setup is an ad account owned by the company's business manager, with the agency given campaign access as a partner, rather than the account living inside the agency's business manager. If the agency owns it, ask them to transfer ownership to the company's business manager or add the company as owner. Some platforms do not allow ad account ownership to be transferred, in which case you will need a new account, so export the history and audiences first. Always switch the payment method to the company's own, so the ads do not stop when the agency's card is cancelled and no unpaid balance ends up attached to your name.
Company pages on social platforms work in a similar way but follow each platform's appeal rules; see recovering company social accounts from a former employee.
When they refuse: evidence, written demand, registrar and platform appeals, then a lawyer
If the other side refuses or uses the assets as leverage, escalate in this order: written demand, registrar and platform appeals, then a lawyer's letter. The core task is proving the assets belong to the company. Useful evidence includes bank records and invoices showing the company paid registration, renewal and service fees; contracts or quotations with the agency that mention the website, domain or email; the company's business registration, and a company name or registered trademark matching the domain; the history of the domain being used for the company website and company mail; and internal approvals or emails showing the employee acted for the company when registering. The more complete the evidence, the smoother the appeals.
The written demand should list the assets, the actions required (add admin, provide the transfer code, change the registrant, transfer the ad account) and a reasonable deadline. State that any fee dispute will be settled separately and is not a condition for the handover. If they still refuse, file a registrant or ownership claim with the registrar. Registrars and platforms have procedures for business ownership disputes, but they usually require registration and payment proof, and the outcome depends on their review. Where the domain matches the company's registered trademark and is being held in bad faith, a dedicated domain dispute procedure may be available; whether it applies is a question for a lawyer.
When the asset is in an employee's personal name, departure is the easiest moment to fix it: put the assets on the exit checklist and complete the handover before final clearance, but never withhold wages that are legally due as leverage. Every case is different; consult a licensed lawyer, and treat this article as general information rather than legal advice.
Four rules so you are never locked out again, and how Yixing can help
There are only four rules: the registrant is always the company, at least two company staff hold top admin rights, the payment method is the company's, and vendors only get operating access. In practice, register new domains in the company's own registrar account with the company name and a shared company mailbox as contact. Open every platform, including email, cloud services and ad managers, with an owner account on the shared company mailbox. Add vendors as partners or limited admins and remove them on the day the engagement ends. Turn on auto-renewal everywhere with a company payment method and put every expiry date into the company calendar with advance reminders.
Write into vendor contracts that all digital assets registered or opened for the company belong to the company, must carry the company's registration details, and must be handed over with all access and data within a set period after termination, regardless of any fee dispute. Write into the employee handbook that staff may not register company assets in their own names and must transfer any existing ones on joining or leaving. Run a digital asset inventory once a year, together with your check of tax portals and online banking tokens.
Yixing International Travel (SEC Registration No. CS202009551; Bureau of Immigration accreditation CA-202624381-1) supports Chinese-invested companies in the Philippines with compliance retainer services: mapping the registration and access of company digital assets, drafting handover demands to vendors, assembling ownership evidence, and bringing in technical providers and licensed lawyers when needed. We are not a domain registrar and we cannot promise the outcome of any platform appeal. Consult a licensed lawyer for your specific case; this article is not legal advice.
Frequently Asked Questions
Our domain is registered to our web agency. Can we move it to the company?
The vendor won't give us the domain transfer code. What now?
Our business email was bought by the agency and resold to us. What should we do?
Our ad account sits in the agency's business manager. Can we get it back?
The domain is about to expire. Is a transfer risky?
A former employee registered our domain with a personal email. What can we do?
How do we stop this from happening again?
Let’s talk through your situation — free
Every company is different. Leave your details and a Chinese-speaking advisor will get back within 1 business day with practical, industry-specific guidance and a transparent quote.
Get help with Compliance & Retainer → Free consultation