diff --git a/app/models/concerns/domain/lockable.rb b/app/models/concerns/domain/lockable.rb
new file mode 100644
index 000000000..68721e595
--- /dev/null
+++ b/app/models/concerns/domain/lockable.rb
@@ -0,0 +1,46 @@
+module Concerns::Domain::Lockable
+  extend ActiveSupport::Concern
+
+  def apply_registry_lock
+    return unless registry_lockable?
+    return if locked_by_registrant?
+
+    statuses << DomainStatus::SERVER_UPDATE_PROHIBITED
+    statuses << DomainStatus::SERVER_DELETE_PROHIBITED
+    statuses << DomainStatus::SERVER_TRANSFER_PROHIBITED
+
+    save
+  end
+
+  def registry_lockable?
+    (statuses & [
+      DomainStatus::PENDING_DELETE_CONFIRMATION,
+      DomainStatus::PENDING_CREATE,
+      DomainStatus::PENDING_UPDATE,
+      DomainStatus::PENDING_DELETE,
+      DomainStatus::PENDING_RENEW,
+      DomainStatus::PENDING_TRANSFER,
+      DomainStatus::FORCE_DELETE,
+    ]).empty?
+  end
+
+  def locked_by_registrant?
+    lock_statuses = [
+      DomainStatus::SERVER_UPDATE_PROHIBITED,
+      DomainStatus::SERVER_DELETE_PROHIBITED,
+      DomainStatus::SERVER_TRANSFER_PROHIBITED,
+    ]
+
+    (statuses & lock_statuses).count == 3
+  end
+
+  def remove_registry_lock
+    return unless locked_by_registrant?
+
+    statuses.delete(DomainStatus::SERVER_UPDATE_PROHIBITED)
+    statuses.delete(DomainStatus::SERVER_DELETE_PROHIBITED)
+    statuses.delete(DomainStatus::SERVER_TRANSFER_PROHIBITED)
+
+    save
+  end
+end
diff --git a/app/models/domain.rb b/app/models/domain.rb
index 30ed0b580..66b1feb47 100644
--- a/app/models/domain.rb
+++ b/app/models/domain.rb
@@ -6,6 +6,7 @@ class Domain < ActiveRecord::Base
   include Concerns::Domain::ForceDelete
   include Concerns::Domain::Deletable
   include Concerns::Domain::Transferable
+  include Concerns::Domain::Lockable
 
   has_paper_trail class_name: "DomainVersion", meta: { children: :children_log }
 
diff --git a/test/models/domain/lockable_test.rb b/test/models/domain/lockable_test.rb
new file mode 100644
index 000000000..5b62df355
--- /dev/null
+++ b/test/models/domain/lockable_test.rb
@@ -0,0 +1,59 @@
+require 'test_helper'
+
+class DomainLockableTest < ActiveSupport::TestCase
+  def setup
+    super
+
+    @domain = domains(:shop)
+  end
+
+  def test_registry_lock_on_lockable_domain
+    refute(@domain.locked_by_registrant?)
+    @domain.apply_registry_lock
+
+    assert_equal(
+      [DomainStatus::SERVER_UPDATE_PROHIBITED,
+       DomainStatus::SERVER_DELETE_PROHIBITED,
+       DomainStatus::SERVER_TRANSFER_PROHIBITED],
+      @domain.statuses
+    )
+
+    assert(@domain.locked_by_registrant?)
+  end
+
+  def test_registry_lock_cannot_be_applied_twice
+    @domain.apply_registry_lock
+    refute(@domain.apply_registry_lock)
+    assert(@domain.locked_by_registrant?)
+  end
+
+  def test_registry_lock_cannot_be_applied_on_pending_statuses
+    @domain.statuses << DomainStatus::PENDING_RENEW
+    refute(@domain.apply_registry_lock)
+    refute(@domain.locked_by_registrant?)
+  end
+
+  def test_remove_registry_lock_on_locked_domain
+    @domain.apply_registry_lock
+
+    assert_equal(
+      [DomainStatus::SERVER_UPDATE_PROHIBITED,
+       DomainStatus::SERVER_DELETE_PROHIBITED,
+       DomainStatus::SERVER_TRANSFER_PROHIBITED],
+      @domain.statuses
+    )
+
+    @domain.remove_registry_lock
+
+    assert_equal(["ok"], @domain.statuses)
+    refute(@domain.locked_by_registrant?)
+  end
+
+  def test_remove_registry_lock_on_non_locked_domain
+    refute(@domain.locked_by_registrant?)
+    refute(@domain.remove_registry_lock)
+
+    assert_equal([], @domain.statuses)
+    refute(@domain.locked_by_registrant?)
+  end
+end