Registration details can be found in the TLD reference chart.
Renewal requests should be submitted prior to the domain’s expiry date in order to renew the domain. .IO domains are deleted 3 days prior to expiry if they are not renewed manually prior to this time or set to auto-renew. If the domain is not renewed, it enters a 90 day redemption period.
Auto-renew can be removed up to ~2 days prior to the domain’s expiration date, otherwise the domain will renew.
If a domain name is not renewed by its expiry date, it is not immediately released, but is held in quarantine for 30 days. During that 30 day period, it can be redeemed (reactivated) by the reseller in the RWI; however, the cost to reactivate a domain that is in quarantine is higher than the standard renewal rate. After the 30 day quarantine period, if the domain has not been reactivated, it is made available to the public.
.IO transfers follow the procedure outlined in Transferring domains and changing domain ownership. Authcodes are sufficient for outgoing transfers; email requests are not required.