diff --git a/doc/ext/account-required.md b/doc/ext/account-required.md
new file mode 100644
index 0000000..4ffb34a
--- /dev/null
+++ b/doc/ext/account-required.md
@@ -0,0 +1,12 @@
+# account-required
+
+This specification defines the informational `soju.im/account-required`
+capability. If present, it indicates that the connection to the server cannot
+be completed unless the clients authenticates, typically via SASL. Note, the
+absence of this capability does not indicate that connection registration can
+be completed without authentication; it may be disallowed due to specific
+properties of the connection (e.g. an untrustworthy IP address), which will be
+indicated instead by `FAIL * ACCOUNT_REQUIRED`.
+
+Clients MUST NOT request `soju.im/account-required`; servers MUST reject any
+`CAP REQ` command including this capability.
diff --git a/downstream.go b/downstream.go
index b7416f3..26032eb 100644
--- a/downstream.go
+++ b/downstream.go
@@ -240,6 +240,7 @@ var permanentDownstreamCaps = map[string]string{
 	"soju.im/bouncer-networks-notify": "",
 	"soju.im/no-implicit-names":       "",
 	"soju.im/read":                    "",
+	"soju.im/account-required":        "",
 }
 
 // needAllDownstreamCaps is the list of downstream capabilities that
@@ -906,6 +907,12 @@ func (dc *downstreamConn) handleCapCommand(cmd string, args []string) error {
 				break
 			}
 
+			if name == "soju.im/account-required" {
+				// account-required is an informational cap
+				ack = false
+				break
+			}
+
 			m[name] = enable
 		}