The onboarding form asks for country of residence. That single field carries more regulatory weight than the certificate of incorporation framed on the office wall, because nearly every financial services regime in the world attaches its licensing requirement to the location of the client rather than the location of the company.
Founders get this backwards constantly. The structuring conversation starts with tax, moves to banking, settles on a jurisdiction, and only afterwards does anyone ask where the clients will come from. By then the marketing plan already assumes a market the licence does not reach.
The rule that most regimes share
The common drafting is that a person must not carry on a regulated activity in the territory, or communicate a financial promotion to a person in the territory, without authorisation. Two triggers, not one. The dealing trigger and the promotion trigger operate independently, and the promotion trigger usually fires first because advertising precedes the first deposit.
That is why a firm can be caught before it has a single client in a country. Running paid social in a language spoken only in that market, buying local search terms, or paying local affiliates all count as communicating into the territory in most drafting. Marketing restrictions on CFDs then sit on top of the authorisation question, adding rules about risk warnings, bonuses and performance claims.
Reverse solicitation is narrower than it sounds
Several regimes allow a client to approach a firm entirely on their own initiative without the firm needing local authorisation. It is a real carve-out and it is read narrowly. Supervisors have repeatedly described it as covering a genuinely unprompted approach for a specific product, exhausted once the firm markets anything else to that client.
In practice the carve-out is destroyed by evidence the firm creates itself. A localised website. A price page in the local currency. An affiliate paid per registration from that country. A support line advertised with a local number. A tickbox at signup where the client declares they came on their own initiative proves nothing, because the question is what the firm did, not what the client typed.
Territorial scope is a question of local law and of specific facts, and it changes with supervisory guidance. Nothing here is advice. Any firm accepting clients from a market needs its own legal opinion for that market before it opens.
Where the mismatch shows up in the stack
Country of residence propagates into every system a firm runs, and each one exposes the mismatch in a different way.
| System | What it exposes |
|---|---|
| Onboarding and KYC | Document country, address proof and IP location disagree with the accepted-country list, and the disagreement is logged. |
| Marketing | Ad platforms apply financial services policies by target country, and some require local authorisation evidence for the market being targeted. |
| App distribution | App store review of financial apps applies country-level rules, and storefront availability is set per territory. |
| Payments | Card BIN country, bank account country and the merchant's licensed country are compared during underwriting and monitoring. |
| Liquidity and platform vendors | Counterparty due diligence asks which markets are served and on what permission, then restricts symbols or refuses the relationship. |
The payments layer is the least forgiving. Acquirers compare the card's issuing country against the merchant's licensed territory during monitoring, and a persistent mismatch reads as either unlicensed cross-border selling or transaction laundering. BIN country mismatches are among the first things a risk team escalates, and the remedy is usually a hard block rather than a conversation.
The structure that works
Firms that solve this stop treating the licence as the top of the structure and treat the market list as the top instead. Decide which markets the business is actually built for. Establish what permission each of those markets requires. Then choose the entity or entities that deliver those permissions, accepting that some markets need a local presence and that some cannot be served at all at the firm's size.
For firms serving European retail clients, no offshore registration substitutes for a route into the European regime, and passporting only works from an authorised establishment inside it, as the passporting rules set out. A second entity is a genuine answer for firms with enough volume in a protected market, and a poor answer for firms hoping to use one entity's brand to justify another's reach. Running an offshore and an onshore entity together only holds up when client allocation follows residence and the two are operationally separate.
The one piece of tooling that helps is boring. A single accepted-country list, enforced at registration, at deposit, at marketing and in the platform, with an audit trail showing which rule blocked which attempt. Firms that run this from one place in their CRM can answer a supervisor's questions in an afternoon. Firms that keep three different lists in three different systems cannot answer them at all.
"I have never seen a supervisor open a file by asking where the company was registered. They open it by asking who was in the country and what was said to them."
— Alex Onta, Executive Director, SINGUARD
Key Takeaways
- Most regimes attach both the dealing duty and the promotion duty to the client's location, not the firm's incorporation.
- Reverse solicitation is a narrow carve-out that a firm's own marketing usually destroys, and a signup tickbox does not save it.
- The mismatch surfaces in KYC documents, ad platform policies, app store territories, card BIN countries and vendor due diligence.
- Pick the target markets first, then the permissions, then the entity, and enforce one accepted-country list across every system.
Frequently Asked Questions
Can I accept clients from any country if my company is offshore?
No. Whether a client may be accepted is decided by the law of the country where that client is located. An offshore incorporation sets your corporate and tax position and does not grant permission to deal with or promote to residents of a regulated market.
Does a disclaimer saying clients approached us on their own initiative work?
On its own, no. Supervisors assess what the firm did: localised pages, targeted advertising, local affiliates and local phone numbers all point to solicitation. The carve-out is designed for genuinely unprompted approaches and is generally exhausted once the firm markets further products to that client.
How do payment providers detect that clients are outside my licensed market?
Underwriting and ongoing monitoring compare the issuing country of the cards being charged, the country of the settlement account and the territory named on the merchant's licence. A persistent pattern of transactions from countries the merchant is not licensed for is treated as an heightened risk signal.
About the Author
Alex Onta is an Executive Director at SINGUARD. He built eTrader, the terminal, the mobile apps, eTrader Broker, Copytrading, Business and Community, along with the worldwide clustered-server infrastructure it all runs on, with his brother Roman Onta helping on the design, and he leads that division today. Together with Roman he builds the Prop Firm CRM, the Broker CRM, Scalegram and CopySignals, and the two of them carry worldwide compliance, payment processing and international business structuring side by side. He lives and works in Dubai for most of the year. Meet the executive duo leading Singuard's five divisions.