The audit question is never "do you block restricted countries". It is "show me a client from a restricted country who reached a funded state, and explain how". Firms that answer that in minutes have built the control in the right places. Firms that answer it in weeks have an IP filter on the marketing site and nothing behind it.
Geo blocking is four separate controls that happen to share a country list. Miss any one and the other three create a false sense of coverage.
Why IP alone fails
IP geolocation is a probabilistic lookup against a database of address ranges. It is accurate at country level most of the time and wrong often enough to matter: mobile carriers that route traffic through a neighbouring country, corporate networks that egress from a hub, satellite and roaming users, and consumer VPNs which any determined user installs in under a minute.
The failure runs both ways. Legitimate clients in permitted countries get blocked while travelling, complain, and are waved through by support, which quietly creates the exception process that later shows up as a finding. Meanwhile a genuinely restricted user connects from a permitted endpoint and sails past.
Use IP for what it is good at: suppressing marketing pages, suppressing sign-up forms, and generating a risk signal. Do not use it as the determination of who a client is.
Residency is the real determinant
The regulated question is not where a session originated. It is where the client is resident, and in some regimes also where they are a national or a tax resident. That is established by evidence collected during onboarding: a government identity document, a proof of address recognised in that country, and the checks described in KYC verification levels.
Two rules make the difference. First, the declared country in a dropdown is a claim, not a fact, and it must be reconciled with the document. A client selecting one country while presenting a passport and utility bill from another is a case for review, not an automatic pass. Second, residency has to be re-tested on change: a new address, a new phone country, a new payment instrument country. The signal patterns are in BIN country mismatches.
This describes control design, not what any firm is permitted to do. Which countries you may serve, and what evidence of residency is acceptable, is a legal question for your own advisers in each market you touch.
The four enforcement points
Marketing comes first. Adverts should be excluded from restricted countries at campaign level, not left to the landing page, because an advert delivered into a market is itself the promotion that regulators care about. Landing pages should suppress the sign-up call to action for a restricted IP and say plainly that the firm does not accept clients resident there.
Registration is second. Block at account creation on declared country, before any personal data is collected beyond what the check needs, and return a clear message rather than a generic error, because a vague failure sends the user straight to support to be talked around it.
Verification is third and it is the one that counts. Where the documents indicate a restricted country, the account stops there. No deposit, no trading account, no exceptions granted by an agent. If the firm allows any override at all, it should require a named approver, a written reason and a record that survives the agent leaving.
Payments are fourth. Payment instrument country, payout destination country and the settlement chain each carry their own restrictions, and the routing has to read the same list as onboarding. A firm that blocks registration but happily pays out to a bank in a restricted market has not blocked anything.
VPNs, and what you are actually deciding
You will not detect every VPN, and detection lists produce false positives against ordinary privacy tools and corporate networks. The workable position is to treat VPN or proxy use as a risk factor that raises the evidence bar rather than as a rejection in itself, and to weight it heavily when the anonymised session conflicts with the document set.
The important part is the record. When a client misrepresents residency, the firm's defence is that it applied reasonable controls and acted on the evidence available. That defence needs the trail: what was declared, what was verified, which signals fired, what was decided and by whom. Compliance audit trails covers what that record should contain.
Blocking is not enough on its own
A restricted list is a rule about who may become a client. It says nothing about clients you already have when a country moves. When a market closes, existing accounts need a defined path: no new deposits, positions allowed to close, a stated window, and payouts processed to the client's own verified instrument. Doing that badly is what turns a policy change into a public complaint and, for firms with card volume, into disputes.
The same list also has to cover corporate clients, where the relevant country is the place of incorporation, the place of management and the residence of each beneficial owner. KYB for firms goes through that structure.
One list, read everywhere
The failure I see most often is not a missing control. It is three lists. The marketing team maintains one in the ad manager, the onboarding team keeps one in a document, and the payment routing has whatever was configured at launch. Six months on they disagree, and the version that leaked is the one nobody owned.
Hold the country policy in one place, with the reason and effective date per country, and have the sign-up flow, the verification step, the trading account provisioning and the payment routing read that one record. Firms running the Broker CRM get that shape by default: a country closed in the policy is closed in the portal, in onboarding and in payouts on the same day, and the change itself is logged.
"Three country lists in three systems is not redundancy. It is a guarantee that one of them is wrong and you will find out from a regulator."
— Roman Onta, Executive Director, SINGUARD
Key Takeaways
- IP geolocation is a signal for suppressing marketing and flagging risk, never the determination of where a client is resident.
- Residency should be established from verified documents and re-tested whenever address, phone or payment instrument country changes.
- Enforcement has to sit at four points: ad targeting, registration, verification and payment routing, all reading the same list.
- When a country closes, existing clients need a defined wind-down path, otherwise the policy change becomes a complaint and a dispute problem.
Frequently Asked Questions
Is blocking by IP address enough to restrict a country?
No. IP data is approximate and easily changed by a consumer VPN, and it also blocks legitimate travelling clients. It is useful for suppressing adverts and sign-up prompts and for raising a flag, but the binding control is verified residency evidence at onboarding.
What if a client used a VPN and lied about their country?
Your position rests on the controls you applied and the record you kept. Reasonable checks, a documented decision and prompt action once the misrepresentation surfaces are the defence. That is why the audit trail of declarations, documents and signals matters more than the detection tooling.
Do we have to close existing clients when a country becomes restricted?
That depends on the reason for the restriction and on local law, and it is a question for your advisers. Operationally, firms usually stop new deposits, allow orderly closure of open positions within a stated window and return funds to the client verified instrument, with the whole process documented.
About the Author
Roman Onta is an Executive Director at SINGUARD. He builds the Prop Firm CRM, the Broker CRM, Scalegram and CopySignals side by side with his brother Alex Onta, and he helped on the design of eTrader, the division Alex built and leads. His ground is worldwide payment processing, AML compliance and the corporate structures brokers are built on, work the two of them carry together, shaped by executive roles in the UAE and international corporates. He lives and works in Dubai for most of the year. Meet the executive duo leading Singuard's five divisions.