A firm licensed in one place, with clients in twenty, does not run twenty platforms. It runs one platform with a per-client rule set, and the switch that selects the rule set is the client's country of residence. Get that switch wrong and everything downstream is wrong too: the margin the client is given, the instruments they can see, the wording of the risk warning they read, the bonus they are offered, the report their trade lands in.
The mistake I see most often is treating residence as a marketing attribute. It is collected at sign-up, never verified, never re-checked, and never wired to anything except a mailing list segment. Then the firm discovers that a client it has been servicing for a year is resident somewhere its licence does not reach, and that the client's losing months are now a complaint file.
What actually changes when the country changes
The differences are not cosmetic. In the European Union, national regulators applying the product intervention rules that originated with ESMA impose leverage limits that vary by asset class, a standardised risk warning, a ban on monetary and non-monetary inducements to trade, and mandatory negative balance protection on retail CFD accounts. The United Kingdom kept an equivalent regime after leaving the EU and added its own restriction on selling crypto derivatives to retail clients. Australia's regulator, ASIC, has used its own product intervention power over retail CFDs. Japan's regime, supervised by the Financial Services Agency, has long applied tighter retail FX margin rules than most of Asia. These are not the same rules with different numbers. They differ in which instruments are covered, how professional clients are treated, and what has to appear on screen.
Some countries are not a configuration problem at all, they are a serving problem. Retail off-exchange FX in the United States sits under a Commodity Futures Trading Commission and National Futures Association regime that requires registration to solicit or accept US retail persons, and firms outside it do not solve the problem with a smaller leverage setting. Canada moved retail investment dealer oversight to CIRO, and provincial securities commissions have been active against unregistered offshore platforms taking local residents. If your licence does not reach a country, the correct platform setting is closed, not reduced.
None of this is legal advice. Which countries a firm may serve, and on what terms, is a question for its own counsel and its regulator. What a software vendor can tell you is which controls a platform needs so that a lawyer's answer can actually be enforced.
Residence, IP and the payment card do not always agree
Three signals tell you where a client is, and they disagree constantly. The declared country of residence comes from the sign-up form. The address on the identity document and proof of address comes from KYC verification. The IP address comes from the session, and the issuing country of the payment card comes from the card's BIN. A German resident on holiday in Bangkok, using a Revolut card, will trip a naive rule every time.
The workable design is to treat the verified document address as the legal country of record, use IP and BIN as signals that raise a review rather than as blocks in themselves, and require a fresh proof of address before a client can change country. That last part matters more than the rest, because country changes are the mechanism people use to move themselves into a rule set they prefer.
Reverse solicitation is narrower than founders want it to be
The argument that a client from a restricted country "came to us on their own" has a real legal basis in some regimes, and it is far narrower than the marketing team assumes. Where it exists, it typically covers a genuine own-initiative approach by the client, and it is undermined by anything that looks like solicitation: an advert served in that country, a landing page in the local language, an affiliate paid per lead there, a local payment method offered at checkout. We wrote about the mechanics in reverse solicitation and about the exposure created by offshore marketing to EU clients. A firm relying on it needs the paper trail to prove no solicitation happened, and the ad account usually destroys that trail.
The gatekeepers who enforce this for you
Regulators are not the only enforcement layer, and often not the first one you feel. Ad platforms run financial services verification programmes that check a licence against the countries a campaign targets, and a mismatch stops delivery. Mobile app stores apply their own review rules to financial and trading apps, which is why app store financial app rules matter to a platform decision. Card acquirers underwrite the business at a country level, price the risk against high-risk merchant category codes and chargeback thresholds, and can require a rolling reserve or exit entirely when the client geography does not match the licence on file. Banks apply their own jurisdiction risk ratings, sanctions exposure checks and correspondent banking policies, which is the real reason so many applications die quietly.
The pattern is consistent: the licence you hold sets the countries you can be paid from as much as the countries you can trade for. A firm that quietly onboards restricted geographies usually loses its payments before it hears from a regulator.
Building the restriction into the platform, not the policy document
A compliance manual that says "we do not accept clients from country X" is worth nothing if the sign-up form accepts them. The control has to live where the account is created. In practice that means a country list with three states rather than two: open, open with a specific rule set, and closed. The rule set carries the leverage ceiling per asset class, the instrument groups that are visible, the margin close-out level, whether negative balance protection applies, which risk warning text renders, whether inducements can be shown, and which reporting stream the trade joins.
Bundling those settings per country rather than per client is what makes the system auditable. When a supervisor asks how a client in a given country was treated in March, the answer should be a version of a rule set with a date on it, not a reconstruction from individual account records. That is also how MiFID II style obligations get evidenced in practice. Our own eTrader platform holds these as per-group configuration for the same reason: the setting has to be a first-class object, because someone will eventually ask you to prove what it was.
The uncomfortable position, and I will state it plainly: for a firm whose clients are mostly in the EU, an offshore registration with no EU permission is not a lower-cost route to the same business. It is a different business with worse payments, worse advertising access and a complaint process the client can escalate outside your control.
"The country field on an account is a compliance control. Treat it like a text box and you will find out the hard way, usually from a regulator or an acquirer, not from your own reports."
— Roman Onta, Executive Director, SINGUARD
Key Takeaways
- Country of residence is the switch that selects leverage, visible instruments, risk warnings and reporting, so it has to be verified rather than self-declared.
- Some jurisdictions are not a settings problem: where a licence does not reach, the only correct configuration is closed.
- Declared country, document address, IP and card BIN disagree routinely; use the document as the country of record and the others as review triggers.
- Ad platforms, app stores, acquirers and banks enforce jurisdiction rules before a regulator does, usually by cutting off distribution or payments.
Frequently Asked Questions
Can a broker just block an IP address to comply with country restrictions?
IP blocking alone is weak. A client using a VPN passes it and a travelling client fails it. Firms that hold up under scrutiny key restrictions to a verified country of residence from identity and address documents, then use IP and card issuing country as signals that trigger review.
Does reverse solicitation let an offshore broker take EU clients?
Where it exists it is narrow, it covers a genuine own-initiative approach by the client, and it is undermined by advertising, local-language pages, affiliate lead buying or local payment methods aimed at that country. Any firm relying on it needs evidence that no solicitation occurred, and must take its own legal advice.
Why do payment providers care which countries our clients are in?
Acquirers and banks underwrite the merchant, not just the transaction. Client geography drives their jurisdiction risk rating, sanctions exposure, chargeback expectations and correspondent banking policy, so a client base that does not match the licence on file often ends in higher reserves or account closure.
About the Author
Roman Onta is an Executive Director at SINGUARD. He builds the Prop Firm CRM, the Broker CRM, Scalegram and CopySignals side by side with his brother Alex Onta, and he helped on the design of eTrader, the division Alex built and leads. His ground is worldwide payment processing, AML compliance and the corporate structures brokers are built on, work the two of them carry together, shaped by executive roles in the UAE and international corporates. He lives and works in Dubai for most of the year. Meet the executive duo leading Singuard's five divisions.