Security

Why a platform draws a line on the map, and what it means for you

Finding out that a service does not accept people in your country is annoying and it is usually informative. The line is drawn somewhere specific for reasons that are written down, and reading them tells you a great deal about how seriously an operator takes the part of its business that is not software. This describes how the mechanism works and is not legal advice about any particular situation.

· 10 min read

Why a line gets drawn at all

Financial activity is regulated by the place where the customer is, not by the place where the company is. An operator serving somebody in a given country is generally treated as doing business in that country, and whatever rules apply there apply to that relationship regardless of where the servers sit or where the company is registered.

That means every jurisdiction served is a separate compliance obligation with its own requirements, its own supervisory relationship and its own cost. Serving one more country is not a switch that gets flipped, it is a programme of work that has to be paid for and maintained, and the decision to do it is commercial before it is anything else.

So a restriction usually means one of two things, and they are very different. Either the operator has not yet done the work for that jurisdiction, or the activity is not permissible there on terms the operator can meet. Both produce the same message on a screen and they are not the same fact, and which one applies is frequently stated somewhere.

You are regulated by where you are, not by where the company is. Every country served is a separate obligation somebody has to pay for and maintain.

What a licence actually covers

A licence is not a general seal of approval, it authorises a specific set of activities for a specific entity in a specific place. An entity permitted to exchange one asset for another may not be permitted to hold customer funds, offer leverage, or serve customers outside its home jurisdiction, and each of those is a separate permission with separate conditions.

This is why a prominently displayed licence can be entirely genuine and entirely irrelevant to what you are about to do. The correct question is not whether an operator is licensed but whether the activity you are engaging in, in the place you are, is covered by a permission that entity actually holds.

The answer is public. Supervisors maintain registers, the register entry states the entity name and what it may do, and matching that against the name on the terms page you agreed to takes a couple of minutes. Doing that once for a platform you intend to use is one of the higher-value checks available and it is very rarely done.

Registration is not authorisation

Many operators are registered with an authority for a narrow purpose, most commonly to comply with rules on money laundering, and that registration is sometimes presented in a way that suggests broader supervision. It genuinely means something and it means something narrow: the entity has notified an authority and accepted specific obligations, usually about identifying customers and reporting suspicious activity.

It does not mean the authority has examined the business model, verified how customer assets are held, or formed any view about whether the operator is sound. Those are the things an authorisation regime is designed to do, and a registration for anti-money-laundering purposes is not one.

The distinction is visible in the wording. Registers publish the basis on which an entity appears, and the difference between registered for one purpose and authorised to conduct a business is written in plain language on the entry itself, whatever the marketing around it suggests.

How the restriction is actually enforced

The first layer is the network address, which is why a restriction usually appears as soon as a page loads. It is a coarse instrument, it is wrong reasonably often, and every operator knows it is easy to circumvent, which is why it is the first layer rather than the only one.

The second is what you declare and what your documents show during identity verification, which is far harder to work around because it involves representations you have made. The third is behavioural: patterns in how an account is used can indicate a location different from the one declared, and operators do look at that.

The layers exist because the operator's obligation is not to make circumvention difficult but to not serve customers it is not permitted to serve. That distinction explains why enforcement often happens later rather than at signup, and why it can surface at the moment of a withdrawal rather than at the moment of a deposit.

Why circumventing it is a poor trade

The immediate consequence is that you have made a false representation in an agreement, which is the operator's justification for closing the account and, in many arrangements, for freezing it while the situation is resolved. The terms usually say so explicitly, and they are enforced.

The second consequence is the one people do not think about until it matters. Whatever protections exist for customers in the jurisdiction you claimed to be in are protections you cannot invoke, because you are not there, and whatever protections exist where you actually are do not apply either, because the operator does not serve there. You have positioned yourself outside both.

The third is timing. Restrictions are usually enforced when something is examined, and the thing most likely to be examined is a withdrawal of a meaningful amount. The moment at which a circumvention is discovered is therefore the moment you most want it not to be, and that is structural rather than bad luck.

Circumventing a restriction puts you outside both sets of protections at once: the ones where you claimed to be, and the ones where you actually are.

What changes when a jurisdiction is added or removed

An addition usually means the operator has completed a programme of work: an entity in place, a permission obtained, local requirements implemented. It is a substantial signal about commitment, and it is worth reading the announcement to see which entity holds the permission, because it is frequently a different entity from the one you already deal with.

A removal is more informative and is usually announced with little detail. It can mean rules changed, or that the operator decided the cost of continuing exceeded the revenue, and the second is a comment on the size of the business there rather than on anything being wrong.

For an existing customer, what matters is the transition arrangement: how long you have, whether you can still withdraw, and whether positions can be closed in an orderly way. Those terms are usually specified and they are the part worth reading immediately, because they carry deadlines.

Reading a terms page for what it says

Three things are worth locating before anything else, and all three are usually within the first two screens. Which legal entity you are contracting with, since a group can have several and they do not carry the same permissions. Which law governs the agreement and where disputes are heard. And the list of jurisdictions not served, which is usually a specific clause rather than a footnote.

The governing law clause is the one most often skipped and it decides the practical value of everything else. A dispute heard in a distant jurisdiction under a law you do not know is a dispute you are unlikely to pursue, whatever your rights notionally are, and that is a real consideration rather than a technicality.

None of this requires legal training. It requires reading three clauses that are written to be found, and knowing that they exist is most of the work. What you do with the answer is a personal decision this article does not attempt to make.

Where identity verification fits

Verification is how an operator establishes the facts on which its permissions depend, including where you are. That is why it typically happens before money moves rather than at signup, and why it asks for documents that establish residence rather than only identity.

It also creates a record. Once you have provided documents showing a location, the operator has a basis for its treatment of your account, and changing that later is a process rather than a preference. Anybody who moves country while holding an account discovers this, and the process is usually straightforward when handled openly.

What verification is not is a guarantee about the operator. It establishes facts about you for the operator's benefit and for the supervisor's, and none of it is evidence that the operator is well run, solvent, or careful with what it holds. Those are separate questions with separate evidence.

What is worth checking before opening an account

Five things, all published. Which entity you are contracting with. Whether that entity holds a permission covering the activity you intend, in the place you are. What law governs and where disputes are heard. Whether your jurisdiction appears on the restricted list. And what the terms say happens if a jurisdiction is added to that list later.

The fifth is the one nobody reads and the one with a deadline attached. Terms that specify an orderly wind-down period are a different proposition from terms that reserve the right to suspend access immediately, and both exist, and the difference only becomes visible when it is too late to choose.

This is fifteen minutes of reading, once, for a relationship that may hold your money for years. That ratio is unusually favourable compared with almost anything else a trader spends time on, and it is one of the few checks that does not require any judgement about markets.

What none of this is

This describes how jurisdictional restrictions work as a mechanism. It is not legal advice, it does not describe any particular regime, and nothing in it should be read as a statement about what is permitted for any individual, which depends on facts this article cannot know.

It is also not a claim that a restricted operator is better or worse than an unrestricted one. Operators serving fewer places are sometimes doing so because they have chosen to be careful and sometimes because they have not done the work, and the two look identical from outside until you read which one applies.

What the mechanism does support is a small number of checkable questions with public answers. Asking them before rather than after is the entire practical content of the subject, and it is available to anybody willing to spend a quarter of an hour on it.

Frequently asked

Why can a platform refuse users from my country?

Because financial activity is regulated by where the customer is, not where the company is. Every jurisdiction served is a separate compliance obligation with its own requirements and cost. A restriction usually means either the operator has not done that work yet, or the activity is not permissible there on terms it can meet.

Does a licence mean a platform is approved for everything?

No. A licence authorises specific activities for a specific entity in a specific place. An entity permitted to exchange assets may not be permitted to hold customer funds, offer leverage, or serve customers elsewhere. The question is whether your activity, where you are, is covered by a permission that entity holds.

What is the difference between registered and authorised?

Registration is usually narrow, most commonly for anti-money-laundering purposes: the entity has notified an authority and accepted specific obligations. It does not mean the authority examined the business model or how customer assets are held. Registers state the basis in plain language on the entry itself.

How is a geographic restriction enforced?

In layers. The network address first, which is coarse and easy to circumvent. Then what you declare and what your documents show at verification. Then behavioural patterns. The operator's obligation is not to make circumvention hard but to not serve customers it may not serve, which is why enforcement often comes later.

What happens if I circumvent a restriction?

You have made a false representation in an agreement, which the terms usually cite as grounds for closing or freezing the account. You also place yourself outside both sets of protections at once. And it tends to surface when something is examined, which is most often a withdrawal of a meaningful amount.

What does it mean when a platform leaves a jurisdiction?

Either rules changed or the operator decided the cost of continuing exceeded the revenue there, and the second is a comment on the size of that business rather than on anything being wrong. For an existing customer what matters is the transition arrangement, which is usually specified and carries deadlines.

What should I read in the terms?

Which legal entity you are contracting with, since a group can have several with different permissions. Which law governs and where disputes are heard, because a dispute in a distant jurisdiction under an unfamiliar law is one you are unlikely to pursue. And the list of jurisdictions not served.

Is identity verification evidence that a platform is sound?

No. It establishes facts about you for the operator's and the supervisor's benefit, including where you are, which is why it asks for documents establishing residence. Whether the operator is well run, solvent or careful with what it holds is a separate question with separate evidence.

Join the waitlist All articles