The CFTC is again asking whether Polymarket kept Americans out after its 2022 settlement. State licensing boards ask the same kind of question about the past.
On October 27, Reuters reported that the CFTC is again investigating whether Polymarket broke its 2022 settlement with the agency. Investigators are said to be examining Polymarket’s past controls and processes, including how it determined where customers were located.
The question is whether Polymarket kept Americans out in 2022, 2023, and 2024, as well as today.
Polymarket settled with the CFTC in January 2022, paid $1.4 million, wound down the non-compliant markets, and blocked US access. In July 2025, it paid $112 million for QCEX, a CFTC-licensed exchange and clearinghouse, which is how it is legally back in the US. That same month its CEO posted that the CFTC and DOJ had closed their investigations and cleared the company. Fifteen months later, the question is open again.
Polymarket says it “expressly prohibits the use of virtual private networks (VPNs) or similar tools” to get around its geographic restrictions. In August, its head of investigations told Reuters that US users circumventing those restrictions was not “a really prevalent issue.”
In April, prosecutors charged a US Army soldier stationed at Fort Bragg who made roughly $400,000 on Polymarket’s offshore platform. The indictment says he used a VPN and connected through an exit node that geolocated to a foreign country. He has pleaded not guilty.
New Jersey’s Division of Gaming Enforcement saw the same problem in 2019. It fined Gaming Innovation Group $25,000 after a player in Nevada was able to inspect the browser code and “change data to falsely indicate that the patron was located in New Jersey.” The AP summarized the finding: the operator “did not take adequate steps to ensure that the computer server made the final call on whether a patron was within New Jersey. Instead, the patron was able to trick the system.”
Prediction markets are currently fighting over whether states can regulate them at all. The Third Circuit held that the CFTC’s jurisdiction over sports event contracts is likely exclusive. The Ninth and Sixth Circuits have since ruled that states can regulate them. New Jersey’s cert petition is pending at the Supreme Court. If the states win, these companies will have to go before state licensing boards.
These boards are unforgiving about the past. Ohio’s sports gaming statute forbids the commission from licensing anyone who “accepted illegal wagers from individuals located in the United States” on or after April 16, 2015. That is a flat statutory bar with a lookback date. Ohio also requires applicants to establish suitability “by clear and convincing evidence.” New York’s casino licensing law permits denial for “failure to reveal any fact material to qualification,” and reaches prior acts that were never prosecuted.
Ohio does not need a conviction or a finding to refuse the license. What decides whether you get the license is a fact about where particular people were at particular moments.
The regulator does not have to prove you served people where you shouldn’t have. You have to prove, years later, that you didn’t, using records from before your current compliance stack existed. Nothing Polymarket does now can create a record of where its users were in 2022.
Most location checks come down to the IP address. Cloudflare’s documentation: “There is nothing that inherently binds an IP address to a physical location or country.” The operator either blocks every VPN it detects, turning away the roughly one in five web sessions that now arrive through a VPN (it’s one in three on desktop Chrome-based browsers), or takes the IP address at its word. Someone on a VPN that isn’t detected, like the soldier, passes as a foreign user. Either way, the operator saves the result in its own logs. Those logs are the operator’s account of its own conduct. They were never designed to be evidence, and no retention policy makes them into evidence.
An operator needs a verdict it did not author. The user’s phone answers whether it was inside a region and signs the answer with a key held in its hardware. The operator keeps the signed result and never holds a coordinate. Years later, an investigator can verify each one offline, without taking the operator’s word, or ours, for anything.
That is what we built at Octet. The time to start keeping the record is now.