What is in-process geolocation?

In-process geolocation means establishing location during each transaction rather than only at account opening, and OFAC has cited its absence in enforcement.

Onboarding is not enough

Many compliance programmes check where a customer is once, when the account is opened, and treat the answer as permanent. A customer who onboards from an allowed country and later transacts from a sanctioned one is never checked again.

The U.S. Treasury’s Office of Foreign Assets Control (OFAC) said so when it settled with Payward, Inc., the operator of Kraken, on 28 November 2022.

Kraken failed to exercise due caution or care for its sanctions compliance obligations when, knowing it had customers worldwide, it applied its geolocation controls only at the time of onboarding and not with respect to subsequent transactional activity, despite having reason to know based on available IP address information that transactions appear to have been conducted from Iran.

The settlement covered 826 transactions between October 2015 and June 2019. The same release notes that Kraken “did not implement IP address blocking on transactional activity across its platform,” and points to “the importance of using geolocation tools, including IP blocking and other location verification tools.” OFAC made a similar point in 2021 with BitPay, which it said “had location information, including Internet Protocol (IP) addresses and other location data,” about the people involved before it processed their payments (enforcement release, 18 February 2021).

What in-process means in practice

• The location check runs at the moment of the action that carries the legal risk: the trade, the withdrawal, the wager, the transfer.
• The result is tied to that action, so an auditor can see which check covered which transaction.
• A failed or inconclusive check stops or holds the action rather than being logged and ignored.

Checking every transaction helps only if each check is hard to get around. A VPN defeats an IP check on every trade as easily as one at onboarding.

So the signal behind each check matters. See IP geolocation vs device geolocation for why, and jurisdictional eligibility for cases where the rule itself changes per transaction.

Last reviewed 19 October 2026