Definition

What geolocation controls does OFAC expect?

Last reviewed 20 October 2026

OFAC has not published a geolocation rule, but its enforcement releases say what it expects: use the location information you have, including IP addresses, block users in sanctioned jurisdictions, and apply the check to every transaction rather than only at onboarding.

What the enforcement record says

The clearest guidance comes from two settlements with virtual-currency companies.

BitPay, 18 February 2021. OFAC said BitPay “had location information, including Internet Protocol (IP) addresses and other location data,” about the people involved before it processed their payments, and stressed “screening all available information, including IP addresses and other location data of customers and counterparties” (enforcement release).
Payward (Kraken), 28 November 2022. OFAC faulted Kraken for applying “its geolocation controls only at the time of onboarding and not with respect to subsequent transactional activity,” and noted it “did not implement IP address blocking on transactional activity across its platform” (enforcement release).

The expectations, in practice

Use what you already hold. In BitPay, OFAC counted IP addresses the company had collected as location information it should have screened.
Check at the transaction. Onboarding alone is not enough. See in-process geolocation.
Block, as well as record. The Kraken release faulted the absence of IP address blocking on transactions.
Expect evasion. IP blocking is the minimum the releases name, and a VPN gets around it. See VPN, proxy and residential IP.

Where a signed check fits

For app-based services, a device-measured, signed isOutside check against the sanctioned set, run at each transaction, gives a record an examiner can verify independently. For web sessions, Octet Browser gives a country-level verdict with no install, from browser and network signals. It is not hardware-attested.

Nothing here is legal advice. Read the releases themselves and take counsel on your programme.

What this does not establish

A verdict answers for a device, not a person. It says an enrolled device was inside or outside a region at a time. It does not say who was holding it. Use it alongside identity verification, never instead of it. It does raise the cost of cheating: instead of a VPN subscription, a cheater needs real devices and a person in the permitted place for every transaction.