IP Geofencing API for Sanctioned Countries

What the geofencing API response returns

One GET returns a single JSON object your access-control logic can branch on. Location fields are derived from IP data and are estimates; the sanctioned flag is a lookup against CompliAPI's curated OFAC country designations.

Sanctioned-country flag built in: what sanctioned: true means

OFAC does not publish a single official list of sanctioned countries — it administers programs. The flag is CompliAPI's curated mapping of those programs to countries and regions, in three categories: comprehensive embargoes (Cuba, Iran, North Korea, and the Crimea, Donetsk and Luhansk regions of Ukraine, with Russia treated as comprehensive in practice), targeted country programs that restrict named sectors or officials without embargoing the country, and arms-embargo jurisdictions. Every flagged response carries the official program URL so a reviewer can read the designation behind it.

The mapping is maintained by hand against ofac.treasury.gov, re-synced to the API daily, and published in full — with its verification date — on the sanctioned countries reference page. Two limits to design around: an IP in a flagged country says nothing about whether a specific person or company is designated (that is what SDN screening is for), and a user behind a VPN can present an IP from a permitted country, which is why the flag pairs with VPN detection.

Where jurisdiction geofencing is applied

Exchanges and brokerages apply it at signup and per session, so accounts are not opened or traded from embargoed jurisdictions. DeFi front-ends check the requesting client before a wallet is allowed to interact with contracts. Stablecoin issuers and payment processors check on payment initiation and partner onboarding. And US products with state-level obligations use the region field to treat New York (and other states their policy names) differently from the rest of the country.

In each case the API supplies the location and the sanctions context; which jurisdictions to restrict, and whether to block, limit features or route to review, remains the operator's policy — the endpoint never enforces anything on its own.

Geofencing vs VPN detection: why you need both

IP geofencing answers "which jurisdiction does this request appear to come from?". It cannot answer "is that appearance trustworthy?" — a user in an embargoed country who connects through a VPN exit node in a permitted country passes every country rule silently. The VPN detection API answers the second question with a true / false / unknown signal for the same IP, so a jurisdiction decision can be weighted by how much the location result deserves to be trusted. Most teams call both: geolocation for the rule, VPN detection for the confidence.

Jurisdiction rules without stitching providers together

Geofencing a crypto app usually means integrating a geolocation provider, separately working out which countries and regions your policy restricts, mapping OFAC sanctions programs to country codes yourself, and keeping that mapping current.

CompliAPI combines the lookup and the sanctions context in one request. You get the location and a sanctioned flag together — at signup, on wallet connect, or per session — and your application decides what to do with it: block, restrict features, or log.

CompliAPI returns location signals and sanctions context; it does not decide or enforce your access policy, and no IP-based location signal should be treated as infallible.

What you can screen

• The calling client's IP (no argument needed)
• Any public IPv4 or IPv6 address