Access controls

Crypto geofencing API

Geolocate the calling client — or any IP address — and get back city, region, country, and whether that country is under OFAC sanctions programs. Your application applies the policy.

GET /api/v1/geo/{ip}

# Omit the IP to geolocate the calling client
curl https://api.compliapi.com/api/v1/geo/91.218.114.206 \
  -H "Authorization: Bearer $COMPLIAPI_TOKEN"

Response

{
  "ip": "91.218.114.206",
  "city": "Moscow",
  "region": "Moscow",
  "country": "RU",
  "sanctioned": true,
  "source_url": "..."
}

Sanctioned-country flag built in

Geolocation results are checked against CompliAPI's curated list of OFAC country sanction designations — comprehensive, targeted and military.

City and region granularity

Responses include city and region, supporting rules like different handling for New York State users.

Caller or arbitrary IP

Call the endpoint with no argument to evaluate the requesting client, or pass any IP address explicitly.

One structured response

A single JSON object your access-control logic can branch on — no separate geo provider and sanctions list to join.

Which countries does OFAC sanction?

There is no single official OFAC country list — OFAC runs comprehensive embargoes against a handful of countries and regions (Cuba, Iran, North Korea, and the Crimea, Donetsk and Luhansk regions of Ukraine) plus dozens of selective programs that target sectors or officials without embargoing the country. The geofencing endpoint's sanctioned-country flag is driven by CompliAPI's curated designations across those programs, each match carrying the official program URL.

Jurisdiction rules without stitching providers together

Geofencing a crypto app usually means integrating a geolocation provider, separately working out which countries and regions your policy restricts, mapping OFAC sanctions programs to country codes yourself, and keeping that mapping current.

CompliAPI combines the lookup and the sanctions context in one request. You get the location and a sanctioned flag together — at signup, on wallet connect, or per session — and your application decides what to do with it: block, restrict features, or log.

CompliAPI returns location signals and sanctions context; it does not decide or enforce your access policy, and no IP-based location signal should be treated as infallible.

How it works

  1. Send a request

    Call /geo to evaluate the calling client's IP, or /geo/{ip} for any address your systems have observed.

  2. CompliAPI geolocates and checks sanctions designations

    The IP is geolocated to city, region and country, and the country is checked against curated OFAC sanction designations.

  3. Apply your policy

    Your application branches on the structured result — block, geo-restrict features, require review, or proceed.

What you can screen

  • The calling client's IP (no argument needed)
  • Any public IPv4 or IPv6 address

Where teams use it

Restricted-jurisdiction gating

Check the requesting client before a DeFi frontend lets a wallet interact with your contracts.

US state-level rules

Use the region field to apply different handling for users in New York State or other jurisdictions your policy treats separately.

Signup screening

Flag registrations from comprehensively sanctioned countries for blocking or review.

Feature availability

Serve different product experiences by country where regulatory treatment differs.

Pairing with VPN detection

Combine with the VPN endpoint to judge how much weight to give a location signal.

Scope and limitations

Geofencing signals support access-control decisions; they don't make them. Keep these boundaries in mind:

IP geolocation is probabilistic

Location derived from an IP address is an estimate. It is useful evidence, not proof of where a user is.

Users can obscure location

VPNs and proxies can shift apparent location. Pair geofencing with VPN detection when that matters to your policy.

You own the policy

CompliAPI reports where a request appears to come from and whether that country carries OFAC designations. Which jurisdictions you restrict, and how, is your organization's decision.

Curated country designations

OFAC does not publish a single official list of sanctioned countries. CompliAPI curates designations across comprehensive, targeted and military programs, with a source link for each.

Frequently asked questions

Can geofencing detect VPN usage?

VPN detection is a separate endpoint (GET /api/v1/vpn) that reports whether an IP appears to be a VPN. Many teams call both: geolocation for the jurisdiction decision, VPN detection to judge how reliable the location signal is.

Which countries are flagged as sanctioned?

Countries and regions under OFAC sanctions programs, curated by CompliAPI across comprehensive, targeted and military designations. Each flag includes a source_url so you can review the underlying program.

Can I apply state-level rules like New York?

Yes — responses include city and region alongside country, so your application can implement rules such as special handling for New York State users.

Do I have to pass an IP address?

No. Calling GET /api/v1/geo with no argument evaluates the calling client's public IP. You can also pass any public IP explicitly, for example from your own request logs.

Is IP-based geofencing enough on its own?

It depends on your obligations and risk appetite. IP signals are a widely used control but can be evaded; organizations should decide, with qualified counsel where appropriate, what combination of controls their policy requires.

Related

Add geofencing to your application

Get a free API key and make your first request in minutes.

14-day free trial. No credit card required.

CompliAPI provides data and tools that support compliance workflows. It does not provide legal advice, and organizations should determine their obligations with qualified counsel.