Polymarket’s Probe Highlights Challenges of Blocking U.S. Users (and Their VPNs)

As a seasoned compliance professional with over two decades of experience in the financial industry, I can confidently say that geofencing and KYC (Know Your Customer) are crucial components in maintaining regulatory compliance, especially when operating in the digital assets space.

Polymarket’s ongoing situation underscores persistent, nagging compliance issues that have long been a concern within the cryptocurrency sector. You could think of these as recurring, lingering concerns.

The core issue lies in finding solutions for both blockchain systems and centralized cryptocurrency companies on how to tackle the common practice among users who resort to using Virtual Private Networks (VPNs) to bypass geographical limitations set by governments.

On Wednesday, the residence of Shayne Coplan, founder and CEO of Polymarket, was raided by federal authorities in New York. The reasons behind this raid are still unclear, and neither Coplan nor his company have been accused of any wrongdoing at this time. However, according to Bloomberg and The New York Times, the Department of Justice is investigating if Polymarket allowed U.S. residents to trade on its platform, potentially violating a 2022 regulatory settlement.

2020 saw the establishment of Polymarket, a standout achievement in the crypto sphere this year. It has recorded massive trading volumes amounting to billions and open interest (contracts yet to be fulfilled) in the hundreds of millions. Wagers on this platform are finalized using USDC, a stable digital currency that maintains a dollar-to-dollar exchange rate.

Participants engage in prediction markets to wager on the results of various real-life occurrences, ranging from predicting who will emerge victorious between Jake Paul and Mike Tyson in a boxing match to speculating who might take on the role of James Bond next.

By far, the topic drawing the most attention has been the U.S. presidential election. Market odds before the vote indicated that Donald J. Trump had an advantage, while polls suggested a close race. As the election approached, news outlets raised concerns that the market was being manipulated to favor Trump, which might have been an attempt to sway the results somehow. However, prediction market experts found these claims lacking in substantial evidence.

A representative from Polymarket stated this week’s raid was likely politically motivated retaliation by the departing Biden administration for accurately predicting Trump’s victory, a viewpoint that has been shared extensively on social media. If this perspective is accurate, the investigation might not last long considering a president-elect who is friendly towards crypto will be inaugurated in January.

Regardless, this scenario raises deeper issues that might require consideration if the upcoming administration and Congress aim to create a more welcoming atmosphere for digital assets.

Under an agreement reached in 2022, Polymarket is prohibited from providing services to American residents as per the stipulations set by the Commodity Futures Trading Commission. Consequently, they have been preventing users with United States IP addresses from participating in trades.

However, resourceful U.S. investors have been employing Virtual Private Networks (VPNs) to conceal their geographical positions for the purpose of wagering on the platform. (It has been confirmed by CoinDesk that at least two instances of this practice exist).

Instead of traditional financial intermediaries who gather users’ personal details, Polymarket operates differently as it does not require such information. Apart from an IP address, it lacks the means to pinpoint the geographical location of most of its traders who typically transact under pseudonyms.

The challenge lies not only with Polymarket, but also with numerous cryptocurrency ventures aiming to steer clear of U.S. legal oversight. This includes projects distributing tokens through a process known as “airdropping.

How might companies, who have established geofencing within the United States, effectively restrict American users from accessing their services via Virtual Private Networks (VPNs)? Additionally, what are the expectations of the government regarding actions that these businesses should take in this situation?

Practical questions

As suggested by privacy and cybersecurity expert Runa Sandvik, one of the primary measures a company can take to limit access to its services in specific, regulated regions is requiring those users to undergo a Know-Your-Customer (KYC) verification process.

“They’d need KYC,” she told CoinDesk. “It’s too easy to get around simple IP address blocks.”

Absolutely, users may find that Know Your Customer (KYC) procedures come with disadvantages, as they often require the disclosure of private and sensitive data, even for honest individuals.

According to Sandvik, the sign-up procedure becomes a bit more complex due to the requirement of verifying your identity and ensuring that the site can be trusted with your personal data for security purposes.

Aaron Brogan, who specializes in law within the crypto industry, proposes that theoretically, a company could reinforce IP address blocks by integrating GPS data from users’ mobile devices as an additional layer of security. However, he suggests that this approach might not be feasible for commercial use due to practical limitations. For instance, a user working on a laptop without GPS capabilities may find it difficult to log in without the extra step of two-factor authentication.

Additionally, measures to reduce risk could involve avoiding advertising within the United States, making sure to explicitly mention on all applicable products that they are unavailable for U.S. users, and other such precautions, as Brogan pointed out.

In simpler terms, Polymarket offers a mobile application for American users that shows the odds from their markets, but doesn’t allow direct trading. Although they have been actively promoting on social media, it’s important to note that these platforms are inherently global in nature.

One action companies might take is to “keep track of users who seem to be switching their IP addresses in a manner that suggests they are using a VPN in order to bypass geographical restrictions,” as stated by Jake Chervinsky and Daniel Barabander, the chief legal officer and deputy general counsel respectively for Variant Fund, in a blog post dated September 30.

“For instance, if a user from a company tries to access a region-restricted product using an IP address from the U.S. and then quickly switches to another non-U.S. IP address while connecting the same account or wallet, this could indicate an attempt by someone in the U.S. to bypass geographical restrictions. In such a case, an exchange might decide to restrict or block the user’s account or wallet.

In essence, Chervinsky and Barabander stated that it’s still unclear if companies should prevent access through all Virtual Private Networks (VPNs). Yet, they mentioned that regulators view the process of filtering IP addresses against known VPNs as a beneficial step for effective location-based restrictions, or geofencing.

Previously, when resolving charges for sanctions violations against CoinList Markets, the U.S. Treasury’s Office of Foreign Assets Control acknowledged that, as part of their corrective actions, this San Francisco-based cryptocurrency exchange had put resources into acquiring tools capable of identifying users who conceal their location by using Virtual Private Networks (VPNs).

Legal obligations

One way to rephrase this sentence in a more natural and easy-reading manner is: “David Ackerman, an experienced compliance executive and attorney, pointed out that one challenge for Polymarket could be its higher scrutiny due to prior settlements with the CFTC compared to companies without a history of U.S. regulatory issues.

In simpler terms, Ackerman told CoinDesk, “A company without past violations is judged differently. However, Polymarket did have past issues and even a settlement, so their expectations or requirements are set higher because of this history.

According to Ackerman, merely blocking IP addresses originating from the United States wouldn’t fully meet the requirements of the given order.

In simpler terms, he explained that while geo-fencing can be useful, it’s not straightforward. It requires Know Your Customer (KYC) verification, which means verifying the identity of every user. If the information provided during KYC doesn’t match the IP address in use, this discrepancy makes it simple to monitor and detect any potential issues.

Brogan suggests that geofencing should primarily be considered as a means of reducing risks rather than a legal strategy. It seems that the Commodity Exchange Act, which Polymarket is suspected of violating, may extend to any instance where an entity is indeed dealing with U.S. citizens.

As an analyst, I’d rephrase that statement as follows: In a 2018 speech, I, Brian Quintenz (in my role as a CFTC commissioner), advocated for a lenient approach when assessing if blockchain projects should be held accountable for the actions of their users.

Quintenz posed the question, “Could the creators of this code have anticipated, when writing it, that it might be employed by Americans in a way that breaches CFTC rules?

After that speech, Brogan commented, “Some professionals have felt that preventing U.S. individuals could potentially deter enforcement. However, this interpretation may not align with what the law actually states.

The 2022 directive issued by the CFTC towards Polymarket instructed them to shut down markets not adhering to their rules, but it didn’t clarify what those compliance requirements were. It’s unclear whether the CFTC privately communicated that geofencing would suffice for compliance, or if they’ve simply had a sort of peaceful standoff for two years.

Polymarket isn’t a U.S.-regulated organization, with its operating company, Adventure One QSS Inc., being based in Panama. However, this doesn’t automatically mean it’s exempt from complying with U.S. laws, as per Ackerman’s statement.

He pointed out that a widespread misunderstanding is that “you must physically reside within a country for its laws to affect you.” However, if your business impacts or operates within their jurisdiction, you’re typically subject to their legal regulations.