Restricted Markets & GEO-blocking: Navigating iGaming Jurisdiction Restrictions

Why Jurisdiction Restrictions Matter for Affiliates

Promoting casino brands to the wrong jurisdiction isn't just a compliance misstep—it's a legal landmine. iGaming is heavily regulated by country, state, and sometimes province, with strict rules about who can promote gambling, where, and to whom.

For affiliates, the risks include:

• Legal penalties: Fines, cease-and-desist orders, or criminal charges in some jurisdictions
• Operator consequences: Commission clawbacks, account termination, or being blacklisted from affiliate programs
• License violations: Operators can lose licenses if affiliates breach geographic restrictions
• Payment processor bans: Visa, Mastercard, and banks may freeze accounts tied to illegal gambling promotion

This guide covers which markets are restricted, how to implement geo-blocking, and what happens if you get it wrong.

Global Restricted Markets Overview

Complete Bans: Countries Where Online Gambling Is Illegal

In these countries, promoting or operating online gambling is prohibited. Affiliates must block traffic entirely:

• United Arab Emirates (UAE): All forms of gambling banned; VPN use common but illegal
• Qatar: Strict Islamic law prohibits gambling
• North Korea: Total ban; practically no affiliate market anyway
• Brunei: Sharia law prohibits gambling
• Cambodia: Online gambling illegal for locals; land-based casinos exist for tourists
• Singapore: Only government-operated lotteries and two land-based casinos allowed; online gambling illegal

Affiliates promoting international brands must geo-block these countries to avoid operator penalties.

Sanctioned Countries: US OFAC Restrictions

U.S. Office of Foreign Assets Control (OFAC) sanctions prohibit U.S.-based affiliates and operators from transacting with individuals or entities in:

• Iran, North Korea, Syria, Cuba, Crimea (Ukraine): Comprehensive sanctions
• Venezuela, Belarus: Targeted sanctions (varies by entity)
• Russia: Expanding sanctions since 2022; iGaming transactions increasingly restricted

Even if you're not U.S.-based, operators licensed in the U.S. or using U.S. payment processors must comply. Promoting to these countries can trigger anti-money laundering (AML) flags and payment processor bans.

Partially Restricted Markets: Licensed-Only Promotion

These countries allow online gambling but only through locally licensed operators. Promoting unlicensed brands is illegal:

• United Kingdom: Must promote only UKGC-licensed operators; affiliates may need to register
• Sweden: Spelinspektionen-licensed operators only; unlicensed promotion illegal since 2019
• Germany: Glücksspielbehörde (GGL) license required; interstate treaty (GlüStV 2021) limits promotions
• Netherlands: KSA-licensed operators only since October 2021; heavy fines for promoting unlicensed brands
• Italy: ADM (Agenzia delle Dogane e dei Monopoli) license required
• France: ANJ-licensed operators for sports betting and poker; online casino slots remain monopoly-only
• Spain: DGOJ-licensed operators only; strict advertising rules
• Denmark: Spillemyndigheden-licensed operators
• Portugal: SRIJ-licensed operators; unlicensed promotion illegal

If you promote unlicensed brands in these markets, you're violating local law—even if the operator accepts players from there.

U.S. State-by-State Restrictions

The U.S. is a patchwork of legal, gray, and illegal markets. Online gambling regulation varies wildly by state.

States Where Online Casino/Poker Is Legal (Licensed Markets)

As of 2024-2025, only these states allow legal online casino gaming (iGaming):

• New Jersey: Fully legal since 2013; must promote NJ-licensed operators only
• Pennsylvania: Legal since 2019; PA Gaming Control Board licenses required
• Michigan: Legal since 2021; MGCB-licensed operators
• West Virginia: Legal since 2019; WV Lottery-licensed operators
• Delaware: Legal since 2013; state-run lottery operators
• Connecticut: Legal since 2021; tribal and state partnerships only
• Rhode Island: Legal since 2024; state lottery operators

Affiliates promoting in these states must link only to state-licensed brands. Promoting offshore operators (e.g., Bovada, BetOnline) to players in legal states risks operator penalties and potential legal action.

States Where Online Gambling Is Explicitly Illegal

These states prohibit online gambling, and promoting it may violate state law:

• Washington State: Online gambling is a Class C felony; has issued cease-and-desist letters to offshore operators (Bovada, twice in 2024-2025)
• Utah: All gambling illegal; constitution prohibits it
• Hawaii: All gambling illegal; no land-based or online options

Major affiliates geo-block these states entirely to avoid legal exposure.

Gray Market States (No Regulation, Not Explicitly Illegal)

Most U.S. states fall into a gray area: no legal framework for online gambling, but no specific ban on accessing offshore sites. Examples: California, Texas, Florida, New York (online casino; sports betting is legal in NY).

Affiliates promoting offshore operators (Bovada, Ignition, Cafe Casino) to these states operate in a legal gray zone. Risks:

• Enforcement: States like Nevada, Arizona, Illinois, Maryland, New Jersey, Ohio have sent cease-and-desist letters to offshore operators
• Payment issues: Banks and payment processors may freeze funds tied to unlicensed gambling
• Operator liability: If an operator loses its license or gets blacklisted, your commissions may be clawed back

Best practice: If promoting offshore brands, clearly disclose legal status and consider geo-blocking states with active enforcement.

License-Specific Restrictions

Curacao, Malta, and Offshore Licenses

Operators with Curacao, Malta (MGA), or Gibraltar licenses often restrict affiliates from promoting to:

• Their own jurisdiction: Curacao-licensed operators may block Curacao traffic; MGA blocks Malta
• UKGC markets: MGA licenses don't cover the UK; separate UKGC license required
• U.S. markets: Most offshore licenses prohibit U.S. promotion (violates operator terms, even if technically accessible)
• Sanctioned countries: OFAC compliance required

Check your affiliate agreement's "Restricted Territories" clause. Promoting to blacklisted countries voids commissions and may trigger account suspension.

UKGC Affiliates: Registration Requirements

The UK Gambling Commission (UKGC) doesn't require affiliate licenses, but high-volume affiliates may need to register if they:

• Operate marketing services for multiple operators
• Have significant control over promotional content
• Handle player funds (rare for traditional affiliates)

All affiliates promoting to UK players must follow UKGC advertising codes, including responsible gambling messaging and no appeal to minors.

GEO-blocking: Technical Implementation

Why GEO-blocking Is Required

GEO-blocking prevents users from restricted jurisdictions from accessing your affiliate site or clicking affiliate links. It's a legal safeguard and often a requirement in affiliate agreements.

Methods for GEO-blocking

1. IP Address Detection

Use GeoIP databases (MaxMind, IP2Location) to detect user location and block restricted countries. Implementation:

• Server-side redirect: If user IP is from restricted country, show "This service is not available in your region" page
• Remove affiliate links: Replace "Join Now" buttons with disabled text or redirect to operator's geo-block page
• Hide content: Don't show bonus offers or casino reviews for blocked regions

Pros: Fast, effective for most users
Cons: VPNs bypass IP-based blocking

2. HTML5 Geolocation API

Request user's GPS location via browser. More accurate than IP, but requires user consent (GDPR compliant).

Pros: Accurate, consent-based
Cons: Users can decline; only works on mobile/GPS-enabled devices

3. Operator-Side GEO-blocking

Link to operators that enforce their own geo-restrictions. When a restricted user clicks your affiliate link, the operator blocks registration.

Pros: Transfers liability to operator
Cons: Users may blame you for a broken link; still risks affiliate agreement violations if your site targets restricted regions

GEO-blocking Best Practices

• ☐ Whitelist, don't blacklist: Instead of blocking specific countries, only allow traffic from approved jurisdictions
• ☐ Update GeoIP databases regularly: IP ranges change; outdated databases cause false positives/negatives
• ☐ Test with VPNs: Ensure your geo-blocking works when users mask their location
• ☐ Provide clear messaging: "This offer is not available in your region due to local regulations" is better than a generic error
• ☐ Log blocked access attempts: Track which countries are trying to access your site; helps audit compliance

VPN Detection: Preventing Proxy Bypass

Why VPNs Are a Problem

Users in restricted markets (e.g., UAE, Washington State) use VPNs to mask their location and access gambling sites. If your geo-blocking relies solely on IP addresses, VPNs bypass it.

Operators may hold you liable if a VPN user from a blacklisted region signs up via your link—even if your geo-blocking was in place.

VPN Detection Methods

1. Third-Party VPN Detection Services

Tools like IPQualityScore, IPQS, or Spur detect VPNs, proxies, and data center IPs. They flag suspicious traffic in real-time.

Implementation: Query the API with each visitor's IP; if flagged as VPN/proxy, block or warn the user.

2. Behavioral Analysis

Look for patterns: rapid IP changes, data center ranges, mismatched timezone/IP location. Advanced but requires analytics infrastructure.

3. Operator Verification

Rely on operators' KYC (Know Your Customer) checks during account creation. Operators verify user location via ID documents, payment methods, and IP consistency. If they detect VPN use, they block the account—and you're not liable.

Should You Implement VPN Blocking?

For high-risk markets (UAE, Washington State, sanctioned countries), yes. For gray markets or licensed regions, it's overkill—most reputable operators handle VPN detection themselves.

If your affiliate agreement requires "reasonable efforts" to prevent restricted traffic, IP-based geo-blocking + VPN detection services satisfy that standard.

Penalties for Violating Jurisdiction Restrictions

Affiliate-Side Consequences

• Commission clawbacks: Operator retracts earnings from restricted players
• Account termination: Immediate ban from affiliate program
• Blacklisting: Other operators may refuse to work with you if you have a history of violations
• Legal action: Cease-and-desist letters or fines (rare but possible in aggressive jurisdictions like Sweden, Netherlands)

Operator-Side Consequences (Affects You Indirectly)

• License suspension: UKGC, MGA, or state regulators may suspend or revoke licenses
• Fines: Netherlands KSA fined unlicensed operators €10M+ for accepting Dutch players
• Domain seizures: Governments block domains (e.g., Italy's ADM blacklist)

If an operator loses its license, your commissions stop—and you may lose months of unpaid earnings.

Real-World Enforcement Examples

Nevada & Multi-State Enforcement (2024-2025): Nevada, Arizona, Illinois, Maryland, New Jersey, Ohio sent cease-and-desist letters to Bovada. Washington State issued a second letter in September 2025 after Bovada ignored the first.

Netherlands KSA (2021-2024): Fined unlicensed operators over €10M for accepting Dutch players post-regulation. Affiliates promoting those brands faced account shutdowns.

Sweden (2019-present): Spelinspektionen fined operators and blocked domains for unlicensed activity. Affiliates promoting unlicensed brands to Swedish users were flagged, and some faced legal warnings.

Actionable Jurisdiction Compliance Checklist

• ☐ Review affiliate agreements: Check "Restricted Territories" clauses for every operator you promote
• ☐ Implement IP-based geo-blocking: Block traffic from complete ban countries (UAE, Qatar, North Korea, etc.)
• ☐ Verify operator licenses: Only promote UKGC-licensed brands to UK traffic, MGA to EU (non-UK), state licenses to U.S. legal states
• ☐ Avoid sanctioned countries: Geo-block OFAC-sanctioned nations (Iran, North Korea, Syria, Cuba, Crimea)
• ☐ Add VPN detection: For high-risk markets (Washington State, UAE), use VPN detection services or rely on operator KYC
• ☐ Monitor enforcement trends: Follow news on cease-and-desist letters, license suspensions, or new regulations in your target markets
• ☐ Update geo-blocking quarterly: Laws change (e.g., new U.S. states legalizing iGaming); refresh your restricted territories list
• ☐ Disclose legal status: If promoting offshore brands to gray markets, add disclaimers: "Online gambling may not be legal in your jurisdiction. Check local laws."
• ☐ Log compliance efforts: Keep records of geo-blocking implementation, VPN detection, and restricted territory lists (useful if operators question you)

Best Practices for Multi-Jurisdiction Affiliates

1. Segment traffic by region. Use subdomains or separate sites for different markets (e.g., yoursite.co.uk for UK, yoursite.com for international). Makes compliance easier and improves SEO.

2. Partner with compliant operators. Operators with robust geo-blocking and KYC processes protect you from liability. Avoid shady offshore brands with no license verification.

3. Stay current on regulations. Subscribe to iGaming law newsletters (Yogonet, GamblingCompliance) or follow regulator press releases. New states legalize or ban online gambling regularly.

4. Use affiliate network tools. Networks like Income Access, CJ, Awin often provide geo-blocking settings in their dashboards. Enable them for restricted countries.

5. Don't rely on "plausible deniability." "I didn't know it was illegal" won't save you from commission clawbacks or account bans. Do your homework on every market you target.

Key Takeaways

• Promoting to restricted markets triggers commission clawbacks, account bans, and potential legal penalties
• Complete ban countries (UAE, Qatar, Singapore) require full geo-blocking; sanctioned nations (Iran, North Korea) violate OFAC rules
• Licensed-only markets (UK, Sweden, Netherlands) prohibit promoting unlicensed brands—verify operator licenses before linking
• U.S. is fragmented: only 7 states allow legal online casinos; Washington, Utah, Hawaii explicitly ban online gambling
• Geo-blocking via IP detection is minimum standard; VPN detection adds extra protection for high-risk markets
• Affiliate agreements specify restricted territories—read them; violations void commissions

Jurisdiction compliance isn't just about avoiding penalties—it's about building sustainable, long-term affiliate businesses. Regulators are tightening enforcement, and operators are cutting ties with non-compliant affiliates. Stay ahead by geo-blocking proactively and promoting only where it's legal.