Polymarket is being investigated by the Department of Justice for allowing US residents to trade on its platform. This occurs despite a regulatory agreement prohibiting such activities.

Although the prediction market blocks US IP addresses, legal experts note that this may not be enough just to comply with US regulations. This can be especially challenging for companies with a history of regulatory issues, such as Polymarket.

Beyond geoblocks, the only real way to prevent users in restricted countries from accessing a site is to request authentication. But this means that law-abiding users must safely entrust their personal data to platforms, cybersecurity experts note.

Polymarket’s current situation highlights the crypto industry’s long-standing compliance questions. This could be called “Extremely Persistent, Annoying Questions.”

At the heart of the matter is how blockchain protocols or centralized crypto firms can prevent users from bypassing geographic restrictions imposed by governments using virtual private networks (VPNs).

On Wednesday, federal law enforcement raided the New York home of Shayne Coplan, the 26-year-old founder and CEO of Polymarket.

While it’s not yet clear exactly why this crackdown took place, and neither Coplan nor the company has been charged, Bloomberg and The New York Times have reported that the Justice Department is investigating whether Polymarket allowed US residents to trade on its platform. This could constitute a breach of a regulatory agreement made in 2022.

Founded in 2020, Polymarket achieved great success in the crypto world this year, reaching billions of dollars in transaction volume and hundreds of millions of dollars in open positions. Bets on the platform are settled in USDC, a stablecoin, which is a cryptocurrency that trades one-to-one with the dollar.

Traders use Polymarket to bet on the outcomes of real-world events. For example, who will win the boxing match between Jake Paul and Mike Tyson or which actor will play the character of James Bond.

But the most popular topic was the US presidential election. Polymarket’s pre-election rates accurately signaled that Donald Trump was ahead despite the uncertainty the polls showed.

A spokesperson for Polymarket described this week’s raid as political revenge by the Biden administration for correctly predicting Trump’s victory. This comment received wide coverage on social media. If this view is correct, the investigation may be short-lived because a crypto-friendly president has been elected to take office in January.

Still, this raises broader questions that need to be addressed as the new administration and Congress seek to create a more conducive environment for digital assets.

Polymarket is barred from serving US residents under a 2022 agreement and is attempting to block users with US IP addresses from trading. However, American traders place bets on the platform by hiding their location using VPN. (CoinDesk has confirmed at least two such cases).

Unlike regulated financial intermediaries, Polymarket does not collect customers’ personal information. Other than the IP address, there is little way of knowing where its traders are located, who often operate pseudonymously.

Polymarket’s case highlights similar problems faced by many crypto companies trying to evade US jurisdiction. These companies face similar difficulties with projects that engage in activities such as “airdrop” tokens.

Even if a company blocks the US with geoblocking, what can they do to prevent users from accessing their service using a VPN? And what does the government expect from companies?

According to privacy and cybersecurity researcher Runa Sandvik, the most important thing a company can do to prevent users in restricted regions from accessing services is to put them through an identity verification (KYC) process.

“Simple IP address blocks are very easy to bypass,” says Sandvik. “They will need KYC,” he adds.

Of course, KYC has some disadvantages for users. Users who act in accordance with the law are forced to share their personal information.

“This puts more hurdles in the sign-up process because you have to verify your identity, and you also have to trust the site to keep your data safe,” Sandvik says.

Crypto industry lawyer Aaron Brogan notes that, in theory, a company could strengthen IP address blocking by capturing GPS data from its users’ mobile devices, but this may not be practical in commercial use.