Every venue that keeps traders out of a state or a country describes the measure the same way, as a technical control. A system reads the device, compares it with a boundary and refuses the order. That description holds right up to the moment the check fails, because what happens next is almost never technical. A message appears, and at the end of the message a person is waiting in a chat window.
As of 19 October 2026 that person is the least documented part of the control. Exchange rulebooks do not describe the role, the state standards that prescribe geofencing in detail do not say what the role may answer, and logging standards that capture an engineer's keystroke to the second do not keep the reply. There is exactly one case in which a regulator wrote down how a geographic block failed in practice, and it is not about software.
The only documented failure of this kind happened in a chat window
On 15 October 2021 the Commodity Futures Trading Commission entered an order against iFinex Inc., BFXNA Inc. and BFXWW Inc., CFTC Docket No. 22-05, the three companies trading as Bitfinex. The order covers conduct from at least 1 March 2016 through at least 31 December 2018, finds violations of Sections 4(a) and 4d(a)(1) of the Commodity Exchange Act, 7 U.S.C. 6(a) and 7 U.S.C. 6d(a)(1), and imposes a civil monetary penalty of 1.5 million dollars. The Commission announced it the same day in press release 8450-21.
What makes the order useful to anyone building an access control has nothing to do with digital assets at all. It records that the firm represented it had performed its own checks of internet protocol address and location for all accounts, including basic accounts, throughout the period and whenever a customer accessed an account. On the technical layer, the firm's own account of itself was that the control existed and ran continuously.
The same section then describes what the firm's customer service representatives did. They dealt with customers based in the United States about account matters, including address changes that, in the order's words, "clearly identified the customers' geographic location", and on various occasions they encouraged those customers to use a virtual private network to mask the address the control was reading. The order dates one example to on or around 3 April 2018, when a representative told a United States based customer that the platform is "not against VPNs . . . by any means", and added that most users trading or providing margin funding would not need to supply verification documents.
Read the two together and the shape of the failure is clear. The control was represented as present, continuous and applied to every account, and the thing that defeated it was a sentence typed by an employee who was, at that moment, the only human being inside it. The desk was also where location evidence arrived unprompted, as address changes, which made it the firm's best detection surface and its weakest one at once.
The undertakings reach the staff only where reputation is at stake
Part V of the same order contains the undertakings the respondents accepted. One of them, headed Prevention of Unlawful Trading, requires them to implement and maintain "systems and procedures reasonably designed to prevent U.S. persons" from entering the transactions at issue, to have those in place on or before 31 December 2021, and to close the open leveraged positions of identified United States persons. It is the operative access-control obligation in the document and it stops at systems and procedures.
The undertaking immediately before it, headed Public Statements, is drafted differently. It obliges the respondents to take "all steps necessary to ensure that all of their agents and/or employees under their authority or control understand and comply", and what they must understand is the promise not to publicly deny the order's findings. So in the one enforcement document that describes a geographic control defeated by a member of staff, the only undertaking that expressly requires the firm to make its staff understand a rule is the one that protects the Commission from being contradicted in public.
The Commission is not the villain here. This is a fair snapshot of where the category's written standards still sit five years later.
Part 38 uses the word training twice and both times about code
The rulebook for a designated contract market is 17 CFR part 38. A machine search of its full text as published in the eCFR on 1 October 2026, appendices A, B and C included, comes to roughly 28,500 words. In all of it the word training appears twice, and both occurrences sit inside Section 38.1051 on system safeguards: once as "security awareness training" in the information security category, once as "training in secure coding practices" under systems development. The phrase customer service appears not once.
The word employee does appear, 27 times: staff who may run penetration tests because they did not build the system, the independence of directors, who may sit on a disciplinary panel, prohibitions on employees trading the contracts, and the Commission's own staff. Not one of the 27 is the person who answers a customer whose order was just refused.
The rule that does name employees belongs to the broker
There is a Commission rule written for exactly this problem, in a different part of the code. Section 166.3 of the Commission's regulations, one sentence long and in force since 1983, requires each Commission registrant, apart from an associated person with no supervisory duties, to "diligently supervise the handling" by its partners, officers, employees and agents of the accounts it carries, operates, advises or introduces, and of all other activities relating to its business as a registrant.
That is the obligation the desk needs, and the reason it does not close the gap is structural. Section 166.3 is addressed to registrants, while an exchange designated under the Act is a registered entity and the firm carrying the customer account may be another company altogether. On a prediction-market trade routed through an intermediary, the supervision duty attaches to the intermediary's staff, while the venue that published the geographic boundary and promised to enforce it is governed by part 38, where the desk is not mentioned. The location record held at that intermediary layer is the subject of our article on the question Michigan asked that an exchange cannot answer alone.
Michigan once scripted the sentence that sends a blocked user to the desk
The most detailed geolocation rules in the United States were written for internet gaming, not for prediction markets, and they are worth reading because the people who drafted them had already met this failure. In Technical Bulletin No. 2020-01, issued on 6 August 2020, the Michigan Gaming Control Board went further than any document discussed above. It set out the wording. The bulletin requires the system to detect and block locational data fraud including proxy servers, fake location applications, virtual machines and remote desktop programs, and then lists thirteen approved messages for the platform to send when a location check fails, covering an insufficient result, detected location fraud, an IP anonymiser, a detected proxy, remote desktop software, device tampering and a border area.
Two of the thirteen hand the user to a person. One is the plain technical failure. The other is the case that matters here, where software is found on the device that might bypass the geolocation check, and the approved text asks the user to "contact our customer service department so we can assist you in resolving this problem". A regulator had mapped the whole control, including the moment a suspected circumvention tool is detected, and routed that moment to a human being whose answer it left unwritten.
The current Michigan standard keeps the scenario and drops the wording
That 2020 bulletin was marked as issued for discussion pending final rules, and it has been superseded. The operative document is Technical Bulletin No. 2024-03 on geofencing specifications, revised 28 February 2024, which keeps the detection and blocking requirements almost unchanged and replaces the scripted messages with a list of twelve scenarios a message must address. Scenario (c) is software on the device "which could be used to circumvent geolocation", and scenarios (g), (h) and (k) are an IP anonymiser, a detected proxy and remote desktop software.
The approved texts are gone, and with them the one line in any of the standards reviewed here that put the support desk inside a location control. The phrase customer service does not occur anywhere in the 2024 bulletin. Nor does any person appear in the underlying rule: the four subsections of Mich. Admin. Code R. 432.631 require transactions to come from inside the state, a geofencing system to detect location and block outside attempts, dynamic monitoring throughout a session, and Board approval of the specifications.
Leaving the wording to operators is a defensible choice and the Board kept every detection duty. The point is narrower, and it is ours to fix rather than the Board's: the handoff survived and the script for the person receiving it did not.
Seven logs record the engineer and none record the conversation
Michigan also prescribes what is kept. Technical Bulletin No. 2023-03 on data logging standards, revised 6 December 2023, names seven logs: account creation, wagering and account activity, software installation and removal, game availability, promotions, authentication and adjustments. The activity log must hold everything needed to recreate a participant's session "including any identity or location verifications" for no less than five years.
Three of the seven go further and demand a name. For software installed or removed, for a change in game availability and for any adjustment made to platform data, the log must contain the date and time to the second and "the full identity and user ID of the person performing the action". All three are engineering actions. The words support, chat and customer service appear nowhere in the bulletin, so a regime that can tell a regulator which named individual changed a configuration at 14:22:08 cannot say who told a blocked trader what to do next.
Nevada names training once, and not where the location check lives
Nevada shows the drafting pattern exists and where the industry spent it. Regulation 5A of the Nevada Gaming Commission on the operation of interactive gaming, in the revision of May 2024, runs to roughly 5,400 words. Section 5A.070 requires ten areas of internal control, among them identification and verification of players to keep out those who are not authorised, with procedures that must "incorporate robust and redundant identification methods". Section 5A.120(1) requires the operator to record the player's physical location, by state or foreign jurisdiction, while logged in.
In the whole of Regulation 5A the string train occurs once, in section 5A.130(1)(c), where the required self-exclusion policy must include "Employee training to ensure enforcement of these policies and procedures". The words customer service, customer support and chat occur not at all. Gambling regulation learned long ago that an exclusion promise is only as good as the member of staff who can be talked into an exception, which is why Directive 03 of our manifest insists that deposit limits, cool-off periods and self-exclusion be "product features, built into the account, not concessions granted by support staff on request". A geographic boundary is the same kind of promise, and nobody has written that sentence about it.
What a support procedure would have to contain to be worth citing
None of this needs new technology, and a venue that has already bought a geolocation vendor has done the expensive part. What follows is what we would put in writing this month. All five items are auditable from outside the company.
- One approved refusal and no approved workaround. The macro library holds a single answer to a question about virtual private networks, and no macro names a circumvention tool as a way to keep trading. That audit is a search box and ten minutes, and it answers the sentence quoted from 3 April 2018.
- The reply is a logged event, with the fields Michigan already demands of an engineer. Date and time to the second, the full identity and user ID of the agent who answered, and a description of what was said about location. If a configuration change earns that record, so does the sentence that decides whether a blocked customer trades tomorrow.
- A location ticket is a detection input, not a service record. The order shows the desk receiving address changes that identified where the customer was. Any ticket revealing a customer outside the permitted boundary belongs in the same queue as an automated geolocation flag, on the same clock and with the same escalation.
- An outsourced desk carries the procedure and the record. Part 38 already contains the right construction for this. Under Section 38.154 a market that uses a third party for regulatory services "will at all times remain responsible" for that performance, owes a duty to supervise it, and must conduct periodic reviews "documented carefully" and available to the Commission. A contracted support desk sits at least as close to the rulebook as a surveillance vendor.
- A published failure rate. For a stated period: how many tickets touched a location block, how many closed with the approved refusal, how many were escalated, how many ended in an account action. Dated figures, in the same place as fees and settlement sources, which is where Directive 02 says the facts about a venue belong.
The fifth item will be resisted and is worth the most. A venue that publishes the number tells a regulator it already knows where this control leaks, which is a stronger position than a representation that the control exists.
A control is only as narrow as the last person who answered
The pattern keeps repeating in these pages. A block answers who may place the next order and says nothing about positions already open, which is the gap the Michigan series exposed in July 2026. Naming a vendor in a court order does not transfer the diligence the venue owes, the subject of our piece on what a geolocation affidavit would have to show a judge. And a control described as technical turns out to have a human exception path nobody wrote down.
No regulator has asked this category for a support-desk standard. That is the argument for writing one rather than waiting, because Directive 05 of our manifest sets standards against the jurisdiction that regulates next rather than the one that has not yet arrived, and that jurisdiction will have read the 2021 order too. The line quoted in it is one message in a support window, and it will outlive every geofence specification written since, because this was never a software problem. Somebody asked a question and somebody answered it.