Geoblocking

Geoblocking lets you restrict access to yield functionality based on user location — at the country or region level — through a configuration-based system. Instead of maintaining your own country-by-country enforcement logic, you define your compliance posture once and the API enforces it on every transaction.

How It Works

Geoblocking is enforced at the action level, covering all enter, exit, and manage flows. If a user is in a blocked region, the API returns a 403 Forbidden error and no transaction is created.

Checks are performed at the project level, so each project can define its own compliance posture.

Configuration Options

Geoblocking settings are managed in the Yield.xyz Dashboard. As a project owner, you can:

• Enable Auto Compliance Mode to block all regions on global compliance risk lists (OFAC, OFSI, official crypto bans, staking bans, and more)
• Add your own country- or region-level restrictions
• Override specific locations to match your legal position or risk tolerance
  By default, only OFAC-level restrictions are applied unless you opt into broader enforcement.

Region Categories

Yield.xyz maintains an up-to-date global region list across the following categories:

Official Crypto Bans

Countries with explicit bans on cryptocurrency trading, staking, or DeFi use. Block these regions to align with local regulations.

OFAC Sanctions

Jurisdictions sanctioned by the U.S. Treasury's Office of Foreign Assets Control (OFAC). Enforcing OFAC restrictions keeps your product out of jurisdictions prohibited under U.S. policy.

OFSI Sanctions

Jurisdictions sanctioned under the U.K.'s Office of Financial Sanctions Implementation (OFSI) regime. OFSI-restricted countries can be blocked with a single toggle.

US State-Level Restrictions (Optional)

Certain US states restrict specific products — through active litigation, regulatory orders, or state-specific licensing requirements. You can restrict access from these states individually, following the approach adopted by major US platforms.

Error Response

Blocked requests return:

{
  "message": "Access denied from US (US-CA)",
  "error": "Forbidden",
  "statusCode": 403
}

The response is consistent across all endpoints and includes the detected region, so it can be handled programmatically or surfaced to the user.