IP Geo API

IP Geolocation for Fintech — KYC, Sanctions, and Payment-Fraud Signals

Why fintech is its own axis: payments, lending, neobanks, crypto-on-ramps, BNPL, and embedded finance all share the same regulatory floor (KYC + sanctions + AML) and the same fraud-economics (chargeback liability sits with the merchant or PSP). The IP-layer signal isn’t optional — it’s the cheapest first check before you commit to a card-network call or a 3DS challenge.

The country an IP resolves to, the ASN it belongs to, and whether it’s a known VPN, proxy, or Tor exit node are inputs to three separate fintech control surfaces:

  1. KYC / onboarding — country-of-origin must match the customer’s claimed jurisdiction, or the application gets routed to enhanced due diligence (EDD).
  2. Sanctions / OFAC / EU-restrictive-measures screening — IP-country is one of the indicators that triggers a sanctions hold (alongside name, DOB, address).
  3. Payment fraud — at authorisation time, IP-country mismatch with billing-country, hosting-provider ASN (DigitalOcean, AWS), and VPN/Tor flags compound into a per-transaction risk score.

A single REST call to IP Geo API returns all three signal classes — country, ASN, threat-flags, risk-score — on every plan, no add-on SKU.

What fintech buyers care about (in order)

  1. EU residency + GDPR posture. EU-headquartered fintechs cannot ship customer IPs to a US-based vendor without a §28 GDPR DPA + SCCs + a transfer impact assessment. Most US incumbents (MaxMind, ipinfo.io, ipstack) require this paperwork. IP Geo API runs on EU hosting (Hetzner, Frankfurt) and never transfers data outside the EEA — the DPA is a one-page artifact, not a 40-page schedule.
  2. Predictable EUR billing. Fintechs in DE/NL/IE/FR don’t want USD-denominated SaaS cost on the income statement. We bill in EUR, monthly, no annual prepay, no FX surprises at quarter-end.
  3. Threat fields included on every plan, not a separate SKU. ipgeolocation.io charges separately for the Security API. ipstack splits the Security Module out. ipinfo.io charges per-bundle. With IP Geo API, is_vpn, is_proxy, is_tor, is_hosting, and risk_score ship on every response from the free tier upward.
  4. ASN-level granularity. Fintech fraud teams routinely block transactions from commercial-hosting ASNs (residential users do not normally pay for groceries from an OVH server). We expose asn, asn_org, and is_hosting as first-class fields.
  5. Latency ≤40 ms median (EU edge). Authorisation flows have a hard SLA at the PSP — typically 800-1200 ms end-to-end for the cardholder. An IP lookup that costs 200 ms erodes margin elsewhere; ours costs 30-40 ms median in EU.

The three fintech control-surfaces, in code

1. KYC: country-of-origin check at signup

// /api/onboarding/start.js — Node 20 / Vercel Edge
import { headers } from 'next/headers';

export async function POST(req) {
  const ip = headers().get('x-forwarded-for')?.split(',')[0]?.trim()
    ?? req.ip;
  const claimedCountry = (await req.json()).billing_country; // ISO-2

  const geo = await fetch(`https://api.ipgeo.10b.app/v1/lookup/${ip}`, {
    headers: { Authorization: `Bearer ${process.env.IPGEO_KEY}` }
  }).then(r => r.json());

  const mismatch = geo.country_code !== claimedCountry;
  const flagged = geo.is_vpn || geo.is_proxy || geo.is_tor || geo.is_hosting;

  return Response.json({
    proceed: !mismatch && !flagged,
    enhanced_due_diligence: mismatch || flagged,
    geo_country: geo.country_code,
    asn: geo.asn,
    risk_score: geo.risk_score,
  });
}

Audit trail: persist (timestamp, ip, country_code, asn, risk_score) alongside the customer record. Regulators (DNB, BaFin, FCA, AFM) ask for this in the next on-site visit.

2. Sanctions screening: pre-filter by IP-country before name-screening

Sanctioned jurisdictions today include (per OFAC + EU restrictive-measures consolidated list, 2026): CU, IR, KP, RU, SY, BY, plus regional restrictions on Crimea, DNR, LNR, Kherson, Zaporizhzhia.

# Python / FastAPI
SANCTIONED = {"CU", "IR", "KP", "RU", "SY", "BY"}
SANCTIONED_REGIONS = {  # ISO-2 + region-name match
    ("UA", "Crimea"), ("UA", "Donetsk"), ("UA", "Luhansk"),
    ("UA", "Kherson"), ("UA", "Zaporizhzhia"),
}

def sanctions_pre_filter(geo):
    if geo["country_code"] in SANCTIONED:
        return ("HARD_BLOCK", f"sanctioned_country:{geo['country_code']}")
    region = (geo["country_code"], geo.get("region_name", ""))
    if region in SANCTIONED_REGIONS:
        return ("HARD_BLOCK", f"sanctioned_region:{region[1]}")
    if geo["is_tor"] or (geo["is_vpn"] and geo["is_hosting"]):
        return ("MANUAL_REVIEW", "anonymizer_or_datacenter_vpn")
    return ("PASS", None)

The IP-layer pre-filter cuts the name-screening false-positive rate (sanctions lists are full of common Slavic surnames) by routing high-confidence-allowed traffic past name-screening entirely.

3. Payment fraud: per-transaction risk score at authorisation

// /api/payment/authorize.js
const geo = await ipgeoLookup(ip);
let risk = geo.risk_score; // 0-100, server-side

if (geo.country_code !== card.country)            risk += 20;
if (geo.is_vpn || geo.is_proxy || geo.is_tor)     risk += 25;
if (geo.is_hosting)                                risk += 15;
if (HIGH_FRAUD_GEOS.includes(geo.country_code))   risk += 10;

const action =
  risk > 80 ? 'block'    :
  risk > 60 ? '3ds_step_up' :
  risk > 40 ? 'review'   : 'allow';

await audit.write({
  ip, geo_country: geo.country_code, asn: geo.asn,
  risk, action, ts: Date.now()
});

Why this composes: IP signals are cheap (≤40 ms, ~€0,0001/lookup) and produce a numeric risk score that down-stream signals can extend (3DS challenge, device fingerprint, behavioural analytics) without re-doing the lookup.

Pricing math for a typical EU fintech

Stage Volume Tier Cost / month Cost per check
Pre-launch / pilot < 30 K checks/mo Free € 0 € 0
Seed / Series A < 1 M checks/mo Starter €29 € 29 € 0,00003–0,001
Series B+ scale-up < 10 M checks/mo Business €99 € 99 € 0,00001–0,0001
Late-stage / multi-product > 10 M Custom on request < € 0,00001

A single fintech merchant blocking just one € 60 chargeback per month through better IP-layer pre-filter recovers the entire Starter subscription — and chargebacks at € 60 are a conservative rounding-down.

Honest limits — what IP geolocation is not for in fintech

IP geolocation’s job in a fintech stack is to cheaply route so the expensive signals (3DS, device, behavioural, document-vault, manual review) only activate for ambiguous cases — saving 60-80% of cost without giving up control.

Related use-cases

The fintech surface composes from these IP Geo API use-case patterns:

Compare IP Geo API to the providers fintechs evaluate

If you’re shortlisting vendors for a fintech RFP — typically driven by a procurement or compliance team — these head-to-heads cover the providers most often shortlisted in the IP-geolocation market:

Read also — narrative deep-dives

Seven 2026-dated comparison articles with code-level migration sketches and pricing math at 100K / 1M / 10M req/mo:

Migration walkthroughs — drop-in code-level guides

Already on an incumbent? These step-by-step migration guides ship with field-by-field maps, code diffs, shadow-mode validation, and rollback notes:

Industry deep-dives

Other vertical-specific surfaces using the same IP Geo API primitives:

Get started — fintech-friendly procurement

Sign up at https://ipgeo.10b.app/pricing and start with a sandbox key today.

Get early access — 50% off for 12 months

First 100 signups lock in 50% off any paid plan for the first year. No credit card required — we’ll email you at launch.