OKX's geography policy — US fully blocked, China restricted
OKX currently bans service in: (1) United States (all states + Puerto Rico) — voluntarily withdrew after SEC's 2023 probe; (2) Canadian Ontario — blocked by the Ontario Securities Commission (OSC); (3) Malta (core office there but some services restricted by domestic conflicts); (4) other US-sanctioned countries (Cuba / Iran / North Korea / Syria / Sudan / parts of Russia like Crimea); (5) high-risk country list (FATF-updated, including some African and Central Asian states). Mainland China since 2021 'offshore compliance': no more RMB OTC to Chinese citizens, no Chinese ID KYC accepted — but IPs aren't actively blocked (VPN isn't the main obstacle, KYC is). OKX's REGION_CODES logic is a blacklist (not in blacklist → allowed) — user-friendly but AF3 has to maintain a denylist specifically.
AF3 3-star — loose main site, strict KYC
AF3 rates OKX 3-star, but 'access' and 'usage' are distinct: (1) Access (www.okx.com + app) — VPN detection is very loose, datacenter IPs / commercial VPN nodes all pass. IP scoring: residential 30 / quality_vpn 28 / normal_vpn 25 / datacenter 22 (close to Spotify's leniency); (2) Registration KYC — the real strictness point. OKX demands: ID document (passport / national ID) + phone number (must match ID country) + IP geography + name consistency + face liveness. Post-KYC, VPN has little impact. For intent-clear users (Chinese / US identity wanting OKX), the real obstacle is KYC, not VPN. AF3 probes only tell you IP reachability — whether KYC passes depends on your document and OKX risk controls, which is outside AF3's scope.
US user workarounds — risks and options
US users wanting OKX have several paths, each with legal and account risk. (1) KYC with non-US passport (HK / Singapore) + US VPN for daily use — requires overseas passport; post-KYC VPN-insensitive, but OKX can ban if it later detects primary activity from US IPs; (2) OKX overseas edition with VPN + overseas fiat rails (SGD / HKD / EUR) — avoids USD rails but needs overseas bank accounts; (3) pure Web3 / decentralized (OKX Web3 Wallet + DEX) — no KYC, but liquidity and depth are below CEX; (4) strongly not recommended — US IP + fake overseas identity — violates US financial regulation + OKX contract, high ban and legal risk. AF3 rules US IPs as ❌ blocked and explicitly steers users to compliant US-licensed options (Coinbase / Kraken / Gemini).
China users — a more complex gray zone
Mainland China users' OKX reality: (1) IP access — not directly blocked, but GFW erratically interferes with okx.com traffic (sometimes reachable, sometimes not); app delisted from China App Store, need overseas Apple ID; (2) KYC — Chinese mainland ID not accepted, but passport KYC works (Chinese citizens with passports); (3) fiat rails — RMB OTC ended, but USDT / BTC can trade against other-channel fiats; (4) compliance risk — China's 9/24/2021 notice banned domestic exchanges, but cross-border individual use of overseas exchanges is legally ambiguous (discouraged but not explicitly criminal). Practical path: Chinese passport + non-China phone (HK / Singapore) + overseas VPN + OKX Web3 / spot / USDT fiat flows. AF3 rules China IPs as ⚠️ partial (main site reachable but KYC channel restricted), not ❌.
Fiat rails — availability by region
OKX fiat rails vary massively by region: (1) USD — only for non-US identities, limited channels (mostly USDT-based); (2) EUR — SEPA is most friendly for EU identities, low fees; (3) HKD — HK identities get FPS instant transfer, fastest; (4) SGD — Singapore identities get PayNow; (5) GBP — UK identities via Faster Payments; (6) JPY — Japanese identities via bank transfer, but Japanese compliance tightened in 2024 and some channels shrunk; (7) AED (UAE) — Dubai identities have a dedicated channel, friendly to HNW users; (8) TRY / ARS / BRL — emerging markets (Turkey / Argentina / Brazil) use P2P rails. AF3 observes that KYC'd accounts only get matching-country rails — 'HK passport KYC' gets HKD rails, can't cross into EUR SEPA.
Security, compliance, and risk warnings
OKX is relatively compliance-mature among CEXs, but crypto's systemic risk remains high: (1) Licenses — Seychelles, Dubai VARA, Malta MFSA, HK application pending (submitted 2024); (2) Proof of Reserves — monthly Merkle tree proof of holdings; (3) 2FA + hardware key + cold-wallet ratio (>90% user assets cold-stored); (4) 2017 hack (OKEx era, compensated users); no major incidents post-2022 rebrand. User-side: (1) enable Google Authenticator 2FA, not SMS 2FA (SIM-swap risk); (2) move large assets to OKX Web3 self-custody, don't leave on exchange; (3) don't fake identity under KYC pressure — account freezes on issue; (4) comply with your country's tax reporting (US 1099, China tax compliance still unclear). AF3 explicitly warns: crypto has extreme market risk, OKX doesn't endorse any token, users bear all risk.