Anthropic's revised Supported Regions Policy took effect on Thursday, November 12: less a new wall than the old one resurveyed, gaps filled. Claude use is now unsupported on any of three grounds: where a person physically sits, where their employer is incorporated or headquartered, and who owns or controls that employer. China, Hong Kong and Macau are absent from the list of supported places; Taiwan is on it. For engineers in Europe the word that matters is "control", because it follows the cap table, not the office address.
From one ownership test to three
The baseline is Anthropic's September 4, 2025 post, which barred entities more than 50% owned, directly or indirectly, by companies headquartered in unsupported regions, wherever those entities operate. That rule was about corporate parents.
The November text widens it on three axes. It covers "Use by persons while physically located in an unsupported region", explicitly including staff of otherwise supported customers. It covers entities incorporated or headquartered in an unsupported region, with their personnel included even when they are physically elsewhere. And it covers entities majority-owned or controlled, directly or indirectly, by persons or entities in unsupported regions: individuals now count alongside companies, and control counts alongside a majority stake. The policy names Claude.ai, Claude Code, Cowork, the API and developer platform, and Claude models offered through cloud platforms and authorized resellers. It does not name Amazon Bedrock, Google Vertex AI or Microsoft Foundry, and it does not define "control".
ChainCatcher reported the update on November 11. The rules are written for every unsupported region; China is the headline, not the only target.
Passports, selfies and the relay economy
The identity checks attached to this story are real but older than the policy. Anthropic's help centre, last updated August 11, 2026, describes identity and business verification for some use cases, prompted by certain capabilities or routine integrity checks: an original, physical government photo ID, possibly a live selfie, processed by Persona. Anthropic says the images stay with Persona and are not used for training; it states no retention period. Organisations also supply a legal name, address and registration number. The policy page itself never mentions verification.
Enforcement has a history. The South China Morning Post reported in April that access from China had run through location-masking servers and relay platforms such as AICodeMirror, which it said had more than 10,000 registered users and over 200 institutional clients. A Financial Times investigation, relayed by the Free Press Journal, reported Ant giving staff corporate accounts tied to a Singapore entity, ByteDance reimbursing personal subscriptions used over VPNs, and firms reaching Claude through foreign subsidiaries on Azure. Those routes reportedly broke no US or Chinese law, only Anthropic's terms. Anthropic said it enforces through "continuous, evolving detection systems", down to signals as humble as a computer's time zone.
The case made, and the case against
Anthropic's stated rationale, set out in 2025, is that companies in such jurisdictions can be legally compelled to share data or cooperate with intelligence services, that its models could end up serving "adversarial military and intelligence services", and that access feeds distillation into competing models. Per the FT report, Anthropic also described itself as the only frontier AI company restricting sales to PRC-controlled companies. That is the company's claim; we did not check OpenAI's or Google's terms against it.
The other side is heard mostly from developers. SCMP reported alarm in China's developer community, where many programmers rely on Claude Code, and fear of a complete cutoff. After the 2025 rule, SCMP described confusion at Chinese-backed tools serving users abroad: Trae, ByteDance's Singapore-based editor, fielded refund requests, while Alibaba's Qoder and Tencent's CodeBuddy also offered Claude internationally. We found no response from Chinese officials or named companies to the November change.
The diplomatic backdrop is talks, not only walls. After eight hours in New York on September 20, Treasury Secretary Scott Bessent said Washington had proposed a notification mechanism for national-security-level AI incidents and that both sides discussed a US-China AI dialogue, AFP reported; Chinese state media called the meetings "candid, in-depth, and constructive". Bessent told CNBC the next AI meeting would "probably be Shenzhen, China, in about two months", Herald Business reported; Shenzhen hosts APEC this month. No source ties Anthropic's timing to that calendar.
What a Berlin team with a Shanghai parent should do
If your employer is a European subsidiary majority-owned or controlled from mainland China or Hong Kong, the policy treats your use as unsupported at a desk in Berlin or Milan. Expect seats and API keys to be reviewed, and do not improvise with personal subscriptions; that is exactly what detection hunts.
Companies outside that net still have homework. Contractors and offshore teams physically in unsupported regions fall under the location test, as does an engineer on a supplier visit to Shenzhen. Products that relay end-user prompts to Claude should geo-fence, since Anthropic's statement to the FT covered facilitating access, not only direct use. Resellers are named in the policy, so procurement and partner due diligence now needs ownership and control questions, not just billing addresses.
The quieter lesson is architectural. Keep a model abstraction layer and a second provider you have actually tested, because a vendor's border can move on a date set elsewhere.
What we could not verify
- We compared the 2025 post with today's policy, not a redline; the version history went unreviewed, so some changes may predate November 12, making this week's step smaller than described.
- How Bedrock, Vertex AI and Foundry enforce the rules, and from what date.
- Whether ID and selfie checks are triggered by region or ownership signals, and how "control" is defined (minority stakes with board seats, say).
- The FT report was read only through a secondary outlet, and a Reuters report on Bessent's November 11 remarks could not be opened, so the diplomatic context rests on September statements.
The 30,000-foot read
Anthropic has decided that access to its models follows jurisdiction and control, not IP addresses. Whether that is prudent security or a market quietly surrendered is argued in Washington, Beijing and inside the industry, and this post does not settle it. What is settled is narrower: the rule is in force, and it reaches people, parents and resellers.
For engineers, the controllable part is small and concrete: know your ownership chain, know where your people and users sit, and keep a second model wired in. The rest belongs to others. Watch whether the cloud platforms publish matching enforcement, whether verification widens, whether the Shenzhen talks touch commercial access at all, and whether rivals follow Anthropic or market the difference.
Sources: Anthropic Supported Regions Policy (November 12, 2026 effective date, three unsupported-use tests, products and channels covered, supported-region list); Anthropic, Updating restrictions of sales to unsupported regions (September 4, 2025 baseline, 50% ownership threshold, stated security rationale); Claude Help Center, Identity verification on Claude (ID and selfie requirements, Persona, data handling, August 11, 2026 update); ChainCatcher (November 11 report of the policy update); South China Morning Post, April 2026 (relay platforms, AICodeMirror figures, developer reaction); Free Press Journal, relaying the Financial Times (Ant, ByteDance and Azure workarounds, Anthropic's enforcement statement and "only frontier company" claim); South China Morning Post, September 2025 (Trae, Qoder, CodeBuddy); Kuwait Times, AFP (September 20 talks, notification mechanism, Chinese state media response); Herald Business (Bessent on next AI meeting in Shenzhen, APEC host city). CAVEATS: primary policy text read directly; the comparison of old and new rules is ours, made from two Anthropic documents rather than an official changelog. The FT investigation is cited through a secondary outlet, so its details are single-sourced here. The SCMP April article carries no visible date; April 2026 is inferred from its image path and same-day coverage elsewhere. The lead's claim that flagged users face ID and selfie checks matches Anthropic's help centre generally but is not stated in the November policy. The digest that prompted this story (TokenPost) and the November 11 Reuters report could not be opened. No chart: the story has no comparable sourced figures.