> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.thepennyinc.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.thepennyinc.com/_mcp/server.

# Geographic Rules

Use `geographic` to limit where a merchant may be located. Penny checks the merchant's country, subdivision (state or province), and ZIP or postal code when those values are present. A configured check declines when its value is not allowed.

**`Geographic rule config`**

```json title="Geographic rule config"
{
  "rule_type": "geographic",
  "applicable_transaction_authorizations": ["debit"],
  "applicable_card_issuance_modes": ["managed"],
  "configuration": {
    "country_rules": { "allowlist": ["US"] },
    "subdivision_rules": { "denylist": ["US-NV"] },
    "zip_code_rules": { "denylist": ["10001"] }
  }
}
```

`country_rules` uses ISO 3166-1 alpha-2 codes such as `US`. `subdivision_rules` uses ISO 3166-2 codes such as `US-NV` or `CA-ON`, and `zip_code_rules` uses postal code strings. Set at least one block. Each block accepts an `allowlist` or a `denylist`: an allowlist permits only the listed values, and a denylist excludes the listed values. A value can't appear in both lists. If you set both, the denylist governs; see [Allowlists and denylists](/spend-controls#allowlists-and-denylists).