The technology border is being drawn by terms of service

Anthropic spent last week closing the workarounds Chinese firms had built to reach Claude: Singapore-subsidiary corporate accounts at Ant Financial, VPN-and-reimbursement schemes at ByteDance, and the "transfer station" relay services in between. None of what those firms did was illegal under US or Chinese law. The barrier being enforced is Anthropic's Terms of Service, read against timezone metadata on user accounts. This is a private company drawing a technology border that governments have declined to draw.

The gap between what US law prohibits and what Anthropic wants to prohibit is doing the interesting work here. US export controls on AI currently reach hardware — Nvidia's H100s, the specific chips that matter for training frontier models. They do not reach API access to general-purpose models by Chinese firms operating through third-country subsidiaries. A Singapore entity paying for Claude with a Singapore card, staffed partly by mainland engineers, is an entirely ordinary corporate structure. It is how multinationals have worked for decades.

Anthropic's updated terms now bar entities more than 50% owned by organisations headquartered in unsupported regions, regardless of where the subsidiary sits. That is a policy choice a legislature has not made. It may be a policy choice a legislature would not make, given how much legitimate multinational activity the rule sweeps up on its way to the target.

The detection mechanism is the second thing to notice. Anthropic is not asking Ant Financial for a corporate structure diagram. It is not requiring attestations from account holders. It is reading behavioural telemetry — when accounts are active, what timezone they resolve to, what card issued the payment, whether traffic passes through a known relay. The Financial Times reports timezone signals on user accounts as one of the detection methods; the Perplexity consensus adds payment-card issuing country and proxy identification to the list. ^{1 2}

This is the same toolkit social platforms use against coordinated inauthentic behaviour, repurposed as a geopolitical filter. Access control is becoming a data-science problem, run against the same signals every trust-and-safety team already collects. The wall is not made of paper. It is made of pattern-matching against a login map.

The workaround topologies tell us where the demand is coming from. Ant Financial went corporate: Singapore subsidiary, group accounts, mainland staff logging in. ByteDance went grassroots: individual engineers buying personal Claude subscriptions over VPN, then submitting the receipts for reimbursement. Two different companies converged on two structurally different solutions to the same problem.

Neither of these looks like a procurement decision. A procurement decision picks one topology and scales it. What the FT documents looks like engineering demand routing around whatever obstacle it hits, with finance departments quietly writing the cheques after the fact. ¹ The developers want Claude Code specifically. Not "an AI coding tool" — Claude Code. That is a product-preference signal strong enough to make people expense their VPN subscriptions.

The wall is being built from two sides that are not talking to each other, using account terms and platform bans as bricks.

Alibaba banned Claude Code from its developer platforms in the same week. ³ Whether that is retaliation, competitive positioning, or a security review that happened to conclude on Tuesday, the effect is the same: mutual walling-off, built without any government on either side having to sign anything. This is more durable than a treaty. A treaty can be renegotiated. Two private companies enforcing symmetric exclusions through their own terms of service produce a bifurcation that neither government has to own, defend, or reverse.

The consensus framing calls this "decoupling." I think that word is doing too much work. Decoupling implies a single decision, ideally a policy one. What we have is two commercial platforms independently arriving at the conclusion that the other side's users are not worth the risk, and enforcing that conclusion through account terms and platform bans. The outcome resembles decoupling; the mechanism is something quieter and, because it is quieter, harder to undo.

The obvious counter is that enforcement at this scale is performative. VPNs, reimbursement schemes, and Singapore subsidiaries are not exotic techniques. If Ant Financial and ByteDance are doing this, so are hundreds of Chinese firms that will never attract Financial Times coverage. Timezone signals catch the visible cases and the careless ones. They cannot catch a determined engineer who sets their laptop clock to Singapore time and pays with a Wise card.

This is a fair objection, and I think it is partly right — but only partly. The point of the enforcement is not to achieve zero access. It is to achieve credible deniability at scale, plus enough friction that the workaround stops being cheap. Ant Financial's Singapore-subsidiary route worked because it was cheap and low-risk. Once accounts start getting terminated on timezone signals, the cost curve moves. Corporate legal starts asking questions. Reimbursement approvals slow down. The demand does not disappear, but it thins.

The precedent worth watching is what this does to legitimate multinational structures. A Singapore subsidiary of a Chinese parent is a normal thing. So is a US subsidiary of a European parent, or a UK subsidiary of an American one. If Anthropic's 50%-ownership rule holds and other frontier labs follow, every multinational has just acquired a new compliance question about which of its group accounts are permitted to touch which model. That is not necessarily wrong. It is a change worth naming, and it is a change being made by a handful of private terms-of-service teams rather than by any legislature.

The specific enforcement action against Ant Financial and ByteDance will probably work in the sense that matters to Anthropic: the visible workarounds close, the FT stops writing about it, the regulatory pressure to do something about Chinese access eases. The larger thing that is happening — private terms of service becoming the operative layer of technology-border enforcement, with telemetry as the detection mechanism — is not going to stop with Claude. It is the shape of how this gets done now.

Footnotes

¶