The same counts for US and the security law. If you market your offering to an American, even if they are in Europe, and you actively ban all the US traffic, SEC has a right to go after you.