The SEC allows for individuals to not register with them if they don't permit business with users outside of the state:
A broker-dealer that conducts all of its business in one state does not have to register with the SEC. (State registration is another matter. See Part III, below.) The exception provided for intrastate broker-dealer activity is very narrow. To qualify, all aspects of all transactions must be done within the borders of one state. This means that, without SEC registration, a broker-dealer cannot participate in any transaction executed on a national securities exchange or Nasdaq. Also, information posted on the Internet that is accessible by persons in another state would be considered an interstate offer of securities or investment services that would require Federal broker-dealer registration.
What technology or implementation is sufficient to protect a website and limit its access to a given state?