US CItizens are prohibited to participate in ICO's to safeguard their citizens from fraud/scam. ICO's to keep themselves safe from any legal obligation, they now ask for KYC information before applying/or at the time of distribution of token. So you can't bypass VPN to participate in ICO's. doubt you have much to worry about if you're thinking of using a bypass (VPN, for example) for short-term participation.
" ICO uses KYC to keep themselves safe from any legal obligation". But what if ICO is not from the US and its tokens are utility tokens (not security)?
To my knowledge, it does not matter the location. The SEC has a global reach and power. If American citrizens are allowed to participate in that ICO, it automatically opens up that ICO issuer to the SEC. If Americans were unable to participate by the ICO issuer but do so anyways, the company has an argument against the SEC jurisdiction.