APs are normally programmed based on the market they're sold into. Client devices receive information about which regulatory domain they're in from the AP they're connecting to.
There's no technical mechanism to prevent someone operating an AP inappropriately. That's more an opportunity to discover how effective your local enforcement agency is.