It's a basic principle of international law that a country can hold someone criminally liable for violating laws in that country, even if they did so from abroad, so long as the activity was specifically targeted at the country or had a major impact on that country. E.g. if you run a service that defrauds people from a country with lax fraud laws, but specifically advertise to people in the U.K., the U.K. is within its rights to hold you criminally liable under their fraud laws. This is most visible with financial crimes, which aren't uniform between countries.