Crypto ATM laws in Arizona: a guide for operators (2026)

Licensing in Arizona

Kiosk operators must be licensed money transmitters with DIFI; A.R.S. 6-1236 bars locating a kiosk (or letting a third party do so) without a money transmission license. Money transmitter licenses are issued through NMLS.

Regulator: Arizona Department of Insurance and Financial Institutions (DIFI) · License: Money transmitter license

Sources: DIFI: Money Transmitters - NMLS · Ariz. HB 2387 (2025) introduced text, A.R.S. 6-1236 · DIFI Regulatory Bulletin 2025-05 (2025 legislation summary)

Arizona's kiosk law

A.R.S. § 6-1236 (HB 2387, 2025). Daily limits, disclosures, receipts, 24/7 live support and refunds for defrauded new customers.

• New customers (first 10 days): no more than $2,000 cash a day. Existing customers: no more than $10,500 a day.
• A defrauded new customer gets a full refund, fees included, if within 30 days they contact you and law enforcement or the Attorney General and provide a report.
• Live customer service 24 hours a day, 7 days a week, with the toll-free number shown on the kiosk or its screen.
• Clear terms and separate disclosures the customer accepts before a transaction; a physical or digital receipt after it; blockchain analytics and a written anti-fraud policy.
• The law sets no fee cap; fees must appear on the receipt.

Sources: Ariz. Laws 2025, ch. 171 (HB 2387), A.R.S. § 6-1236

Also in the law, and recent changes

• The Attorney General's page says the kiosk law took effect September 26, 2025.
• Operators must give any governmental entity, on request, a list of their Arizona kiosks and notify DIFI within 10 business days of changes (new, moved or removed kiosks, name, address, kiosk wallet address) (introduced text; confirm against the chaptered law).

Sources: Arizona AG: Cryptocurrency ATM Fraud · Ariz. HB 2387 (2025) introduced text

Bills and changes to watch

• HB 2232 (2026, Rep. Blackman): would require a separate DIFI cryptocurrency kiosk operator license by 2027-01-01, with fingerprints, a solvency audit, a 15-year regulatory history review and mandatory denial for fraud or money laundering convictions. Introduced; final status not confirmed.

Enforcement and lawsuits

• The Attorney General runs an online form for reporting kiosk operators that violate HB 2387 and tells new customers they have 30 days to file a police or AG report to qualify for a refund.

Practical hurdles

• Refund exposure: a new customer with a law-enforcement or AG report within 30 days gets a full refund including fees, and the AG actively solicits these reports.
• Scam pressure context: FBI IC3 counted 460 crypto-kiosk complaints from this state in 2025 with $14,530,436 in adjusted losses (FBI notes losses may include non-kiosk transactions).

What we couldn't confirm

• MTMA: 2022 Ariz. Laws ch. 236 (SB 1580) repealed and replaced the money transmitter article with multistate-supervision provisions, but we did not confirm it is the CSBS MTMA (CSBS enactment list could not be fetched).
• The two location/notification rules are from the introduced HB 2387 text, not the chaptered law.
• AG enforcement actions against specific kiosk operators in Arizona: none found.
• HB 2232's final status.