Crypto ATM laws by state: a guide for operators (2026)

The short version

• Almost every state treats selling bitcoin for cash as money transmission, so the first hurdle is a license in each state you operate in, usually through NMLS. A few license virtual currency separately (New York's BitLicense, California's DFAL, Louisiana's VCBA, and new kiosk licenses in Kentucky and Virginia), and a few, such as Montana, Utah and New Hampshire, require no state license for crypto at all.
• 25 states have a kiosk-specific law in force today and 5 more have one passed but not yet effective. They add daily limits, fee caps, scam warnings, refunds for fraud victims and, in some states, holds on new customers' transactions.
• 5 states ban crypto ATMs outright: Hawaii, Indiana, Minnesota, Tennessee, Vermont. Some cities have their own bans too.
• New Jersey, New York, Massachusetts, Michigan, Pennsylvania, Delaware and Ohio all have kiosk bills or bans in play, and Texas, Montana and Nevada are expected to take kiosks up in 2027. Expect the table below to keep changing.
• On top of all of it sits the federal layer: FinCEN registration, a written AML program, CTRs and SARs, OFAC screening and the Travel Rule, which apply in every state.

How strict is each state?

Every state at a glance

Pick a state for its licensing, kiosk rules, pending bills, local rules and the practical hurdles, each with the sources we read.

The federal layer: what applies everywhere

Every crypto ATM operator in the US is a money services business under federal law, wherever it operates. These rules apply on top of every state's. Kiosk operators are generally money services businesses (money transmitters) under the BSA. They must register with FinCEN (Form 107) within 180 days of starting and renew every two years, keep an AML program, verify customer ID, file SARs on suspicious transactions of $2,000 or more and CTRs on cash over $10,000 (aggregated), and keep SARs and supporting records 5 years. FinCEN registration is not a license or an endorsement.

Sources: FinCEN Notice FIN-2025-NTC1 (2025-08-04) · 31 CFR 1022.380 (registration) · FinCEN: MSB registration

FinCEN's kiosk notice (2025-08-04)

• Not a new rule: it reminds kiosk operators of existing BSA duties and urges financial institutions to report kiosk-linked fraud, cybercrime and drug trafficking.
• Red flags for operators: many payments just under reporting thresholds across kiosks; structuring across machines or accounts; new customers' deposits moved quickly through several addresses; many customers in distant places paying one address; links to known fraud wallets.
• Red flags for non-compliant operators: unregistered or unlicensed, no ID collection, advertising no-ID transactions, unusually high or opaque fees.
• SAR key term: put 'FIN-2025-CVCKIOSK' in SAR field 2 and the narrative.
• Cites FBI IC3 2024: more than 10,956 kiosk complaints and about $246.7 million in losses (complaints up 99%, losses up 31% from 2023); FTC data show people 60+ were more than three times as likely as younger adults to report a kiosk loss.

Sources: FinCEN Notice FIN-2025-NTC1

Why regulators are moving

• Loss figures (latest year, FBI IC3 2025, PSA of 2026-05-15): more than 13,400 kiosk complaints (table total 13,460) and over $388 million in losses (table total $388,981,267), up 23% and 58% from 2024; more than half of complaints involved people over 50, with losses over $302 million. Top states by losses: Texas ($56.8M), Florida ($32.8M), California ($24.0M). FBI says losses are not solely attributable to kiosks.
• FTC: reported Bitcoin ATM fraud losses rose nearly tenfold from 2020 to 2023 (Durbin's office cites $12 million in 2020 and $114 million in 2023); over $65 million in the first half of 2024, about 71% of it reported by people 60 and over, with a $10,000 median loss (FTC Data Spotlight, Aug 2024).
• FinCEN's notice flags unregistered or unlicensed operators, no-ID transactions and opaque fees as signs of non-compliance; expect banks to scrutinize kiosk operators' accounts and cash logistics.

In Congress

• S. 710, Crypto ATM Fraud Prevention Act of 2025 (Durbin; cosponsors Blumenthal, Reed, Welch): introduced 2025-02-25, referred to Senate Banking; no committee action found. Would set new-customer (first 14 days) limits of $2,000 per 24 hours and $10,000 total, live phone/video confirmation for new-customer transactions of $500 or more, refunds (new customers: full amount plus fees; existing: fees) on a report and affidavit within 30 days, paid within 30 days, kiosk address filings with Treasury every 90 days, a full-time compliance officer owning no more than 20%, blockchain analytics, live support, physical receipts, $10,000 per violation per day; no fee cap; effective 90 days after enactment; does not preempt stronger state laws.
• Durbin filed a crypto ATM amendment (FinCEN registration and location reporting, disclosures, daily limits, refunds) to the 21st Century ROAD to Housing Act and promoted it on the Senate floor on 2026-03-10; outcome not confirmed.
• CLARITY Act (market structure): Senate Banking advanced it 15-9 on 2026-05-13; no kiosk provision found in the reporting we read. Sen. Lummis said she and Sen. Gillibrand hoped to address Bitcoin ATM fraud in the market structure bill (undated report). A Senate cloture vote was scheduled for 2026-09-15; result not confirmed.

• Bitcoin Depot (Bitcoin Depot Operating, LLC), previously in 33 states, filed for bankruptcy in the U.S. Bankruptcy Court for the S.D. Texas in May 2026 and took its kiosk network offline (Louisiana OFI alert 2026-07-06; IDFPR also posted a claims alert).
• State AG suits outside this group, for context: D.C. AG v. Athena Bitcoin (Sept 2025); Massachusetts AG v. Bitcoin Depot; Missouri AG v. CoinFlip (May 2026), after civil investigative demands to CoinFlip, Rockitcoin, Bitcoin Depot, Athena and Byte Federal.

Sources: S. 710 bill text (congress.gov) · S. 710 details (govinfo) · Durbin press release, 2026-03-10 · Durbin press release, 2026-05-26 (Peoria) · Elliptic: CLARITY Act passes Senate Banking (2026-05-13) (secondary) · Cointelegraph via TradingView: Lummis on ATM scams (secondary) · KuCoin News: Senate procedural vote on CLARITY (2026-09-15) (secondary) · Louisiana OFI consumer alert: Bitcoin Depot · IDFPR: Bitcoin Depot bankruptcy alert · D.C. OAG: Schwalb sues Athena · Mass. AG: Campbell sues Bitcoin Depot · Missouri AG: suit against CoinFlip · Missouri AG: investigation (CIDs)

2026: the year states started banning kiosks

• Five states now ban crypto ATMs: Indiana (March 2026), Tennessee and Vermont (July 2026), Minnesota (August 2026) and Hawaii (October 2026, for machines that sell crypto for cash).
• New Jersey's S2141 ban passed the Senate 37-3 on June 30, 2026 and waits in an Assembly committee. Massachusetts's Senate put a ban in its economic development bill, which is in conference. Delaware and Michigan have ban bills filed.
• At the same time, more than a dozen states passed or started kiosk rulebooks in 2025-2026, from Alabama and Georgia to Kansas, Utah and Wisconsin, and Florida, New Hampshire, North Carolina, Kentucky and Virginia have laws starting between December 2026 and July 2027.
• Cities aren't waiting: Spokane, Spokane Valley, Kennewick, Anacortes and Cheney in Washington, Albuquerque, and about 20 Massachusetts towns have banned kiosks.
• Bitcoin Depot, one of the largest operators, filed for Chapter 11 in May 2026 and took its network offline, according to state regulators' alerts. Attorneys general in DC, Iowa, Massachusetts and Missouri are suing operators.

What the kiosk laws have in common

• Daily limits, usually lower for new customers: $1,000 to $3,000 a day in their first days or weeks, and $5,000 to $10,500 a day after that. California, Maine, New Hampshire and Wisconsin cap every customer at $1,000 or $2,000 a day.
• Fee caps that count the spread, not just the flat fee: from the greater of $5 or 3% in Maine, a reported 10% in Alaska and 12% in North Carolina (from 2027), through 15% (California, Connecticut, Iowa, Maryland, Oklahoma) and 18% (Georgia, Illinois, Kansas, Kentucky, Nebraska, Virginia) to 25% in South Dakota.
• Scam warnings the customer must see and accept before paying, often with set wording and type size, plus receipts with the fee, the exchange rate and your contact details.
• Refunds for fraud victims who report within a set window (usually 14 to 90 days), usually the full amount for new customers and the fees for existing ones.
• Holds and cooling-off periods on new customers: 48 hours in New Hampshire, North Carolina and Virginia, and 72 hours in Kansas and Kentucky. Louisiana gives every user, not just new ones, a 72-hour wait or cancellation right.
• Location reporting and approvals: quarterly kiosk lists in Georgia, Kansas, Mississippi, Missouri, North Dakota, Nebraska, Oklahoma and Rhode Island; approval of each kiosk before it goes live in Alaska, Rhode Island and (from 2027) Kentucky; telling local police in Wisconsin.
• Staff and systems: live phone support during set hours, a full-time compliance officer, blockchain analytics and a written anti-fraud policy.

These rules are aimed at elder-fraud scams, which the FBI says cost Americans hundreds of millions of dollars a year through crypto ATMs. Operators who already screen, warn and refund are the ones best placed when the next state writes its law.

Cities and counties with their own rules

• California: San Diego: an ordinance requiring operators and host businesses to post a City-created crypto ATM scam warning sign was on the Council Rules Committee agenda for 2026-09-16; adoption not confirmed.
• Massachusetts: Lynnfield: General Bylaw Chapter 128 'Cryptocurrency Machines' bans virtual currency kiosks in town.
• Massachusetts: Gloucester: a city ordinance banning kiosks and requiring removal within 30 days was before the Budget & Finance committee on 2025-09-18 (final vote not confirmed).
• Massachusetts: Ipswich: an October 28, 2025 Special Town Meeting warrant article would ban kiosks and require removal within 60 days (outcome not confirmed).
• Massachusetts: Sharon: 2026 Annual Town Meeting Article 19 would ban kiosks, $300 fine per day per violation (outcome not confirmed).
• Massachusetts: Boston.com reported on 2026-08-29 that 20 Massachusetts communities have banned crypto kiosks (secondary; list not read).
• Michigan: Sterling Heights: Ordinance No. 507 (adopted 2026-01-06) requires a city virtual-currency-machine license (by 2026-03-31), yearly inspections, an on-site employee, a customer helpline, photo ID, fraud warnings, and limits of $1,000 per 24 hours for new customers, $2,000 per 24 hours for others, and $10,000 per 30 days.
• Michigan: Grosse Pointe Farms: ordinance with a $1,000 daily cap and $5,000 over 14 days, adopted before any kiosks were in town (secondary).
• Michigan: Port Huron: ordinance requiring kiosk registration (secondary; details not read).
• Minnesota: Before the ban, 'some cities' regulated or banned kiosks by ordinance; the League of Minnesota Cities says those local frameworks have been repealed or superseded by the statewide ban (cities not named).
• New Mexico: Albuquerque: O-26-49, the 'Virtual Currency Ordinance' (Telles, Fiebelkorn), bans virtual currency ATMs and cashier-assisted virtual currency transactions citywide. Introduced 2026-06-15 and listed for final action at the 2026-09-09 council meeting. Secondary reports (September 2026) say it passed, gives operators 45 days to remove machines, and fines $500 per day.
• Tennessee: Murfreesboro police identified about 30 businesses with Bitcoin ATMs and are visiting them to enforce the state ban (2026-07-24).
• Washington: Spokane: Ordinance C36704 (Spokane Municipal Code ch. 10.90) makes it unlawful to host, allow, operate, permit, locate or place a virtual currency kiosk in the city. It passed 2025-06-16, took effect 2025-07-30, and gave existing kiosks 60 days to be removed. Violations are a class 1 civil infraction to the operator, and the city may revoke the operator's business license.
• Washington: Spokane Valley banned virtual currency kiosks (Spokesman-Review headline, 2026-05-11). Ordinance details unconfirmed.
• Washington: Kennewick adopted Ordinance 26-6177 adding KMC ch. 6.09 on virtual currency kiosks (2026-04-21 ordinance packet). News headlines describe it as a ban that removes all kiosks from the city.
• Washington: Anacortes banned cryptocurrency kiosks (Skagit Valley Herald headline). Date and details unconfirmed.
• Washington: Cheney: 'Cryptocurrency kiosks banned' (Cheney Free Press, 2026-07-30). Details unconfirmed.
• Washington: Benton County: a Tri-Cities Area Journal of Business article URL ('benton-crypto-ban') suggests a county ban or proposal. Unconfirmed.

States by status

Kiosks banned Hawaii, Indiana, Minnesota, Tennessee, Vermont

Kiosk law in force Alabama, Alaska, Arizona, Arkansas, California, Colorado, Connecticut, Georgia, Illinois, Iowa, Kansas, Louisiana, Maine, Maryland, Mississippi, Missouri, Nebraska, North Dakota, Oklahoma, Rhode Island, South Dakota, Utah, West Virginia, Wisconsin, Wyoming

Kiosk law coming Florida, Kentucky, New Hampshire, North Carolina, Virginia

No kiosk-specific law Delaware, District of Columbia, Idaho, Massachusetts, Michigan, Montana, Nevada, New Jersey, New Mexico, New York, Ohio, Oregon, Pennsylvania, Puerto Rico, South Carolina, Texas, Washington

How we researched this

We read each state's statute, session law or regulator page where we could find it, and marked secondary sources (law-firm alerts, news) as secondary. Where we couldn't confirm a detail from a primary source, the state page says so. Every state was checked on 2026-10-28. Kiosk rules for states in our compliance calendar come from the same checked entries operators see in their dashboard.

Bitcoin Scouts is built by the team behind QuickieCoin, which operates bitcoin ATMs in New Jersey. Its machines get no special treatment on the map.