The numbers finally caught up with the machines. In 2025, the FBI’s Internet Crime Complaint Center logged more than 13,400 complaints tied to crypto ATMs, with reported losses exceeding $388 million — up 58% year over year — and more than half of the victims were over 50. State legislatures noticed. Thirteen state crypto kiosk laws were enacted in 2026 alone, roughly 30 states have introduced or passed kiosk measures since 2023, and one state has now done what many operators considered unthinkable: banned the machines outright. For virtual currency kiosk operators — who were already Money Services Businesses under federal law — the operating environment has changed permanently. Here is what the new landscape looks like, and what it demands of your compliance program.
Indiana Draws the Hardest Line: A Statewide Ban
On March 9, 2026, Indiana became the first state to prohibit virtual currency kiosks entirely when Governor Mike Braun signed House Enrolled Act 1116. The bill’s history should worry the industry more than its outcome: it began as a conventional licensing bill with ID verification, transaction limits, and fee caps. When operators testified that those requirements would push them out of the state, lawmakers — backed by law enforcement testimony on elder fraud — rewrote it as an outright prohibition. Enforcement sits with the Attorney General, courts can order forfeiture of all fees collected and seizure of kiosks, and liability can extend to property owners who knowingly host a machine. The lesson: where the industry cannot demonstrate credible fraud controls, the political alternative to regulation is no longer the status quo. It is prohibition.
Wisconsin’s Blueprint: What Full Regulation Looks Like
One month later, on April 9, 2026, Wisconsin’s Assembly Bill 968 showed the other path. Kiosk operators must now obtain a license under the state’s money transmission statutes and operate under a dense set of controls: a physical fraud alert in at least 20-point type on the front of every machine, the same warning on screen with affirmative customer acknowledgment, government-issued ID collection plus a photograph of the customer at the kiosk, a $1,000 daily transaction cap, a full refund — including fees — for fraud victims who notify the operator and law enforcement within 30 days, advance notice of each kiosk location to local police, live toll-free customer service during all operating hours, and a written anti-fraud policy with defined monitoring responsibilities. Virginia, Wyoming, and South Dakota also enacted kiosk laws in 2026, following Nebraska’s 2025 statute, while Vermont has extended a moratorium on new machines.
The Emerging National Baseline
Pending bills in Pennsylvania, New Hampshire, Michigan, and Washington — plus the federal Crypto ATM Fraud Prevention Act (S. 710) — converge on a recognizable template. Operators should assume that within a short horizon, most states where they place machines will require some combination of:
- Money transmitter licensing or registration under an equivalent state framework;
- Daily transaction limits, typically $1,000–$2,000 per customer, with New Hampshire’s SB 482 adding a 48-hour hold and cancellation right on first-time customer transactions;
- Refund rights for fraud victims within 14–30 day windows — an operational obligation that functions like a chargeback regime for cash-to-crypto;
- Blockchain analytics screening to block transfers to wallets linked to fraud, theft, or sanctions exposure;
- Scam interdiction at the machine: scripted fraud-warning prompts, mandatory acknowledgments, and transaction blocking when responses indicate coercion;
- Designated compliance and consumer-protection officers, elder-exploitation policies, and quarterly kiosk location reporting to state regulators.
The Federal Layer Has Not Moved — It Still Applies in Full
None of this displaces federal obligations. FinCEN has treated kiosk operators as Money Services Businesses since its 2019 convertible virtual currency guidance: FinCEN registration, a written risk-based AML program, independent testing, SAR and CTR filing, and OFAC screening all apply in every state — including states with no kiosk statute at all. FinCEN’s August 2025 notice on CVC kiosk fraud put examiners and banking partners on alert for the specific typologies driving the state laws: government-impersonation and tech-support scams, elderly customers directed to machines by a caller, structured cash deposits below identification thresholds, and one-way flows to newly created wallets. Operators should expect state examiners to test both layers together — and expect their bank partners to ask harder questions at account review.
FinCheck’s Perspective & Way Forward
We work with Bitcoin ATM and kiosk operators, and our read is direct: the patchwork is the punishment. Fifty different statutes, limits, refund clocks, and reporting formats are now the real compliance cost, and operators who manage them state by state on spreadsheets will fall behind. Four moves matter now. First, build a 50-state obligations matrix and license posture review — know where you are licensed, where you are merely registered, and where a pending bill changes the math on keeping machines deployed. Second, treat refund mandates as a fraud-operations capability, not a legal footnote: intake, investigation, law-enforcement coordination, and reimbursement need owners, SLAs, and reserves. Third, make blockchain analytics and scam-interdiction prompts standard on every machine nationwide — deploying them only where mandated is operationally harder and indefensible to regulators. Fourth, refresh your BSA/AML risk assessment and independent audit scope to cover the new state layer, because your next state exam and your next bank-partner review will. Indiana proved that the alternative to demonstrable compliance is not lighter regulation — it is exit.
FinCheck LLC supports crypto kiosk and MSB operators with FinCEN registration, state money transmission licensing, BSA/AML risk assessments, independent AML audits, policy and procedures development, KYC and transaction monitoring tool selection, and fractional Chief Compliance Officer services. If the 2026 state wave touches your fleet, let’s map your exposure before an examiner — or a legislature — does it for you.