Crypto kiosk rules by state: bans, licenses and the fraud data

Crypto kiosks are the least glamorous corner of American digital asset regulation and, by one measure, the most consequential. The machines sit in gas stations, grocery stores, and convenience shops, accept cash, and send cryptocurrency to a wallet address within minutes. That combination of physical accessibility, cash intake, and irreversible settlement has made them the preferred collection point for a specific category of fraud: impersonation scams in which a caller posing as a police officer, a government agent, or a bank investigator directs a frightened person to a machine and talks them through feeding money into it. The FBI logged 13,460 such complaints in 2025 with reported losses approaching $389 million, and the bureau’s own data indicates roughly two thirds of victims are over 60. The regulatory response has been unusually fragmented even by American standards, running from outright state prohibition to complete absence of oversight, with municipal ordinances now arriving as a third layer. This page maps all three.

The federal baseline

Federal treatment is settled and it is the same everywhere, which makes it the right starting point.

Kiosk operators are money services businesses under the Bank Secrecy Act. FinCEN guidance on convertible virtual currency treats an operator that accepts cash from a customer and transmits cryptocurrency to them as engaged in money transmission, because the operator is accepting value from one party and transmitting it, which is the statutory definition our FinCEN page covers in detail.

That status carries a specific set of obligations. Registration with FinCEN, renewed every two calendar years. A written, risk-based anti-money-laundering program with policies, a designated compliance officer, staff training, and independent review. Recordkeeping and the travel rule for covered transmittals at or above the applicable threshold. Suspicious activity reporting. And sanctions screening against Treasury designations, which carries strict liability, meaning intent is not a defence.

Examinations of money services businesses are generally conducted by the Internal Revenue Service on FinCEN’s behalf, which surprises operators expecting a banking regulator.

Two points worth stating plainly. Federal registration is a filing, not an approval, so it confers no vetting and no licence. And an operator meeting the definition without registering is not outside the regime; it is violating it, and unlicensed money transmission is a federal crime independent of anything crypto-specific.

The state map

Here the picture fragments completely, and the three groups are genuinely distinct. For whether cryptocurrency itself is legal across these jurisdictions, our legal status page covers the baseline; what follows is the kiosk-specific layer on top.

States with outright bans. Indiana was first, enacting a statewide prohibition on crypto kiosks with its ban taking effect in March 2026. Tennessee followed in July 2026, and Minnesota’s prohibition takes effect in August 2026. Three states, three separate legislative processes, three effective dates inside six months, which is a fast-moving pattern for state legislation and suggests a template propagating between statehouses.

States with licensing and transaction rules. A larger group regulates instead of prohibiting, typically through money transmitter licensing extended to kiosk operators, often with kiosk-specific provisions attached: daily transaction caps, disclosure requirements at the machine, mandatory warning screens, refund windows for defrauded first-time users, and receipt requirements. These regimes vary enough that an operator running machines in ten states faces ten different rule sets.

States with no kiosk-specific oversight at all. Texas is the clearest example and the most consequential, because it also leads the country in reported losses. The state has no regulatory framework governing the machines, no registry of how many operate within its borders, and no agency with responsibility for them. Prosecutors and county sheriffs have been lobbying the legislature directly, and a state representative has signalled plans to introduce a ban when the legislature convenes in 2027. The House Speaker and Lieutenant Governor have issued interim charges directing committees to study kiosk regulation and elder fraud through 2026.

The fraud data

The numbers driving all of this deserve their own treatment, because their trajectory is what moved legislatures.

FBI complaint data recorded 10,956 kiosk-related complaints in 2024 with reported losses of $246.7 million. For 2025 the figures rose to 13,460 complaints and nearly $389 million, an increase of roughly 23% in complaints and 58% in losses. Losses grew considerably faster than complaint volume, which means the average loss per victim increased.

The distribution is concentrated. Texas reported approximately $56.8 million across 1,179 complaints, the highest of any state and roughly twice the second-place total. In San Antonio specifically, nearly 38% of identified victims were 66 or older, and the FBI has reported that two thirds of crypto kiosk fraud victims nationally are over 60.

Two caveats belong with any citation of these figures. They reflect complaints filed, and reporting on this category is understood to be low: victims describe shame and humiliation as reasons for not reporting, which means the real totals are higher by an unknown margin. And a complaint is an allegation, not an adjudicated loss.

The mechanism behind the numbers is consistent across cases. A caller impersonates law enforcement, a government agency, or a bank, manufactures urgency through a fabricated warrant, an arrest threat, or a compromised-account story, and directs the victim to a nearby machine while remaining on the phone. Cash goes in, cryptocurrency goes out to an address the caller controls, and the funds are dispersed and mixed within minutes. Speed and irreversibility are the features being exploited.

The municipal layer

The newest development is local, and it is the layer most likely to expand fastest because it requires no legislature.

San Antonio began requiring bilingual warning signage at its 193 kiosks from July 1, 2026. That is a city ordinance applied to machines within municipal limits, and it illustrates the general form: a local government that cannot ban a category can regulate its presentation, siting, and disclosure through ordinary municipal authority over businesses operating locally.

The instruments available at this level are familiar from other contested industries. Signage and disclosure mandates. Zoning restrictions on where machines may be sited, including distance requirements from schools, senior centres, or check-cashing establishments. Business licensing at the municipal level. Hours of operation. And in some cases outright prohibition within city limits.

The significance for operators is that municipal rules accumulate without any single decision to appeal, and they arrive in the jurisdictions with the most political attention, which correlates with where machines are densest. An operator can be federally registered, state licensed, and still unable to place a machine in a particular city.

The federal bill

One legislative vehicle exists at the federal level and it has not moved.

The Crypto ATM Fraud Prevention Act, designated S.710, was introduced in Congress in 2025. Bills of this kind typically propose transaction limits, mandatory refunds for new customers within a defined window, warning requirements at the point of transaction, and enhanced reporting obligations for operators. It has not been enacted.

The absence matters for a structural reason. Without federal legislation setting a floor, the field is governed by state and municipal action, which produces exactly the fragmentation described above: bans in three states, licensing in many, nothing in others, and city ordinances underneath all of it. A federal standard would preempt some of that variation. Its absence guarantees the variation continues.

The industry under pressure

The commercial context matters because it shapes what enforcement can actually reach.

The kiosk sector has been consolidating under financial stress. A major operator filed for Chapter 11 bankruptcy protection in May 2026 after first-quarter revenue fell roughly 50% year over year, having been sued by the Massachusetts attorney general in February. That combination, falling revenue and state litigation arriving simultaneously, describes an industry whose economics are deteriorating while its legal exposure increases.

Two consequences follow. Enforcement against a bankrupt operator recovers little, which limits restitution as a remedy and pushes states toward prohibition and prevention instead. And consolidation concentrates the remaining machines among fewer operators, which makes compliance easier to supervise in principle and creates a smaller number of larger targets in practice.

The industry’s own position, made in legislative testimony and public comment, is that kiosks serve unbanked and underbanked users who lack alternatives, that operators have implemented warning screens and transaction limits voluntarily, and that prohibition removes a legitimate service to address a fraud problem originating elsewhere. That argument has weight: the fraud is committed by callers, not by machines, and the same impersonation scams collect through gift cards, wire transfers, and cash couriers. What the argument has not overcome is the concentration of elderly victims and the irreversibility of the settlement, which is what legislators keep returning to.

Why the machines exist at all

An honest status page has to explain what the category is for, because a reader arriving from the fraud coverage could reasonably conclude the machines have no legitimate function.

They have one, and it is narrow. A crypto kiosk converts physical cash into digital assets without a bank account, an exchange account, identity verification beyond whatever threshold applies, or a linked payment method. For someone unbanked or underbanked, that is the only route into digital assets that does not require an institution to accept them as a customer first. For someone who holds cash from informal work, it is a conversion path that no exchange offers. And for remittance senders, it is a way to move value across borders that competes on speed with services charging considerably more.

The pricing reflects that convenience and it is steep. Kiosk margins run substantially above exchange spreads, frequently by an order of magnitude, which is why several state regimes require the effective rate to be displayed against a reference price. A user paying that premium is buying immediacy and access, and the question of whether the premium is fair is separate from whether the service is legitimate.

The industry’s argument follows from this: the machines serve people the banking system does not, the fraud is committed by callers rather than by operators, and the same impersonation scams collect through gift cards, wire transfers, and cash couriers that nobody proposes banning. Every element of that is factually correct.

What it has not overcome is the combination this page keeps returning to: an elderly victim concentration, irreversible settlement, and a physical machine in a legislator’s district. Gift card fraud is diffuse and the cards have other uses. A crypto kiosk is a single-purpose device, visible, countable, and attributable, and that visibility is why it has drawn a policy response the larger fraud channels have not.

What operators and users should know

For an operator, the compliance stack has four layers and all of them apply at once.

Federal registration and program obligations, as set out above, which apply in every state including the three with bans, since a ban removes the ability to operate, not the federal status of an operation elsewhere.

State licensing, which in most states means money transmitter licensing with kiosk-specific conditions, and which is an approval process measured in months per state.

Municipal requirements, which are the least documented and the most likely to change without notice.

And the prohibition map, which now covers three states with effective dates already passed or imminent.

For a user, the practical guidance is simpler and worth stating because the fraud pattern is so consistent. No legitimate government agency, court, law enforcement body, utility, or bank will ever direct a payment to a cryptocurrency kiosk. Urgency, secrecy, and a caller who stays on the line while you travel to a machine are the three signals present in nearly every reported case. And a completed kiosk transaction is effectively irreversible, which is precisely why it is the collection method of choice.

How this compares to the wider crypto perimeter

Kiosks occupy an unusual position in American crypto regulation, and setting them against the rest of the map explains why the response has been so much sharper than for anything else.

Most crypto regulation in the United States has moved toward accommodation over the past three years, a shift our executive order page traces from its origin. Securities enforcement shifted from registration theories to fraud, as our SEC page documents. A stablecoin statute created a licensing framework where none existed. Federal bank charters opened to crypto firms. Mining faces no federal restriction, as our mining page records. The direction of travel across those areas has been toward defined rules and permitted activity.

Kiosks have moved the other way, and the reason is the victim profile. Every other category of crypto regulation concerns investors, traders, businesses, or infrastructure, where the participants chose to be there and the harm is financial loss to people who accepted risk. Kiosk fraud harms people who were not participating in crypto at all until a caller frightened them into a grocery store, and a disproportionate share of them are elderly. That distinction moves legislators in a way that trading losses do not.

The second structural difference is physical presence. A crypto exchange is a website that can be geoblocked, licensed, or ignored. A kiosk is a machine bolted to a floor inside a business in someone’s district, which makes it visible to constituents, reachable by municipal authority, and a natural target for a legislator who wants to act locally. That combination of physical siting and identifiable victims is why kiosks have attracted prohibition while categories with far larger dollar volumes have attracted licensing.

The practical implication is that the kiosk debate is unlikely to be resolved by the market-structure legislation that would settle so much else. Even a comprehensive federal crypto statute is unlikely to preempt state authority over machines placed in physical retail locations, because that authority derives from ordinary state and municipal power over commerce and not from anything specific to digital assets.

What the state rules actually require

Beyond the three bans, the regulating states have converged on a recognisable set of instruments, and knowing them is more useful than tracking which statute contains which.

Transaction limits. Daily caps on how much a single customer may transact, frequently tiered so that new customers face a lower ceiling for an initial period. The design targets the fraud pattern directly, since impersonation scams typically extract large sums quickly from someone who has never used a kiosk before.

Refund and cooling-off provisions. Some states require operators to refund a defrauded first-time customer who reports within a defined window, which shifts part of the loss from the victim to the operator and creates a commercial incentive to prevent the transaction. This is the most operator-adverse instrument in use and the one the industry has resisted most.

Disclosure at the machine. Mandatory on-screen warnings before a transaction completes, receipt requirements, and fee disclosure. Fee transparency matters independently: kiosk margins are substantially higher than exchange spreads, and several regimes require the effective rate to be shown against a reference price.

Customer identification thresholds. Requirements to collect and verify identity above specified amounts, which is layered on top of the federal obligations rather than replacing them.

Licensing and registration. Money transmitter licensing extended to kiosk operators, in some states with kiosk-specific endorsements, surety bond requirements scaled to machine count, and reporting of machine locations to the state regulator.

The variation between states is real but narrower than the count of statutes suggests. An operator building to the strictest regime it faces will generally satisfy most others, which is the ordinary pattern in multi-state compliance and the reason the three bans matter more than the licensing differences: a licence can be obtained, and a prohibition cannot.

The enforcement record

Rules matter less than what happens when they are broken, and the enforcement picture here has three distinct threads.

State attorney general actions. At least one major operator has faced suit from a state attorney general, in that case Massachusetts in February 2026, on consumer protection grounds. Attorney general actions in this category typically allege unfair or deceptive practices around fee disclosure, failure to prevent foreseeable fraud, or operating without required licensing, and they seek restitution, penalties, and injunctive relief.

Federal money transmission prosecutions. Operating a kiosk business without required registration and licensing is prosecutable as unlicensed money transmission, a federal crime carrying substantial exposure independent of any crypto-specific statute. That charge does not require proving the operator knew about the fraud; it requires proving the business operated without the required registrations.

And the fraud prosecutions themselves, which target the callers rather than the operators. These are the cases that recover money for victims when they succeed, and they succeed rarely, because the perpetrators are frequently overseas, the funds disperse within minutes, and the victim’s own transaction was voluntary in the mechanical sense.

That last point explains why prevention has dominated the policy response. Prosecuting the fraud is slow and rarely recovers funds. Regulating or removing the collection point is fast and does not require finding anyone. Legislatures facing constituent losses have consistently chosen the second, which is why three states have banned the machines outright while the underlying scams continue through other channels.

What to watch

Whether the ban template spreads. Three states in six months is a pattern. Watch for bills modelled on the Indiana, Tennessee, or Minnesota statutes appearing in other legislatures, which is the fastest route to broad prohibition.

Texas in 2027. The largest loss total in the country combined with zero oversight and a signalled ban bill makes Texas the most consequential single jurisdiction. Interim charges through 2026 are the groundwork.

S.710 or a successor. Federal legislation setting a floor would change the fragmentation described here. Its continued absence guarantees the state-by-state pattern continues.

Municipal ordinance activity. The layer that expands fastest and is documented least. Signage, siting, and licensing requirements in major cities are the leading indicator of where the industry gets squeezed next.

Whether the 2026 FBI figures accelerate. The 2024 to 2025 increase was 58% in losses. Another year at that rate would put reported losses above half a billion dollars and would make prohibition considerably harder to argue against.

A closing observation about where this category is heading, because the trajectory is clearer here than in most areas this hub covers.

Three states banned the machines within six months of one another. A fourth, with the largest reported losses in the country, has a ban bill signalled and interim study charges already issued. Municipal ordinances are appearing in major cities. The federal bill has not moved and no federal floor exists to preempt any of it. And the loss figures rose 58% in a single year against a victim population that legislators find unusually sympathetic.

Against that, the industry is consolidating under financial pressure, with a major operator in Chapter 11 after revenue halved and state litigation arriving simultaneously. An industry losing money and losing legislative arguments at the same time does not usually reverse either trend.

The reasonable expectation is therefore continued fragmentation trending toward restriction: more bans, more licensing conditions in the states that regulate, more municipal ordinances, and a shrinking installed base. What would change that trajectory is a federal statute setting a workable national standard with preemptive effect, which is what the industry has been asking for and which S.710 has not delivered.

For anyone tracking this, the useful indicator is not the loss figures, which are lagging and reported annually. It is the appearance of ban bills modelled on the three enacted statutes in additional legislatures, which is a leading indicator visible in real time through legislative tracking, and which will tell you whether the template is spreading before the next FBI release confirms why.