Crypto ATM / kiosk operator in United States
Physical kiosks that exchange cash for crypto (and sometimes vice versa). High-cash AML risk profile.
Crypto ATM is conditionally permitted in United States with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- MSB registration with FinCEN (Form 107) under the Bank Secrecy Act — immediate requirement for any crypto kiosk operator
- State Money Transmitter Licenses (MTLs) in each state of operation — 49 states + DC required (Montana exempt); 18-36 months and $2M-$10M+ in bonds/fees for national coverage
- NY BitLicense (23 NYCRR Part 200) required for New York customers — 12-24+ month application process, $2M+ capital requirement
- California DFAL license required from DFPI for CA operations (effective July 1, 2026) — $100k/day penalties for non-compliance
- Cash Transaction Reports (CTRs) for cash-in/cash-out transactions over $10,000 in a business day
- Suspicious Activity Reports (SARs) for any suspicious transaction regardless of amount
- Travel Rule compliance for transactions over $3,000 — collection and transmission of originator/beneficiary information
- OFAC sanctions screening required for all transactions — mandatory blocking of OFAC-listed entities and jurisdictions
- Mandatory background checks for kiosk security measures
- Automated transaction monitoring systems required for cash-to-crypto conversion patterns
Key Restrictions
- Must register as a Money Services Business (MSB) with FinCEN immediately upon commencement
- Must obtain state MTL in each state where kiosks are physically located — no single national license exists
- NY operation requires BitLicense (separate from standard MTL), which is a 12-24+ month process
- Must geofence to comply with state-by-state licensing; cannot serve states where MTL not yet obtained
- Digital asset kiosks must follow strict security measures including mandatory background checks
- Cash-in limits and daily transaction caps may be imposed by state regulators on a per-kiosk basis
- Cannot offer crypto-to-crypto-only kiosk services without cash fiat on-ramp without potential additional securities/commodities considerations
- Tokens offered through kiosk must not be securities under the Howey Test (SEC jurisdiction) — operator must conduct token-by-token legal analysis
Key Risks
- High enforcement risk from FinCEN and state regulators for failure to obtain proper MTLs or BitLicense
- Criminal enforcement risk (DOJ) if AML/BSA compliance gaps are identified — money laundering, unlicensed money transmission
- State-by-state licensing patchwork creates significant operational complexity and regulatory exposure for multi-state operations
- New Jersey and other states actively auditing crypto income reporting and using automated tools to detect mismatches
- Consumer fraud exposure — $435M in crypto scam losses in NJ alone (2024) drives political pressure for stricter kiosk regulation
- CFTC and SEC secondary liability risk if kiosk facilitates trading in tokens classified as commodities derivatives or securities
- Executive Order 14390 targeting foreign scam centers increases scrutiny on cash-to-crypto channels
- Public and media perception risk — kiosks associated with scams targeting vulnerable populations
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
VASP: FinCEN MSB registration (immediate, Form 107) + state Money Transmitter Licenses in 49 states + DC (18-36 months for full coverage, $2M-$10M+ in bonds/fees). Montana is sole exemption.
FinCEN — Treasury bureau (31 U.S.C. 310) that administers the Bank Secrecy Act: MSB registration on Form 107 within 180 days of establishment and every two years (31 CFR 1022.380), and the funds-transfer recordkeeping and travel rule for transmittals of $3,000 or more (31 CFR 1010.410(e)-(f)).
Bank Secrecy Act (Public Law 91-508, 1970; codified at 31 U.S.C. 5311 et seq.) is the federal AML/CFT statute. It requires reports and records useful in criminal, tax and regulatory investigations and requires money transmitting businesses to register with Treasury (31 U.S.C. 5330), implemented by FinCEN Form 107 within 180 days of establishment and renewal every two years (31 CFR 1022.380).
New York BitLicense (23 NYCRR Part 200) (2015) — NY-specific virtual currency business licensing
California DFAL (2025) — Digital Financial Assets Law — state crypto licensing
Financial Crimes Enforcement Network (FinCEN): administers the Bank Secrecy Act AML/CFT regime. Under FIN-2013-G001 (18 March 2013) an administrator or exchanger of convertible virtual currency is a money transmitter and therefore a money services business; FIN-2019-G001 (9 May 2019) consolidates that guidance and applies it to further CVC business models. Each MSB must register with FinCEN on Form 107 within 180 days of establishment and renew every two years (31 CFR 1022.380).
State regulators: Examples include California's DFPI (Digital Financial Assets Law effective July 1, 2026, requiring licenses with $100k/day penalties); New Jersey Department of Banking and Insurance; New York's NYDFS (BitLicense regime); Connecticut (money transmitter laws).
Digital asset kiosks now must follow strict security measures, including mandatory background checks
On 18 June 2025 the U.S. Department of Justice filed a civil forfeiture complaint in the U.S. District Court for the District of Columbia against more than $225.3 million in cryptocurrency that it alleges was laundered through a blockchain-based network dispersing proceeds of cryptocurrency investment-fraud ("confidence scam") schemes.
New Jersey residents lost $435 million to cryptocurrency scams in 2024, ranking the state sixth among all states for total crypto fraud losses
Executive Order 14390, "Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens", signed by the President on 6 March 2026 and published at 91 FR 12051 (11 March 2026), directs State, Treasury, War, Justice and Homeland Security to review their frameworks within 60 days and, within 120 days, submit an action plan identifying the transnational criminal organizations responsible for scam centers and cybercrime.
The New Jersey Division of Taxation uses automated tools to identify mismatches between reported cryptocurrency income and federal 1099 forms
The SAFE Crypto Act (Strengthening Agency Frameworks for Enforcement of Cryptocurrency Act, S. 3428, 119th Congress), which would establish a Task Force for Recognizing and Averting Cryptocurrency Scams, was introduced on 10 December 2025 by Sen. Jerry Moran with Sen. Elissa Slotkin as original cosponsor and referred to the Senate Banking Committee; it has not advanced beyond committee referral as of 14 October 2026.
OFAC — administers U.S. economic sanctions, which apply to virtual currency transactions; on 15 October 2021 it published 'Sanctions Compliance Guidance for the Virtual Currency Industry'.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — Crypto ATM / kiosk operators may operate in the US but must obtain FinCEN MSB registration immediately, secure state Money Transmitter Licenses in each state of operation (49 states + DC), obtain NY BitLicense for New York operations and California DFAL license for CA, implement CTR/SAR/Travel Rule/OFAC compliance, and adhere to mandatory kiosk security and background check requirements.
Questions this verdict aims to answer
- What money-transmitter / kiosk-specific license is required?
- What cash-transaction reporting thresholds apply?
- What enhanced-KYC obligations attach to cash-in / cash-out?