Florida has turned crypto ATM rip-off prevention right into a business-liability take a look at for kiosk operators.
The state’s newly chaptered HB 505, now Chapter 2026-178, creates a digital foreign money kiosk framework that may require fraud warnings, receipts, every day transaction caps, registration filings, and a conditional refund proper for fraud victims.
The timing issues. A lot of the act takes impact Jan. 1, 2027, whereas the part requiring digital foreign money kiosk companies to register earlier than working begins March 1, 2027.
That staged rollout offers operators time to arrange whereas setting a transparent enforcement path for regulators. Florida is assigning kiosk companies particular duties earlier than, throughout, and after a transaction.
Probably the most consequential piece is the refund provision. As soon as the related provisions take impact, a kiosk enterprise should problem a full refund inside 72 hours for a buyer’s first digital foreign money kiosk transaction if the shopper studies the alleged fraud to the enterprise and to regulation enforcement or a governmental company inside 60 days and supplies proof, corresponding to a police report or notarized affidavit.
The result’s a state-level take a look at of whether or not crypto ATM fraud controls might be constructed into the economics of the kiosk enterprise itself.
Fraud controls change into working guidelines
Florida’s Workplace of Monetary Regulation had already described the hole that HB 505 now addresses. In a December 2024 statute evaluate, OFR mentioned Florida had 26 identified digital foreign money kiosk suppliers, solely 9 of which had been licensed as cash transmitters.
It additionally mentioned peer-to-peer, two-party kiosk operators weren’t required to carry a Florida money-transmitter license except they acted as intermediaries.
That distinction created a sensible regulatory drawback. Some kiosk operators may sit exterior abnormal money-transmitter licensing whereas nonetheless providing machines that flip money into irreversible crypto transfers.
OFR pointed to client notifications as one prevention instrument, together with US Secret Service warning indicators posted round lots of of Central Florida kiosks. It then raised the likelihood that kiosk operators themselves may very well be required by regulation to submit disclosures even when their exercise didn’t require a money-transmitter license.
HB 505 takes that logic additional. It hyperlinks the warning to transaction caps, receipts, registration data, compliance data, and refund documentation, all of which might be checked later.
The regulation’s construction turns a number of consumer-protection concepts into working necessities. Operators might want to handle the shopper expertise earlier than the transaction begins, hold data after it ends, and doc compliance for renewal or inactive-registration eventualities.
| Requirement | Core rule | Timing | Operational impact |
|---|---|---|---|
| Every day caps | $2,000 per day for brand new prospects and $10,000 per day for current prospects, throughout a number of transactions or kiosks | Normal efficient date Jan. 1, 2027 | Limits how a lot a scammer can push by way of one buyer in a day |
| Fraud warning and same-day query | Kiosk should ask about same-day transactions at different kiosks and show a conspicuous warning earlier than the transaction begins | Normal efficient date Jan. 1, 2027 | Makes the operator a part of the pre-transaction fraud-control course of |
| Receipt | Buyer have to be provided a bodily or digital receipt with enterprise contact particulars, quantity, transaction hash, wallets, charges, trade price if relevant, legal responsibility assertion if any, and refund coverage | Normal efficient date Jan. 1, 2027 | Creates a transaction path for victims, operators, and regulation enforcement |
| Refund | Full refund inside 72 hours for the shopper’s first digital foreign money kiosk transaction if the shopper meets the 60-day discover and proof circumstances | Normal efficient date Jan. 1, 2027 | Strikes some first-loss publicity from the sufferer towards the kiosk enterprise |
| Registration | Kiosk companies should register or renew registration earlier than working, with licensed cash transmitters exempt from separate kiosk registration however nonetheless topic to core working guidelines | Registration-required part efficient March 1, 2027 | Provides OFR a gatekeeping and renewal mechanism for kiosk companies |
The registration timeline is staged. A digital foreign money kiosk enterprise already working in Florida on or earlier than Jan. 1, 2027, should submit a registration software to OFR inside 30 days after that date.
The precise statutory part requiring registration earlier than operation takes impact March 1, 2027.
The patron hurt information explains why lawmakers moved in that route. The FBI’s Web Crime Grievance Heart mentioned Florida recorded 1,213 complaints involving cryptocurrency kiosks in 2025 and $32.8 million in adjusted losses.
Nationally, IC3 listed 13,460 complaints and almost $389 million in adjusted losses, whereas cautioning that these complaints could contain different transaction varieties utilized in scams involving kiosks.
AARP Florida individually mentioned in February that the state had greater than 3,100 crypto ATMs and greater than $33 million in reported crypto ATM-facilitated fraud and rip-off losses over 5 years.
The refund proper has strict limits
The refund provision is essentially the most vital coverage shift as a result of it adjustments who bears the rapid value of a fraudulent kiosk transaction.
A public warning leaves the sufferer with the loss if the warning fails. A refund responsibility forces the operator to cost, forestall, or handle a minimum of a few of that threat.
The proper has outlined boundaries. It applies to the shopper’s first digital foreign money kiosk transaction. The shopper should notify each the kiosk enterprise and a regulation enforcement or governmental company inside 60 days.
The shopper should additionally present proof of the alleged fraud, corresponding to a police report or notarized affidavit. The enterprise then has 72 hours to problem the total refund.
That construction is more likely to have an effect on operations. Operators may have clearer onboarding data to find out whether or not a buyer is new or current.
They could want methods that monitor same-day exercise throughout their very own machines. They could want customer-service processes for fraud studies and refund requests.
They could additionally want to keep up data exhibiting refunds had been supplied in required circumstances, as a result of the regulation permits OFR to request proof of compliance throughout renewal or inactive-registration processes.
The caps create a second strain level. A $2,000 every day cap for brand new prospects immediately targets the primary days of a buyer relationship, when a rip-off sufferer could also be most weak and when an operator has the least historical past with that particular person.
The $10,000 cap for current prospects leaves extra room for official use, however it nonetheless locations an outer restrict on a buyer’s every day kiosk quantity.
For operators, that could be a income constraint on high-dollar transactions and a compliance value round monitoring, disclosures, receipts, and refunds.
Florida’s framework lands as federal lawmakers are additionally taking a look at crypto ATM scams. On June 11, Reps. Sean Casten and Maria Elvira Salazar launched the Cease Crypto ATM Scams Act, a federal proposal that features every day transaction limits, warnings, receipts, anti-fraud measures, and refunds of fees collected on fraudulent transactions.
The proposal additionally says states ought to retain authority to impose stronger client protections, together with full refunds for defrauded prospects.
That federal proposal shouldn’t be regulation. Nonetheless, it reveals why Florida’s mannequin may matter past Florida.
The controversy is transferring away from whether or not crypto ATM customers must be warned and towards how a lot duty operators ought to carry when the machines change into a part of fraud workflows.
Florida’s regulation solutions with a hybrid mannequin. It retains kiosks authorized whereas making entry conditional on documented fraud controls.
Licensed cash transmitters are exempt from separate kiosk registration, but they continue to be topic to the identical key working guidelines round disclosures, transaction limits, receipts, and refunds.
That makes the regulation greater than an area client warning. It’s a blueprint for making kiosk entry conditional on documented fraud controls.
The sensible take a look at will are available in 2027. If operators take up the necessities with out pulling again from Florida, the mannequin may look exportable to different states in search of a center path between outright bans and public training campaigns.
If operators scale back kiosk availability, increase prices, or tighten buyer screening, the regulation should still journey, however as a clearer trade-off: much less frictionless entry in trade for much less unchecked publicity to fraud.
Both manner, Florida has modified the coverage query. The difficulty is whether or not kiosk companies must be required to sluggish, doc, cap, and in some circumstances refund the transaction when the warning fails.
