Crypto ATM Regulations by State and Wallet Screening Software

This guide is for compliance officers, BSA officers and founders at US Bitcoin ATM and crypto kiosk operators, from a 20-machine regional network to a national fleet. If your machines sit in more than one state, you are now running several rulebooks at once, and the newest rules ask you to make a judgment about the destination wallet before the cash goes in.

We sell Bitcoin on-chain data, so weigh our view accordingly. The state rules below were read from the enacted bill text or the state code wherever the legislature published it, and we flag the one row that rests on a secondary source. Where a blockchain analytics vendor or your kiosk software does part of the job better than we do, we say so.

Crypto ATM regulations by state

The pattern is now clear. States define a "new customer" by days since the first transaction, give that customer a lower daily cap, cap the markup, and make the operator refund fraud victims who report quickly. The column that matters most for your software budget is the last one.

"New" is not one definition. Arizona counts a customer as new for 10 days, Colorado for 7, Nebraska for 14, and Connecticut until the third transaction or 72 hours. Your kiosk software has to know which clock applies at which machine, which is a configuration problem before it is a data problem.

Refund duties are where the money goes. Arizona refunds a new customer in full, fees included, if the operator and police or the attorney general hear about the fraud within 30 days. Illinois refunds up to three transactions for a new customer. Maine reaches back 90 days. Louisiana adds a 72-hour hold. Every one of those claims will start with a transaction id and a wallet address, so the evidence you keep at send time decides how fast you can close it.

Which states ban crypto ATMs?

Two states have moved from rules to a ban. Minnesota's ban took effect on 1 August 2026, with machines to be removed by 31 December 2026, and it repeals the 2024 kiosk section. Vermont's ban took effect on 1 July 2026. At city level, Spokane passed an ordinance in June 2025 that gave operators 60 days to remove kiosks, and the St. Paul council voted for a ban in November 2025. If you are deciding where to place the next 50 machines, those are the places not to.

Do bitcoin ATMs require KYC?

Yes. FinCEN treats kiosk operators as money services businesses, so they register with FinCEN, run an anti-money laundering program and file suspicious activity reports. FinCEN's notice FIN-2025-NTC1 of 4 August 2025 asks filers to use the key term FIN-2025-CVCKIOSK and says blockchain analytics can help, without making it a federal rule. The state caps also assume you can recognize a returning customer, which means identity at every tier.

What "block wallets affiliated with fraud" means in practice

The statutes are short on method. Arizona says the operator must use blockchain analytics and tracing software to stop sending to a wallet known to be affiliated with fraud. Connecticut asks for third-party blockchain analyses that block high-risk or sanctioned wallets, the ability to block designated wallets, and one wallet per customer. Read together, that is three different checks, and they fail in different ways.

Sanctions lists catch almost nothing at a kiosk. The OFAC SDN file published on 4 September 2026 carried 532 unique Bitcoin addresses, and when we read 531 of them at block 965,562 only 87 still held a balance. None was a Taproot address. A scammer coaching a victim to a machine is not using an address on that list.

Most destination addresses are brand new. We took block 969,996, mined at 10:23 UTC on 5 October 2026 with 4,328 transactions, listed its 9,419 addressed outputs that were not the miner's reward (7,251 distinct addresses), and looked up the full history of 300 chosen at random. 96 of them, 32 percent, had no transaction before that block and none after it: the block was their first appearance on the chain. That is a floor, because an address that was new in the block and spent within the hour shows two transactions and is not counted. At the other end, 25 of the 300 had more than 1,000 transactions each, the hot wallets of exchanges and services. A list of known bad addresses can only ever match the old ones.

So the useful pre-send signals are about history, not reputation. Has this address ever been seen before? How many transactions has it had, and when was the first one? Is it the same wallet this customer used last time, as Connecticut's one-wallet rule expects? Did coins sent to it last week move onward within minutes? Those questions are answered from the chain itself, cheaply, before the customer feeds in cash. Attribution, meaning "this cluster belongs to a known scam operation", is a different product, and the large analytics vendors are better at it than anyone building from public data.

Bitcoin ATM compliance software compared

For most operators the honest answer is two products, not one. Keep the attribution vendor for the "known to be affiliated with fraud" test, and add a cheap, fast history check of your own so that every send leaves a record you control. One call to the Bitcoin address lookup endpoint returns first_seen, last_seen, tx_count and the current balance for 1 credit, which at 500,000 credits on the $49 Developer plan covers any realistic kiosk volume.

How refunds change the data you need to keep

A refund claim arrives weeks after the send. By then you need to show what the customer paid, which transaction carried it, the block it confirmed in, and where the coins went next. Your kiosk log has the first part. The chain has the rest, and pulling it per claim is slow if every investigator does it by hand in a block explorer.

Two habits shorten that work. Store the destination address's history snapshot at send time, so you can later prove what you knew when you approved it. And put every destination address on a watch list for a few days: a Bitcoin webhook API tells you when coins leave, which is the pattern that turns a single complaint into a pattern you can report. When a claim needs the onward path, transaction tracing follows the outputs hop by hop.

Placement is regulated too. The host agreements you sign with each convenience store or gas station now need clauses for state warning signage, machine removal in banned jurisdictions and access for examiners, and a contract management system that tracks renewal and termination dates across hundreds of locations saves a scramble every time a city votes on a ban.

What should a kiosk operator look for in wallet screening software?

1. Per-state rules in one place. Limits, the "new customer" clock, holds and refund windows differ by state, and the software at the machine has to apply the right set.
2. Attribution you can cite. If a statute requires blocking wallets affiliated with fraud, your examiner will ask which source you used. A named vendor and a dated result is a defensible answer.
3. History checks under a second. A customer at a machine will not wait. Address age and transaction count should come back faster than the bill validator.
4. A record you own. Store each check with the block height it was read at, so a refund review months later can be re-performed.
5. Monitoring after the send. Coins that leave a fresh destination within minutes are a common scam pattern, and only a watch on that address catches it.
6. Published pricing. Kiosk margins are capped by statute in most of these states, so per-check cost matters more than it does for an exchange.

For the sanctions side specifically, our guide to the Bitcoin sanctions screening API for fintech compliance explains why the OFAC CSV file misses about half of the listed addresses and how to read the XML instead. For the monitoring side, crypto transaction monitoring covers alert rules on watched addresses.

BitcoinDatabase provides informational on-chain data only. It is not legal advice, and kiosk laws change often: the state rules above were read from enacted text published by each legislature or regulator, except New Hampshire, which rests on a reported copy of the passed bill. Confirm current requirements with each state regulator or counsel before you change limits or screening rules.