Florida has turned crypto ATM scam prevention into a business-liability test for kiosk operators.
The state’s newly chaptered HB 505, now Chapter 2026-178, creates a virtual currency kiosk framework that will require fraud warnings, receipts, daily transaction caps, registration filings, and a conditional refund right for fraud victims.
The timing matters. Most of the act takes effect Jan. 1, 2027, while the section requiring virtual currency kiosk businesses to register before operating starts March 1, 2027.
That staged rollout gives operators time to prepare while setting a clear enforcement path for regulators. Florida is assigning kiosk businesses specific duties before, during, and after a transaction.
The most consequential piece is the refund provision. Once the relevant provisions take effect, a kiosk business must issue a full refund within 72 hours for a customer’s first virtual currency kiosk transaction if the customer reports the alleged fraud to the business and to law enforcement or a governmental agency within 60 days and provides proof, such as a police report or notarized affidavit.
The result is a state-level test of whether crypto ATM fraud controls can be built into the economics of the kiosk business itself.
Fraud controls become operating rules
Florida’s Office of Financial Regulation had already described the gap that HB 505 now addresses. In a December 2024 statute review, OFR said Florida had 26 known virtual currency kiosk providers, only nine of which were licensed as money transmitters.
It also said peer-to-peer, two-party kiosk operators were not required to hold a Florida money-transmitter license unless they acted as intermediaries.
That distinction created a practical regulatory problem. Some kiosk operators could sit outside ordinary money-transmitter licensing while still offering machines that turn cash into irreversible crypto transfers.
OFR pointed to consumer notifications as one prevention tool, including US Secret Service warning signs posted around hundreds of Central Florida kiosks. It then raised the possibility that kiosk operators themselves could be required by law to post disclosures even when their activity did not require a money-transmitter license.
HB 505 takes that logic further. It links the warning to transaction caps, receipts, registration information, compliance records, and refund documentation, all of which can be checked later.
The law’s structure turns several consumer-protection ideas into operating requirements. Operators will need to manage the customer experience before the transaction begins, keep records after it ends, and document compliance for renewal or inactive-registration scenarios.
| Requirement | Core rule | Timing | Operational effect |
|---|---|---|---|
| Daily caps | $2,000 per day for new customers and $10,000 per day for existing customers, across one or more transactions or kiosks | General effective date Jan. 1, 2027 | Limits how much a scammer can push through one customer in a day |
| Fraud warning and same-day question | Kiosk must ask about same-day transactions at other kiosks and display a conspicuous warning before the transaction begins | General effective date Jan. 1, 2027 | Makes the operator part of the pre-transaction fraud-control process |
| Receipt | Customer must be offered a physical or electronic receipt with business contact details, amount, transaction hash, wallets, fees, exchange rate if applicable, liability statement if any, and refund policy | General effective date Jan. 1, 2027 | Creates a transaction trail for victims, operators, and law enforcement |
| Refund | Full refund within 72 hours for the customer’s first virtual currency kiosk transaction if the customer meets the 60-day notice and proof conditions | General effective date Jan. 1, 2027 | Moves some first-loss exposure from the victim toward the kiosk business |
| Registration | Kiosk businesses must register or renew registration before operating, with licensed money transmitters exempt from separate kiosk registration but still subject to core operating rules | Registration-required section effective March 1, 2027 | Gives OFR a gatekeeping and renewal mechanism for kiosk businesses |
The registration timeline is staged. A virtual currency kiosk business already operating in Florida on or before Jan. 1, 2027, must submit a registration application to OFR within 30 days after that date.
The actual statutory section requiring registration before operation takes effect March 1, 2027.
The consumer harm data explains why lawmakers moved in that direction. The FBI’s Internet Crime Complaint Center said Florida recorded 1,213 complaints involving cryptocurrency kiosks in 2025 and $32.8 million in adjusted losses.
Nationally, IC3 listed 13,460 complaints and nearly $389 million in adjusted losses, while cautioning that these complaints may involve other transaction types used in scams involving kiosks.
AARP Florida separately said in February that the state had more than 3,100 crypto ATMs and more than $33 million in reported crypto ATM-facilitated fraud and scam losses over five years.
The refund right has strict limits
The refund provision is the most significant policy shift because it changes who bears the immediate cost of a fraudulent kiosk transaction.
A public warning leaves the victim with the loss if the warning fails. A refund duty forces the operator to price, prevent, or manage at least some of that risk.
The right has defined boundaries. It applies to the customer’s first virtual currency kiosk transaction. The customer must notify both the kiosk business and a law enforcement or governmental agency within 60 days.
The customer must also provide proof of the alleged fraud, such as a police report or notarized affidavit. The business then has 72 hours to issue the full refund.
That structure is likely to affect operations. Operators may need clearer onboarding records to determine whether a customer is new or existing.
They may need systems that track same-day activity across their own machines. They may need customer-service processes for fraud reports and refund requests.
They may also need to maintain records showing refunds were provided in required circumstances, because the law allows OFR to request evidence of compliance during renewal or inactive-registration processes.
The caps create a second pressure point. A $2,000 daily cap for new customers directly targets the first days of a customer relationship, when a scam victim may be most vulnerable and when an operator has the least history with that person.
The $10,000 cap for existing customers leaves more room for legitimate use, but it still places an outer limit on a customer’s daily kiosk volume.
For operators, that is a revenue constraint on high-dollar transactions and a compliance cost around tracking, disclosures, receipts, and refunds.
Florida’s framework lands as federal lawmakers are also looking at crypto ATM scams. On June 11, Reps. Sean Casten and Maria Elvira Salazar introduced the Stop Crypto ATM Scams Act, a federal proposal that includes daily transaction limits, warnings, receipts, anti-fraud measures, and refunds of charges collected on fraudulent transactions.
The proposal also says states should retain authority to impose stronger consumer protections, including full refunds for defrauded customers.
That federal proposal is not law. Still, it shows why Florida’s model could matter beyond Florida.
The debate is moving away from whether crypto ATM users should be warned and toward how much responsibility operators should carry when the machines become part of fraud workflows.
Florida’s law answers with a hybrid model. It keeps kiosks legal while making access conditional on documented fraud controls.
Licensed money transmitters are exempt from separate kiosk registration, yet they remain subject to the same key operating rules around disclosures, transaction limits, receipts, and refunds.
That makes the law more than a local consumer warning. It is a blueprint for making kiosk access conditional on documented fraud controls.
The practical test will come in 2027. If operators absorb the requirements without pulling back from Florida, the model could look exportable to other states seeking a middle path between outright bans and public education campaigns.
If operators reduce kiosk availability, raise costs, or tighten customer screening, the law may still travel, but as a clearer trade-off: less frictionless access in exchange for less unchecked exposure to fraud.
Either way, Florida has changed the policy question. The issue is whether kiosk businesses should be required to slow, document, cap, and in some cases refund the transaction when the warning fails.
