S710-119

1. Short title This Act may be cited as the Crypto ATM Fraud Prevention Act of 2025.

2. Registration with the Secretary of the Treasury Section 5330 of title 31, United States Code, is amended— in subsection (d)— in paragraph (1)(A), by inserting , any person who owns, operates, or manages a virtual currency kiosk in the United States or its territories, after similar instruments; and by adding at the end the following: The terms virtual currency, virtual currency address, virtual currency kiosk, and virtual currency kiosk operator have the meanings given those terms, respectively, in section 5337. by adding at the end the following: Not later than 90 days after the effective date of this subsection, and not less than once every 90 days thereafter, the Secretary of the Treasury shall require virtual currency kiosk operators to submit an updated list containing the physical address of each virtual currency kiosk owned or operated by the virtual currency kiosk operator. Each submission by a virtual currency kiosk operator pursuant to paragraph (1) shall include— the legal name of the virtual currency kiosk operator; any fictitious or trade name of the virtual currency kiosk operator; the physical address of each virtual currency kiosk owned, operated, or managed by the virtual currency kiosk operator that is located in the United States or the territories of the United States; the start date of operation of each virtual currency kiosk; the end date of operation of each virtual currency kiosk, if applicable; and each virtual currency address used by the virtual currency kiosk operator. The filing of false or materially incomplete information in a submission required under paragraph (1) shall be deemed a failure to comply with the requirements of this subsection. (3)Virtual currency; virtual currency address; virtual currency kiosk; virtual currency kiosk operatorThe terms virtual currency, virtual currency address, virtual currency kiosk, and virtual currency kiosk operator have the meanings given those terms, respectively, in section 5337.; and (f)Registration of virtual currency kiosk locations(1)In generalNot later than 90 days after the effective date of this subsection, and not less than once every 90 days thereafter, the Secretary of the Treasury shall require virtual currency kiosk operators to submit an updated list containing the physical address of each virtual currency kiosk owned or operated by the virtual currency kiosk operator.(2)Form and manner of registrationEach submission by a virtual currency kiosk operator pursuant to paragraph (1) shall include—(A)the legal name of the virtual currency kiosk operator;(B)any fictitious or trade name of the virtual currency kiosk operator;(C)the physical address of each virtual currency kiosk owned, operated, or managed by the virtual currency kiosk operator that is located in the United States or the territories of the United States;(D)the start date of operation of each virtual currency kiosk;(E)the end date of operation of each virtual currency kiosk, if applicable; and(F)each virtual currency address used by the virtual currency kiosk operator.(3)False and incomplete informationThe filing of false or materially incomplete information in a submission required under paragraph (1) shall be deemed a failure to comply with the requirements of this subsection..

3. Preventing fraudulent transactions at virtual currency kiosks Subchapter II of Chapter 53 of Title 31, United States Code, is amended by adding at the end the following: In this section: The term blockchain analytics means the analysis of data from blockchains or public distributed ledgers, and associated transaction information, to provide risk-specific information about virtual currency transactions and virtual currency addresses. The term customer means any person that purchases or sells virtual currency through a virtual currency kiosk. The term existing customer means a customer other than a new customer. The term FinCEN means the Financial Crimes Enforcement Network of the Department of the Treasury. The term new customer, with respect to a virtual currency kiosk operator, means a customer during the 14-day period beginning on the date of the first virtual currency kiosk transaction of the customer with the virtual currency kiosk operator. The term transaction hash means a unique identifier made up of a string of characters that act as a record of and provide proof that a transaction was verified and added to the blockchain. The term virtual currency means any digital representation of value that is recorded on a cryptographically secured distributed ledger or any similar technology or another implementation, which was designed and built as part of a system to leverage or replace blockchain, distributed ledger technology, or their derivatives. The term virtual currency address means an alphanumeric identifier associated with a virtual currency wallet identifying the location to which virtual currency purchased through a virtual currency kiosk can be sent or from which virtual currency sold through a virtual currency kiosk can be accessed. The term virtual currency kiosk means a stand-alone machine that is capable of accepting or dispensing legal tender in exchange for virtual currency. The term virtual currency kiosk operator means a person who owns, operates, or manages a virtual currency kiosk located in the United States or its territories. The term virtual currency kiosk transaction means the purchase or sale of virtual currency via a virtual currency kiosk. The term virtual currency wallet means a software application or other mechanism providing a means for holding, storing, and transferring virtual currency. Before entering into a virtual currency transaction with a customer, a virtual currency kiosk operator shall disclose in a clear, conspicuous, and easily readable manner— all relevant terms and conditions of the virtual currency kiosk transaction, including— the amount of the virtual currency kiosk transaction; the type and nature of the virtual currency kiosk transaction; a warning that the virtual currency kiosk transaction is final, is not refundable, and may not be reversed; and the type and amount of any fees or other expenses paid by the customer; a warning relating to consumer fraud including— a warning that consumer fraud often starts with contact from a stranger, and that the customer should never send money to someone they do not know; a warning about the most common types of fraudulent schemes involving virtual currency kiosks, such as— impersonation of a government official or a bank representative; threats of jail time or financial penalties; offers of a job or reward in exchange for payment, or offers of deals that seem too good to be true; claims of a frozen bank account or credit card; or requests for donations to charity or disaster relief; and a statement that the customer should contact the virtual currency kiosk operator’s customer service helpline or State or local law enforcement if they suspect fraudulent activity. Each time a customer uses a virtual currency kiosk, the virtual currency kiosk operator shall ensure acknowledgment of all disclosures required under subsection (b) via confirmation of consent of the customer at the virtual currency kiosk. Upon completion of each virtual currency kiosk transaction, the virtual currency kiosk operator shall provide the customer with a receipt, which shall include the following information: The name and contact information of the virtual currency kiosk operator, including a telephone number for a customer service helpline. The name of the customer. The type, value, date, and precise time of the virtual currency kiosk transaction, transaction hash, and each applicable virtual currency address. The amount of the virtual currency kiosk transaction expressed in United States dollars. All fees charged. A statement that the customer may be entitled by law to a refund if the customer reports fraudulent activity in conjunction with the virtual currency kiosk transaction not later than 30 days after the date of the virtual currency kiosk transaction. The refund policy of the virtual currency kiosk operator or a Uniform Resource Locator where the refund policy of the virtual currency kiosk operator can be found. A statement that the customer should contact law enforcement if they suspect fraudulent activity, such as scams, including contact information for a relevant law enforcement or government agency. Any additional information the virtual currency kiosk operator determines appropriate. Not later than 1 year after the effective date of this section, each receipt required under subsection (d) shall be issued to the customer as a physical receipt at the virtual currency kiosk at the time of the virtual currency kiosk transaction, but such receipt may also be provided in additional forms or communications. Each virtual currency kiosk operator shall take reasonable steps to detect and prevent fraud, including establishing and maintaining a written anti-fraud policy that includes— the identification and assessment of fraud-related risk areas; procedures and controls to protect against risks identified under subparagraph (A); allocation of responsibility for monitoring the risks identified under subparagraph (A); and procedures for the periodic evaluation and revision of the anti-fraud procedures, controls, and monitoring mechanisms under subparagraphs (B) and (C). Each virtual currency kiosk operator shall submit to FinCEN the anti-fraud policy required under paragraph (1) not later than 90 days after the later of— the effective date of this section; or the date on which the virtual currency kiosk operator begins operating. Each virtual currency kiosk operator shall designate and employ a compliance officer who— is qualified to coordinate and monitor compliance with this section and all other applicable Federal and State laws, rules, and regulations; is employed full-time by the virtual currency kiosk operator; is not the chief executive officer of the virtual currency kiosk operator; and does not own or control more than 20 percent of any interest in the virtual currency kiosk operator. Each virtual currency kiosk operator shall use blockchain analytics to prevent sending virtual currency to a virtual currency wallet known to be affiliated with fraudulent activity at the time of a virtual currency kiosk transaction and to detect transaction patterns indicative of fraud or other illicit activities. The Director of FinCEN may request evidence from any virtual currency kiosk operator to confirm compliance with this subsection. Before entering into a virtual currency kiosk transaction valued at 500 dollars or more with a new customer, a virtual currency kiosk operator shall obtain verbal confirmation from the new customer that— the new customer wishes to proceed with the virtual currency kiosk transaction; the new customer understands the nature of the virtual currency kiosk transaction; and the new customer is not being fraudulently induced to engage in the transaction. A virtual currency kiosk operator shall make a reasonable effort to determine whether the customer is being fraudulently induced to engage in the virtual currency kiosk transaction. Each verbal confirmation required under paragraph (1) shall be given by way of a live telephone or video call to a person employed by, or on behalf of, the virtual currency kiosk operator. Not later than 30 days after receiving an application under paragraph (2), a virtual currency kiosk operator shall issue a refund to a customer for the full amount of each virtual currency kiosk transaction, including the dollar value of virtual currency exchanged and all transaction fees, made during the period in which the customer was a new customer and for which the customer was fraudulently induced to engage in the virtual currency kiosk transaction. Not later than 30 days after receiving an application under paragraph (2), a virtual currency kiosk operator shall issue a refund to a customer for the full amount of all transaction fees associated with each virtual currency kiosk transaction made during the period in which the customer was an existing customer and for which the customer was fraudulently induced to engage in the virtual currency kiosk transaction. A customer seeking a refund under paragraph (1) shall, not later than 30 days after the date of the virtual currency kiosk transaction, submit an application to the virtual currency kiosk operator that includes the following: The name, address, and phone number of the customer. The transaction hash of the virtual currency kiosk transaction or information sufficient to determine the type, value, date, and time of the virtual currency kiosk transaction. A copy of a report to a State or local law enforcement or government agency, made not later than 30 days after the virtual currency kiosk transaction, that includes a sworn affidavit attesting that the customer was fraudulently induced to engage in the virtual currency kiosk transaction. Any person who willfully denies a refund to a customer in violation of paragraph (1) shall be liable to the customer for 3 times the amount of the refund owed under that paragraph or $10,000, whichever is greater. A penalty under this paragraph shall be in addition to any penalty under subsection (n). A virtual currency kiosk operator shall not accept more than $2,000, or the equivalent amount in virtual currency, from any new customer during any 24-hour period. A virtual currency kiosk operator shall not accept a total of more than $10,000, or the equivalent amount in virtual currency, from any new customer. Each virtual currency kiosk operator shall provide live customer service during all hours that the virtual currency kiosk operator accepts virtual currency kiosk transactions, the phone number for which is regularly monitored and displayed in a clear, conspicuous, and easily readable manner upon each virtual currency kiosk. Each virtual currency kiosk operator shall provide a dedicated and frequently monitored phone number and email address for relevant law enforcement and government agencies to facilitate communication with the virtual currency kiosk operator in the event of reported or suspected fraudulent activity. Not later than 90 days after the effective date of this section, each virtual currency kiosk operator shall submit the phone number and email address described in paragraph (1) to FinCEN and all other relevant law enforcement and government agencies. Any person who fails to comply with any requirement of this section, or any regulation prescribed under this section, shall be liable to the United States for a civil monetary penalty of $10,000 for each such violation. Each day that a violation described in paragraph (1) continues shall constitute a separate violation for purposes of such paragraph. Any penalty imposed under this section shall be assessed and collected by the Secretary of the Treasury as provided in section 5321 and any such assessment shall be subject to the provisions of that section. The provisions of this section shall preempt any State law, rule, or regulation only to the extent that such State law, rule, or regulation conflicts with a provision of this section. Nothing in this section shall be construed to prohibit a State from enacting a law, rule, or regulation that provides greater protection to customers than the protection provided by the provisions of this section. The table of sections for chapter 53 of title 31, United States Code, is amended by inserting after the item relating to section 5336 the following: 5337.Virtual currency kiosk fraud prevention(a)DefinitionsIn this section:(1)Blockchain analyticsThe term blockchain analytics means the analysis of data from blockchains or public distributed ledgers, and associated transaction information, to provide risk-specific information about virtual currency transactions and virtual currency addresses.(2)CustomerThe term customer means any person that purchases or sells virtual currency through a virtual currency kiosk.(3)Existing customerThe term existing customer means a customer other than a new customer.(4)FinCENThe term FinCEN means the Financial Crimes Enforcement Network of the Department of the Treasury.(5)New customerThe term new customer, with respect to a virtual currency kiosk operator, means a customer during the 14-day period beginning on the date of the first virtual currency kiosk transaction of the customer with the virtual currency kiosk operator.(6)Transaction hashThe term transaction hash means a unique identifier made up of a string of characters that act as a record of and provide proof that a transaction was verified and added to the blockchain.(7)Virtual currencyThe term virtual currency means any digital representation of value that is recorded on a cryptographically secured distributed ledger or any similar technology or another implementation, which was designed and built as part of a system to leverage or replace blockchain, distributed ledger technology, or their derivatives.(8)Virtual currency addressThe term virtual currency address means an alphanumeric identifier associated with a virtual currency wallet identifying the location to which virtual currency purchased through a virtual currency kiosk can be sent or from which virtual currency sold through a virtual currency kiosk can be accessed.(9)Virtual currency kioskThe term virtual currency kiosk means a stand-alone machine that is capable of accepting or dispensing legal tender in exchange for virtual currency.(10)Virtual currency kiosk operatorThe term virtual currency kiosk operator means a person who owns, operates, or manages a virtual currency kiosk located in the United States or its territories.(11)Virtual currency kiosk transactionThe term virtual currency kiosk transaction means the purchase or sale of virtual currency via a virtual currency kiosk.(12)Virtual currency walletThe term virtual currency wallet means a software application or other mechanism providing a means for holding, storing, and transferring virtual currency. (b)DisclosuresBefore entering into a virtual currency transaction with a customer, a virtual currency kiosk operator shall disclose in a clear, conspicuous, and easily readable manner—(1)all relevant terms and conditions of the virtual currency kiosk transaction, including—(A)the amount of the virtual currency kiosk transaction;(B)the type and nature of the virtual currency kiosk transaction;(C)a warning that the virtual currency kiosk transaction is final, is not refundable, and may not be reversed; and(D)the type and amount of any fees or other expenses paid by the customer;(2)a warning relating to consumer fraud including—(A)a warning that consumer fraud often starts with contact from a stranger, and that the customer should never send money to someone they do not know;(B)a warning about the most common types of fraudulent schemes involving virtual currency kiosks, such as—(i)impersonation of a government official or a bank representative;(ii)threats of jail time or financial penalties;(iii)offers of a job or reward in exchange for payment, or offers of deals that seem too good to be true;(iv)claims of a frozen bank account or credit card; or(v)requests for donations to charity or disaster relief; and(C)a statement that the customer should contact the virtual currency kiosk operator’s customer service helpline or State or local law enforcement if they suspect fraudulent activity.(c)Acknowledgment of disclosuresEach time a customer uses a virtual currency kiosk, the virtual currency kiosk operator shall ensure acknowledgment of all disclosures required under subsection (b) via confirmation of consent of the customer at the virtual currency kiosk.(d)ReceiptsUpon completion of each virtual currency kiosk transaction, the virtual currency kiosk operator shall provide the customer with a receipt, which shall include the following information:(1)The name and contact information of the virtual currency kiosk operator, including a telephone number for a customer service helpline.(2)The name of the customer.(3)The type, value, date, and precise time of the virtual currency kiosk transaction, transaction hash, and each applicable virtual currency address.(4)The amount of the virtual currency kiosk transaction expressed in United States dollars.(5)All fees charged.(6)A statement that the customer may be entitled by law to a refund if the customer reports fraudulent activity in conjunction with the virtual currency kiosk transaction not later than 30 days after the date of the virtual currency kiosk transaction.(7)The refund policy of the virtual currency kiosk operator or a Uniform Resource Locator where the refund policy of the virtual currency kiosk operator can be found.(8)A statement that the customer should contact law enforcement if they suspect fraudulent activity, such as scams, including contact information for a relevant law enforcement or government agency.(9)Any additional information the virtual currency kiosk operator determines appropriate.(e)Physical receipts requiredNot later than 1 year after the effective date of this section, each receipt required under subsection (d) shall be issued to the customer as a physical receipt at the virtual currency kiosk at the time of the virtual currency kiosk transaction, but such receipt may also be provided in additional forms or communications.(f)Anti-Fraud policy(1)In generalEach virtual currency kiosk operator shall take reasonable steps to detect and prevent fraud, including establishing and maintaining a written anti-fraud policy that includes—(A)the identification and assessment of fraud-related risk areas;(B)procedures and controls to protect against risks identified under subparagraph (A);(C)allocation of responsibility for monitoring the risks identified under subparagraph (A); and(D)procedures for the periodic evaluation and revision of the anti-fraud procedures, controls, and monitoring mechanisms under subparagraphs (B) and (C).(2)Submission of anti-fraud policy to FinCENEach virtual currency kiosk operator shall submit to FinCEN the anti-fraud policy required under paragraph (1) not later than 90 days after the later of—(A)the effective date of this section; or(B)the date on which the virtual currency kiosk operator begins operating.(g)Appointment of compliance officerEach virtual currency kiosk operator shall designate and employ a compliance officer who—(1)is qualified to coordinate and monitor compliance with this section and all other applicable Federal and State laws, rules, and regulations;(2)is employed full-time by the virtual currency kiosk operator; (3)is not the chief executive officer of the virtual currency kiosk operator; and(4)does not own or control more than 20 percent of any interest in the virtual currency kiosk operator.(h)Use of blockchain analytics(1)In generalEach virtual currency kiosk operator shall use blockchain analytics to prevent sending virtual currency to a virtual currency wallet known to be affiliated with fraudulent activity at the time of a virtual currency kiosk transaction and to detect transaction patterns indicative of fraud or other illicit activities. (2)ComplianceThe Director of FinCEN may request evidence from any virtual currency kiosk operator to confirm compliance with this subsection.(i)Verbal confirmation required before new customer transactions(1)In generalBefore entering into a virtual currency kiosk transaction valued at 500 dollars or more with a new customer, a virtual currency kiosk operator shall obtain verbal confirmation from the new customer that—(A)the new customer wishes to proceed with the virtual currency kiosk transaction;(B)the new customer understands the nature of the virtual currency kiosk transaction; and(C)the new customer is not being fraudulently induced to engage in the transaction. (2)Reasonable effortA virtual currency kiosk operator shall make a reasonable effort to determine whether the customer is being fraudulently induced to engage in the virtual currency kiosk transaction.(3)Method of confirmationEach verbal confirmation required under paragraph (1) shall be given by way of a live telephone or video call to a person employed by, or on behalf of, the virtual currency kiosk operator. (j)Refunds(1)In general(A)New customersNot later than 30 days after receiving an application under paragraph (2), a virtual currency kiosk operator shall issue a refund to a customer for the full amount of each virtual currency kiosk transaction, including the dollar value of virtual currency exchanged and all transaction fees, made during the period in which the customer was a new customer and for which the customer was fraudulently induced to engage in the virtual currency kiosk transaction.(B)Existing customersNot later than 30 days after receiving an application under paragraph (2), a virtual currency kiosk operator shall issue a refund to a customer for the full amount of all transaction fees associated with each virtual currency kiosk transaction made during the period in which the customer was an existing customer and for which the customer was fraudulently induced to engage in the virtual currency kiosk transaction. (2)ApplicationA customer seeking a refund under paragraph (1) shall, not later than 30 days after the date of the virtual currency kiosk transaction, submit an application to the virtual currency kiosk operator that includes the following:(A)The name, address, and phone number of the customer.(B)The transaction hash of the virtual currency kiosk transaction or information sufficient to determine the type, value, date, and time of the virtual currency kiosk transaction.(C)A copy of a report to a State or local law enforcement or government agency, made not later than 30 days after the virtual currency kiosk transaction, that includes a sworn affidavit attesting that the customer was fraudulently induced to engage in the virtual currency kiosk transaction.(3)Enhanced damagesAny person who willfully denies a refund to a customer in violation of paragraph (1) shall be liable to the customer for 3 times the amount of the refund owed under that paragraph or $10,000, whichever is greater. A penalty under this paragraph shall be in addition to any penalty under subsection (n).(k)Transaction limits with respect to new customers(1)In a 24-hour periodA virtual currency kiosk operator shall not accept more than $2,000, or the equivalent amount in virtual currency, from any new customer during any 24-hour period.(2)TotalA virtual currency kiosk operator shall not accept a total of more than $10,000, or the equivalent amount in virtual currency, from any new customer.(l)Customer service helplineEach virtual currency kiosk operator shall provide live customer service during all hours that the virtual currency kiosk operator accepts virtual currency kiosk transactions, the phone number for which is regularly monitored and displayed in a clear, conspicuous, and easily readable manner upon each virtual currency kiosk.(m)Communications with law enforcement(1)In generalEach virtual currency kiosk operator shall provide a dedicated and frequently monitored phone number and email address for relevant law enforcement and government agencies to facilitate communication with the virtual currency kiosk operator in the event of reported or suspected fraudulent activity.(2)SubmissionNot later than 90 days after the effective date of this section, each virtual currency kiosk operator shall submit the phone number and email address described in paragraph (1) to FinCEN and all other relevant law enforcement and government agencies.(n)Civil penalties(1)In generalAny person who fails to comply with any requirement of this section, or any regulation prescribed under this section, shall be liable to the United States for a civil monetary penalty of $10,000 for each such violation.(2)Continuing violationEach day that a violation described in paragraph (1) continues shall constitute a separate violation for purposes of such paragraph.(3)AssessmentsAny penalty imposed under this section shall be assessed and collected by the Secretary of the Treasury as provided in section 5321 and any such assessment shall be subject to the provisions of that section.(o)Relationship to State lawsThe provisions of this section shall preempt any State law, rule, or regulation only to the extent that such State law, rule, or regulation conflicts with a provision of this section. Nothing in this section shall be construed to prohibit a State from enacting a law, rule, or regulation that provides greater protection to customers than the protection provided by the provisions of this section.. 5337. Virtual currency kiosk fraud prevention..

4. Effective date The amendments made by this Act shall take effect 90 days after the date of enactment of this Act.