Florida’s new crypto ATM law makes scam refunds the cost of doing business
Florida has enacted the nation’s first comprehensive crypto ATM fraud-liability statute, requiring kiosk operators to issue full refunds for scam transactions within 72 hours and register with state regulators by March 2027. The law shifts fraud prevention costs directly onto kiosk businesses, creating a new operating-expense model that institutional investors and operators must factor into feasibility and margin calculations.
- HB 505 mandates 72-hour full refunds for fraud victims who report within 60 days and provide proof such as police reports or notarized affidavits.
- Florida’s Office of Financial Regulation identified 26 virtual currency kiosk providers in the state, with only nine holding money-transmitter licenses before the law passed.
- Registration requirement begins March 1, 2027, while most consumer protections take effect January 1, 2027, creating a staged rollout timeline for operators.
- 72 hours Refund window for confirmed fraud compared to industry standard of no refunds
- 26 Known kiosk providers in Florida versus nine with money-transmitter licenses
- 60 days Consumer reporting deadline to qualify for refund protection versus typical statute of limitations periods
Florida has become the first state to embed fraud liability directly into the operational and financial structure of crypto ATM businesses. The newly enacted HB 505, codified as Chapter 2026-178, creates a comprehensive licensing and consumer-protection framework that treats kiosk fraud not as a consumer risk to be warned away but as a cost of business that operators must absorb.
The law requires kiosk operators to post fraud warnings, issue transaction receipts, enforce daily spending caps, register with state regulators, and crucially, refund customers who report fraud to both the business and law enforcement within a 60-day window.
The staged implementation timeline, January 1, 2027, for consumer protections and March 1, 2027, for mandatory operator registration, gives market participants three to nine months to assess whether the economics of kiosk operation remain viable under the new liability regime.
Florida regulators identified 17 unregistered kiosk operators exploiting licensing gaps
The regulatory driver behind HB 505 emerged from a December 2024 audit by Florida’s Office of Financial Regulation. OFR documented 26 known virtual currency kiosk providers operating in Florida, but only nine held money-transmitter licenses. That 17-operator gap represented a practical enforcement vacuum.
Under Florida law, peer-to-peer kiosk operators who did not act as intermediaries, those who simply facilitated direct cash-to-crypto transfers, faced no mandatory money-transmitter licensing requirement. The distinction allowed kiosk operators to deploy machines accepting cash and executing irreversible blockchain transactions without triggering traditional money-transmission oversight.
OFR flagged this as a policy failure with real consumer consequences. The office noted that federal agencies, including the US Secret Service, had posted warning signs at hundreds of Central Florida kiosks alerting users to scam risks, but those warnings originated outside Florida’s regulatory authority.
No state law required kiosk operators themselves to post disclosures or take affirmative prevention steps. Many consumers who used the machines either did not see the warnings or ignored them, proceeding with transfers to fraudsters posing as tech-support agents, investment advisors, or romance scammers.
HB 505 transforms that gap into an affirmative operator duty. Rather than leaving fraud prevention to customer awareness, the statute links consumer warnings to transaction caps, mandatory receipts, registration filings, and most significantly, refund obligations.
The law effectively declares that if a kiosk operator wants to remain in business in Florida, fraud prevention becomes a line-item operating cost, not an aspirational compliance goal.
Mandatory refunds create first state-level test of fraud liability economics
The refund mechanism is the statute’s most consequential feature for institutional operators and investors. Once the law takes effect on January 1, 2027, a kiosk business must issue a full refund within 72 hours if a customer reports alleged fraud to both the kiosk operator and law enforcement or a government agency within 60 days and provides supporting documentation.
The supporting proof requirement, police reports, notarized affidavits, or equivalent evidence, creates a verification standard that protects operators from unsubstantiated refund claims while still establishing a liability floor.
The economic impact is material. Crypto ATM margins have historically relied on transaction fees (typically 7-15 percent of transaction value) and spreads between spot prices and kiosk prices (often 8-12 percent or higher). A single refund obligation eliminates both the fee and the spread, converting what would have been profitable revenue into a loss.
For operators running high-volume kiosks in populated areas, even a 2-3 percent fraud claim rate could swing a machine from profitable to breakeven or loss-making.
The 60-day reporting window is deliberate. Most crypto scams involve delays before victims recognize the fraud, they may send funds to a fraudster’s address, receive nothing in return, and only later confirm they have been scammed. A 60-day window captures most of those cases while remaining short enough to discourage false or opportunistic refund claims months after a transaction.
The requirement to report to law enforcement adds friction but also creates audit trails that regulators can examine during compliance reviews.
This structure shifts the entire fraud-prevention burden to kiosk businesses rather than placing it on consumers or regulators. If an operator wants to minimize refunds, it must invest in customer screening, transaction monitoring, velocity limits, and staff training. Those are operating expenses that did not exist in Florida’s unregulated kiosk market.
Registration deadline forces immediate compliance infrastructure buildout
Florida’s staged rollout creates two distinct compliance phases. January 1, 2027, triggers the consumer-protection requirements: warnings, receipts, daily caps, and refund obligations take effect immediately. However, the mandatory registration requirement does not begin until March 1, 2027.
That two-month gap is intentional, allowing operators to implement operational changes while preparing registration applications and documentation systems.
Registration with Florida’s Office of Financial Regulation will require operators to file business information, ownership details, transaction-volume data, fraud-reporting procedures, and compliance records. The statute does not specify the registration fee, but the filing requirement itself creates infrastructure costs.
Operators must establish systems to track daily transaction caps, document refund requests, maintain proof of law enforcement notification, and generate compliance reports for potential audits or license renewals.
The practical effect is to formalize an industry that has operated largely outside regulatory view. By March 1, 2027, Florida will have a registry of every kiosk operator in the state, their business locations, ownership structure, and compliance posture. That registry gives OFR enforcement authority it previously lacked.
An operator who fails to register, posts a machine without required warnings, or refuses to issue a mandated refund can face license denial, penalties, or cease-and-desist orders.
The registration framework also creates a barrier to entry for small operators who lack compliance infrastructure or capital to absorb fraud losses. Larger operators with legal and compliance teams will adapt more readily than independent machine owners operating one or two kiosks in convenience stores.
Transaction caps and velocity limits become default fraud controls
HB 505 requires daily transaction limits for each customer at each kiosk, though the statute does not specify the cap amount or whether it applies per machine, per location, or per operator. That detail matters enormously for market structure.
A strict daily limit (e.g., $500 per customer per machine per day) would sharply reduce fraud exposure but also cut revenue by limiting repeat customers and high-value transactions. A looser cap (e.g., $5,000 per day) would preserve more revenue but leave significant fraud risk uncontrolled.
The receipt requirement serves a dual purpose. First, it creates contemporaneous documentation that operators can use to dispute fraudulent refund claims. Second, it creates an audit trail for regulators investigating operator compliance. An operator without receipt records cannot demonstrate that it provided warnings or that the customer acknowledged transaction limits.
Together, these provisions, daily caps, receipts, and fraud refunds, form a control system that mirrors what regulated financial institutions use for wire transfers and payments. The difference is speed and irreversibility. A crypto
