STATE OF NEW YORK
________________________________________________________________________
10899
IN ASSEMBLY
April 8, 2026
___________
Introduced by M. of A. VANEL -- read once and referred to the Committee
on Banks
AN ACT to amend the banking law, in relation to crypto kiosks
The People of the State of New York, represented in Senate and Assem-bly, do enact as follows:
1 Section 1. The banking law is amended by adding a new article 2-AAA to
2 read as follows:
3 ARTICLE 2-AAA
4 CRYPTO KIOSKS
5 Section 76-a. Definitions.
6 76-b. Crypto kiosk and cashier crypto exchange registration.
7 76-c. Disclosures for crypto kiosks.
8 76-d. Disclosures required prior to completing a transaction.
9 76-e. Transaction receipt.
10 76-f. Customer service.
11 76-g. Crypto kiosk transaction hold periods.
12 76-h. Fraud refunds related to crypto kiosks.
13 76-i. Cashier crypto transmission prohibition.
14 76-j. Crypto kiosk or cashier crypto fees.
15 76-k. Fraud and anti-money laundering.
16 76-l. Blockchain analytics.
17 76-m. Transaction limits and protections.
18 76-n. Legal and beneficial ownership; penalties.
19 § 76-a. Definitions. As used in this article, the following terms
20 shall have the following meanings:
21 1. "Consumer" shall mean a natural person who uses a crypto kiosk
22 regardless of whether they create an account with the operator.
23 2. "Crypto kiosk" shall mean any electronic terminal or retail
24 location which enables a consumer to exchange money for virtual currency
25 including by connecting to a separate virtual currency exchange.
26 3. "Operator" means a person that engages in virtual currency business
27 activity via a crypto kiosk or cashier crypto exchange located in this
28 state, or a person that owns, operates, or manages a crypto kiosk or
29 cashier crypto exchange located in this state through which virtual
30 currency business activity is offered. This definition applies whether
31 or not the operator owns the kiosks or cashier crypto exchanges used in
32 transactions, and whether the operator provides custodial or non-custo-
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[] is old law to be omitted.
LBD15416-01-6
A. 10899 2
1 dial services. A group or persons or entities acting in concert, includ-
2 ing but not limited to any affiliated entities, subsidiaries, parent
3 companies, joint ventures, partnerships, agents, or employees thereof,
4 or any entity or individual acting at the direction of, in cooperation
5 with, under contract or in partnership with, or financially benefitting
6 from another person or entity shall be treated as one person for
7 purposes of this article.
8 4. "Cashier crypto exchange" shall mean a method of exchanging virtual
9 currency in exchange for funds, where such funds are collected at a
10 retailer acting as an agent or processor for such transaction.
11 5. "Retailer" shall mean any physical location that sells goods or
12 services to consumers for personal or commercial use.
13 6. "Virtual currency" shall have the same meaning as in 23 NYCRR Part
14 200.2.
15 7. "Funds" shall mean cash or other monetary value accepted by the
16 crypto kiosk or cashier crypto exchange.
17 8. "Execution" shall mean the irreversible broadcast by the operator
18 of a transfer of virtual currency to the consumer-designated address on
19 a blockchain.
20 § 76-b. Crypto kiosk and cashier crypto exchange registration. 1.
21 Every operator of a crypto kiosk or cashier crypto exchange shall be
22 registered with the department in the manner and form prescribed by the
23 department including providing the number and locations of kiosks they
24 operate. Such registration number shall be for an unlimited number of
25 crypto kiosks or cashier crypto exchanges.
26 2. An operator shall conspicuously post their registration number and
27 toll-free contact number on every crypto kiosk or, in the case of a
28 cashier crypto exchange, in a conspicuous manner that is readily avail-
29 able to the consumer.
30 3. Where an operator fails to register with the department, the
31 department shall order that such operator cease the operation of all
32 crypto kiosks and cashier crypto exchanges and shall be subject to a
33 civil penalty of ten thousand dollars per crypto kiosk or cashier crypto
34 exchange.
35 4. Such operator shall also be liable for a civil penalty that is the
36 greater of fifty dollars per transaction which occurs following such
37 order, or two times the total amount of profit made during such failure
38 to cease operation of such crypto kiosk.
39 5. Any provision in a contract or waiver relating to any provision in
40 this section shall be deemed void and unenforceable.
41 § 76-c. Disclosures for crypto kiosks. 1. A crypto kiosk operator
42 shall disclose in a clear, conspicuous, and easily readable manner in
43 the chosen language of the user, all relevant terms and conditions
44 generally associated with the products, services, and activities of the
45 crypto kiosk operator and virtual currency including but not limited to
46 transaction fees collected and exchange rates used by the operator.
47 2. Each time a user engages with a crypto kiosk, the crypto kiosk
48 operator shall receive acknowledgement of receipt of all disclosures
49 required under this section via confirmation of consent at the crypto
50 kiosk.
51 § 76-d. Disclosures required prior to completing a transaction. 1. In
52 addition to any other disclosures required pursuant to this article,
53 disclosures required pursuant to this section shall at a minimum include
54 the following message, in a substantially similar form and shall be
55 displayed prior to the consumer completing the transaction on a crypto
A. 10899 3
1 kiosk or cashier crypto exchange, in a form, size, placement, and manner
2 as prescribed by the department by regulation:
3 "WARNING:
4 IF SOMEONE ASKED YOU TO DEPOSIT MONEY IN THIS MACHINE AND/OR IS ON THE
5 PHONE WITH YOU AND CLAIMS TO BE A:
6 * FRIEND OR FAMILY MEMBER,
7 * GOVERNMENT AGENT,
8 * COMPUTER SOFTWARE REPRESENTATIVE,
9 * BILL COLLECTOR,
10 * LAW ENFORCEMENT OFFICER,
11 * OR ANYONE YOU DO NOT KNOW PERSONALLY,
12 STOP THIS TRANSACTION IMMEDIATELY AND CONTACT YOUR LOCAL LAW ENFORCE-
13 MENT AND THE KIOSK OPERATOR. THIS MAY BE A SCAM."
14 2. The message required by this section shall not be altered, dimin-
15 ished, or otherwise obscured in any manner. No additional message shall
16 appear on or near the same notice, screen, or on any screen which
17 distracts from or is presented as related to the required message.
18 3. When using a crypto kiosk, the following information shall be
19 provided to the consumer:
20 (a) The name, address, and telephone number of the owner of the kiosk
21 and the days, time, means by which a user can contact the owner for
22 assistance, and any relevant state and local law enforcement and/or
23 government agency for reporting fraud shall be displayed on or at the
24 location of the crypto kiosk or cashier crypto exchange, or on the first
25 screen of a crypto kiosk.
26 (b) Any other disclosure that the department may require.
27 § 76-e. Transaction receipt. Upon the completion of each transaction
28 the crypto kiosk or cashier crypto exchange operator shall provide the
29 user with paper and electronic receipts in a retainable form. The
30 receipt shall include the following information:
31 1. the operator's name and toll-free customer service phone number;
32 2. relevant contact information for state and/or local law enforcement
33 and/or government agency to report fraud;
34 3. type, value, date, and precise time of the transaction, and each
35 applicable virtual currency address and transaction hash where avail-
36 able;
37 4. all fees;
38 5. exchange rate of the virtual currency to United States dollars;
39 6. statement of the operator's refund policy;
40 7. any additional information the operator may determine; and
41 8. any additional information the department may require.
42 § 76-f. Customer service. All crypto kiosk and cashier crypto exchange
43 operators performing business shall provide live customer service during
44 operating hours including the hours between 8 AM to 10 PM local time.
45 The customer service toll-free number shall be displayed on the crypto
46 kiosk or the crypto kiosk screens and shall be run by trained individ-
47 uals who are employed by or on behalf of the operator, and who provide
48 live customer assistance to a caller in real time. In the case of a
49 cashier crypto exchange, such toll-free number shall be displayed in a
50 conspicuous manner that is readily available to the consumer.
51 § 76-g. Crypto kiosk transaction hold periods. 1. No person shall
52 operate a crypto kiosk in this state unless such operator complies with
53 the following:
54 (a) Upon receipt of funds from a consumer in an amount of one thousand
55 dollars or more in any twenty-four hour period, the operator shall not
A. 10899 4
1 execute any virtual currency transmission for a hold period of seventy-
2 two hours from the time of receipt.
3 (b) All such funds accepted during the hold period shall be held in
4 statutory trust for the exclusive benefit of the consumer in segregated,
5 non-commingled accounts, shall not be encumbered or pledged, and legal
6 and beneficial ownership shall remain with the consumer until execution
7 in accordance with this section.
8 (c) The operator shall aggregate a consumer's transactions across all
9 kiosks within any twenty-four hour period for purposes of the threshold
10 in paragraph (a) of this subdivision. Multiple transactions that exceed
11 one thousand dollars over a twenty-four hour period shall be treated as
12 one transaction;
13 (d) Both on the machine and on the customer's receipt, the operator
14 provides:
15 (i) A current, toll-free contact number dedicated to cancellation and
16 refund requests;
17 (ii) The transaction identifier;
18 (iii) The hold-period expiration timestamp; and
19 (iv) A clear and conspicuous notice that any amounts aggregated to one
20 thousand dollars and over in a twenty-four hour period can be refunded
21 upon request.
22 (e) Any other rule or regulation established by the superintendent,
23 which may include know your customer, anti-money laundering, and other
24 regulations.
25 2. The consumer may cancel their transaction at any time during the
26 hold period using the information in paragraph (d) of subdivision one of
27 this section and the operator shall not refuse, frustrate, or charge any
28 fee for collection.
29 3. Upon the consumer's timely cancellation during the hold period, the
30 operator shall refund the full amount tendered by the consumer, includ-
31 ing all fees, within seven business days of notice by the consumer or
32 the consumer's representative. Refunds shall be made by check sent via
33 certified mail to the consumer's address on file. Such amounts refunded
34 shall be the amount deposited including any and all fees. Operators may
35 not charge fees to issue a refund.
36 4. Where an operator violates paragraph (b) or (c) of subdivision one
37 of this section or subdivision three of this section, or refuses or
38 frustrates restitution in accordance with the provisions of subdivision
39 seven of this section, such operator shall be subject to a civil penalty
40 of the greater of two thousand five hundred dollars or three times the
41 amount tendered to the operator in the amount that such crypto was worth
42 at the time of such tender, inclusive of all fees paid by the consumer,
43 whichever is greater.
44 5. In addition to the penalties set forth herein, where an operator
45 fails to comply with any provision of this section, legal and beneficial
46 ownership of the funds accepted shall be conclusively presumed to remain
47 with the consumer, and the operator shall return the full principal and
48 all fees within seven business days of notice by the consumer or the
49 consumer's representative.
50 6. Where an operator engages in a persistent course of conduct in
51 violation of this section, the department may revoke such operator's
52 registration and such operator shall be subject to a civil penalty of
53 five hundred dollars per transaction in violation of such subdivisions.
54 7. Where the operator fails to pay back such principal and fees in
55 full within such period of time as described in subdivision three of
56 this section, the consumer shall have a private right of action to
A. 10899 5
1 recover such funds and, upon such a finding that the operator violated
2 subdivision five of this section, such court shall award attorney's fees
3 and costs to the consumer, including statutory damages of three times
4 the amount required to be paid back to the consumer.
5 § 76-h. Fraud refunds related to crypto kiosks. 1. In cases related to
6 fraud, where a crypto kiosk operator fails to comply with the provisions
7 of sections seventy-six-g and seventy-six-k of this article, such opera-
8 tor shall issue a refund to a consumer in the full amount of all trans-
9 actions paid by the consumer, including, but not limited to, any fees or
10 other charges collected in connection with the transactions, at the time
11 of the transaction, regardless of any acknowledgments or waivers the
12 consumer may have made prior to finalizing the transactions. Refunds
13 shall be made in the originating currency. Operators shall not charge
14 any fees to issue a refund.
15 2. To receive a refund under this section, a consumer must:
16 (a) Have engaged in one or more crypto kiosk transactions that were
17 affected by fraud, whether the transactions were authorized or unauthor-
18 ized;
19 (b) Notify the crypto kiosk operator of the fraudulent nature of the
20 transaction or transactions within ninety days after the last such tran-
21 saction occurred or the consumer becoming aware of the fraud; and
22 (c) Within one hundred twenty days after notifying the operator,
23 submit to the operator a police report, government agency report, or
24 sworn statement describing the fraudulent nature of the transaction or
25 transactions.
26 3. If the conditions for a refund are met, the operator shall issue
27 the refund within seventy-two hours after receiving the required
28 documentation.
29 4. For all communications relating to refunds, the operator shall
30 provide written notices in English and Spanish, and shall communicate
31 with the consumer in the consumer's preferred language through staff,
32 interpretation services, and/or auxiliary aids and services.
33 5. Any provision in a contract or waiver relating to any provision in
34 this section shall be deemed void and unenforceable.
35 § 76-i. Cashier crypto transmission prohibition. 1. No person or enti-
36 ty involved in a cashier crypto exchange transaction shall permit,
37 facilitate, or enable the transmission of virtual currency.
38 2. A cashier crypto exchange shall be used for the sole purpose of
39 exchanging virtual currency for United States dollars, whether in cash
40 or deposited to a bank account.
41 3. No cashier crypto exchange shall evade the prohibitions under this
42 section by any device, subterfuge, or pretense.
43 § 76-j. Crypto kiosk or cashier crypto fees. 1. The aggregate of all
44 fees, charges, commissions, and other amounts, directly or indirectly,
45 charged to a customer in connection with a single transaction or series
46 of related transactions involving virtual currency effected through a
47 crypto kiosk or cashier crypto exchange, including any difference
48 between the price charged to the customer to buy, sell, exchange, swap,
49 or convert virtual currency and the prevailing market value at the time
50 of the transaction, shall not exceed three percent of the United States
51 dollar value of the transaction.
52 2. Where an operator violates the provisions of this section, such
53 operator shall be subject to a civil penalty of five hundred dollars per
54 transaction which violates this section.
A. 10899 6
1 3. In addition to the penalties set forth herein, where an operator
2 engages in a persistent course of conduct in violation of this section,
3 the department may revoke such operator's registration.
4 4. A consumer may bring a civil action to recover any amounts unlaw-
5 fully charged in violation of this section, together with interest and
6 statutory damages equal to the greater of one thousand dollars or three
7 times the amount charged to the consumer.
8 5. Any provision in a contract or waiver relating to any provision in
9 this section shall be deemed void and unenforceable.
10 § 76-k. Fraud and anti-money laundering. 1. All crypto kiosk operators
11 shall take reasonable steps to detect and prevent fraud and money laun-
12 dering, including establishing and maintaining a written anti-fraud and
13 money laundering policy and abiding by Bank Secrecy Act, 31 U.S.C. 5311
14 et seq., provisions.
15 2. The anti-fraud and money laundering policy shall be filed with the
16 department as part of registration pursuant to this article and shall,
17 at a minimum, include:
18 (a) implementation of know your customer policies;
19 (b) verification of the customer prior to engaging in the transaction;
20 (c) identification and assessment of fraud and money laundering
21 related risk areas;
22 (d) procedures and controls to protect against identified risks;
23 (e) allocation of responsibility for monitoring risks; and
24 (f) procedures for the periodic evaluation and revision of the anti-
25 fraud and money laundering procedures, controls, and monitoring mech-
26 anisms.
27 § 76-l. Blockchain analytics. 1. All crypto kiosk operators shall use
28 blockchain analytics and tracing software to assist in the prevention of
29 sending virtual currency to a virtual currency wallet known or likely to
30 be affiliated with fraudulent activity at the time of a transaction and
31 to detect transaction patterns indicative of fraud or other illicit
32 activities.
33 2. Crypto kiosk operators shall block transactions to virtual currency
34 wallets associated with overseas exchanges non-accessible for United
35 States users.
36 3. State regulators may request evidence from any crypto kiosk opera-
37 tor of their current use of blockchain analytics.
38 4. All crypto kiosk operators performing business shall provide a
39 dedicated communications line for relevant government agencies via a
40 posted United States phone number or email address. This dedicated line
41 shall be used to facilitate law enforcement and regulatory agency commu-
42 nications with the crypto kiosk and cashier crypto exchange operator in
43 the event of a fraud report from a user. The communications line shall
44 be frequently monitored.
45 § 76-m. Transaction limits and protections. 1. Daily transaction
46 limit. A crypto kiosk or cashier crypto exchange operator shall not
47 accept transactions of more than one thousand dollars in United States
48 dollars or the equivalent in virtual currency for any user per day
49 across all crypto kiosks or cashier crypto exchange of such operator. In
50 addition, the transaction limit shall not exceed ten thousand dollars in
51 United States or the equivalent in virtual currency in any thirty-day
52 period.
53 2. The transaction limits and protections provided for in this act
54 shall apply to all products or services offered by an operator through a
55 crypto kiosk.
A. 10899 7
1 3. Operators shall not use alternative methods, including but not
2 limited to online portals, affiliated kiosks, or over-the-counter trans-
3 actions, to evade or exceed the limits provided for in this section.
4 4. At the request of the department a crypto kiosk or cashier crypto
5 exchange operator must provide any transaction and user information
6 requested, including related to transactions that were attempted but
7 denied.
8 5. Data collected by the department pursuant to this section shall be
9 confidential and may be released only in composite form, except as
10 otherwise provided by law.
11 § 76-n. Legal and beneficial ownership; penalties. 1. Where an opera-
12 tor of a crypto kiosk fails to comply with subdivision one of section
13 seventy-six-b, section seventy-six-g, section seventy-six-k or section
14 seventy-six-l of this article, legal and beneficial ownership of the
15 funds accepted shall be conclusively presumed to remain with the consum-
16 er, and the operator shall return the full principal and all fees within
17 seven business days of notice by the consumer or the consumer's repre-
18 sentative. Where the operator fails to pay back such principal and fees
19 in full within such period of time as described in subdivision three of
20 section seventy-six-g of this article, the consumer shall have a private
21 right of action to recover such funds and, upon such a finding that the
22 operator violated subdivision three of section seventy-six-g of this
23 article, such court shall award attorney's fees and costs to the consum-
24 er, including statutory damages of three times the amount required to be
25 paid back to the consumer.
26 2. Where an operator of a cashier crypto exchange fails to comply with
27 subdivision one of section seventy-six-b or section seventy-six-i of
28 this article legal and beneficial ownership of the funds accepted shall
29 be conclusively presumed to remain with the consumer, and the operator
30 shall return the full principal and all fees within seven business days
31 of notice by the consumer or the consumer's representative. Where the
32 operator fails to pay back such principal and fees in full within such
33 period of time as described in subdivision three of section
34 seventy-six-g of this article, the consumer shall have a private right
35 of action to recover such funds and, upon such a finding that the opera-
36 tor violated subdivision five of this section, such court shall award
37 attorney's fees and costs to the consumer, including statutory damages
38 of three times the amount required to be paid back to the consumer.
39 3. Where an operator of a crypto kiosk or cashier crypto exchange
40 fails to comply with any provision of this article with a specific
41 penalty, such penalty shall be imposed on such operator. Where no penal-
42 ty is provided, such penalty shall be the greater of one hundred dollars
43 per violation of two times such profits earned from such violation.
44 § 2. Severability clause. If any clause, sentence, paragraph, subdivi-
45 sion, section or part of this act shall be adjudged by any court of
46 competent jurisdiction to be invalid, such judgment shall not affect,
47 impair, or invalidate the remainder thereof, but shall be confined in
48 its operation to the clause, sentence, paragraph, subdivision, section
49 or part thereof directly involved in the controversy in which such judg-
50 ment shall have been rendered. It is hereby declared to be the intent of
51 the legislature that this act would have been enacted even if such
52 invalid provisions had not been included herein.
53 § 3. This act shall take effect on the one hundred eightieth day after
54 it shall have become a law.
