Crypto ATMs Are on the Rise. Who’s Supposed to Keep an Eye on Them?

Crypto fans and crypto companies see the machines as an extension of the promise embodied by Bitcoin, the largest cryptocurrency: another step in the democratization of finance. Everybody knows what an ATM is, and allowing people to buy crypto with cash opens this new landscape of exchange and investment up to anyone. You can’t buy into Wall Street investments without a bank account and a brokerage account. BTMs offer the hourly worker on a lunch break the option to buy crypto instead of a lottery ticket.

But as they’ve proliferated, state regulators across the country, and even some federal officials, have started to raise concerns. Legitimate companies may run most of these machines, but some are set up by unlicensed operators. The regulators worry that crypto ATMs can too neatly serve the interests of money launderers and fraudsters, or could hide payments to sex and drug traffickers; even for honest brokers, their fees are considerably higher than normal bank transactions. They also market themselves, sometimes aggressively, to low-income people who may not understand the risks of moving their money into cryptocurrency, which is currently in the midst of one of its intermittent crashes.

States are trying to figure out how to handle these machines at a time when they’re still grappling with what to do about crypto itself. In most states, banking officials head up the task of sorting through policy. And in most states, they haven’t yet explicitly decided that digital money trades need the same kind of money transmitting licenses that govern traditional finance.

As a result, customers find themselves with a patchwork of protections, and crypto firms face their own kind of uncertainty. “Each state has its own powers and has the right to make its own laws,” says Bill Repasky, an attorney with the Louisville, Ky., firm Frost Brown Todd who works with BTM manufacturers. “It makes it difficult [for companies] to know where to open up.”

The machines have already triggered some federal and international concern. In a February report on virtual money’s role in trafficking, the U.S. Government Accountability Office warned Congress that the machines can aid and abet transnational cartels, and recommended that federal agencies, including the IRS, should intensify their scrutiny. Singapore, recently dubbed the world’s top crypto economy, banned them outright in January, arguing their marketing encouraged people to trade on impulse. In March, Britain’s regulator shut down the U.K.’s 81 BTMs in a move that may or may not be permanent.

In the U.S., New York has been particularly tough on crypto ATMs — not surprising for a state stacked with financial regulators. California, often on the forefront of new technologies, has struggled to come up with a coherent regulatory scheme. One of the more aggressive states on crypto policy generally and now on BTMs is, perhaps surprisingly, Alabama, where the machines made a relatively late arrival, and where the state government has started the process where BTMs will have to submit to money transmitter laws.

As crypto ATMs grow, they’re becoming the focus of many of the same big, hard-to-answer questions that surround cryptocurrency itself: Are they a boon for people without traditional bank accounts, or an age-old financial predator hiding behind a slick new screen? Is it even a regulator’s role to say? And does the fact that these machines are a useful tool for criminals, and a new source of law-enforcement headache, drown out that question altogether?

What crypto ATMs are for, exactly, depends on who you ask.

Because you don’t need a bank account to use them, one market the industry has touted is remittances: money that immigrants send back to friends and family in their home countries. In major metropolises like Miami, Dallas-Fort Worth and Los Angeles, BTMs cluster in Salvadoran, Colombian and Mexican neighborhoods. The company that installed the first American bitcoin ATM, in Austin, later rebranded itself as a remittance firm, before shutting down.

BTM firms — which both install the machines and supply virtual wallets to users — also tout themselves as offering people a new form of alternative investment. Crypto overall has been popular with Americans traditionally outside the financial system, and is popular with lower-income people.

But critics suggest that the real driver for these machines is their anonymity. Because most crypto kiosks don’t have to follow the uniform “know your customer” rules that banks do, they’re convenient for anyone who needs, for whatever reason, to send money in an off-the-radar transaction. Potential criminal use has driven a handful of prosecutions already: In 2020, a Southern California man pleaded guilty to running a $25 million illegal crypto business, including BTMs, partly for a criminal clientele. In indicting a man running dozens of unlicensed machines this past April, Manhattan District Attorney Alvin Bragg made the point that the owner “went to great lengths to keep his Bitcoin kiosk business a secret” to draw customers who required anonymity.

Like many financial services aimed at the “unbanked,” BTMs charge fees that skew much higher than their establishment counterparts. Typical kiosk commissions for crypto purchases start at 6.5 percent per transaction but can go as high as 20 percent. (Fees are lower if you’re simply withdrawing cash from your crypto wallet.)

The BTM industry rejects the charge that the kiosks prey on the poor, though some companies do acknowledge that the attraction for criminals is a problem they have to fix. Some firms are trying to differentiate themselves with tougher security standards and proactive anti-fraud measures.

Broadly, the industry argues that the machines offer needed ease, speed and privacy — and what might look like “targeting” poor people is a key part of cryptocurrency’s democratization of finance, giving those who might not have the chance to invest an easy way in. Crypto may sound scary, the world of online crypto exchanges may seem complicated or overwhelming, but everyone knows what an ATM looks like. A BTM stands as a solid, familiar distillation of the theoretical complexity of blockchain or “web3” money into something anyone can recognize.

As the ATMs have spread, much of the oversight landscape has followed predictable lines. New York, capital of traditional finance and financial regulation, unveiled its super-strict “BitLicense” for all virtual currency businesses in 2015. The first such license granted to a BTM went to Coinsource in 2018.

Wyoming and Florida, by contrast, are among the laxest, hoping to attract the industry to their states — with Miami molding itself as a kind of crypto Wall Street.

There are plenty of others in the middle, like California. To date, the state has offered one of the easier regulatory environments, despite its reputation as a consumer-protection hub. In the late spring, Gov. Gavin Newsom signed a crypto-friendly executive order aimed at bringing in more business. Last month, however, the state legislature proposed a massive ramp-up of oversight over the cryptocurrency markets overall, a measure that will be up for a final vote in August.

One business-friendly red state taking a tough line is Alabama, whose securities commissioner, Joseph Borg, has emerged as a crypto hawk — especially when it comes to tracking down and prosecuting digital money frauds.

Alabama found itself in the forefront not because crypto ATMs came early, but because they came late: With fewer than 5 million people, it was one of the last states to see BTMs move in. Today, says Borg, they mostly scatter around touristy beach areas and high-tech districts.

Thanks to a quirk of Alabama securities law, Borg has criminal enforcement authority, unlike every other state financial regulator. He says he got intrigued by BTMs as he worked to root out crypto-related scams in his state. When BTMs began arriving, their potential misuses for money laundering, terrorism and the like struck him as a law enforcement problem, and he immediately started thinking how he could slap up some guardrails.

Were these machines following the rules that banks do, where they have to verify their customers are real people and legally and financially suitable to do business with? Were they insured? Did their operators have a license to operate a financial business, or were they subletting the kiosks out to others who did? Could “money mules” of the past — where an innocent person gets paid to make illegal money transfers on behalf of an anonymous criminal — get unknowingly tapped as a “crypto mule?”

“We do need to know what’s going on in our state,” Borg says. “We don’t want the BTM machines used for illegal practices, and we don’t want local people roped into doing anything illegal.”

Borg says the kiosks do have legitimate purposes, and he’s not trying to shut them down. He’s currently writing rules to make BTM companies get money transmitter licenses. “We want to do it right the first time,” he says. “I don’t see crypto going away.”

On the national level, crypto ATMs are subject to certain kinds of oversight: They are bound by the federal anti-money laundering law known as the Bank Secrecy Act. Operators must register with the Treasury Department’s Financial Crimes Enforcement Network and flag suspicious transactions to federal officers.

But there is plenty of wiggle room. Big federal agencies can only move so fast, and critics and some state regulators say it’s insufficient. The sheer number of BTMs means federal bureaucrats don’t have their hands on what’s happening everywhere. Criminal activity can be hard to nail down, especially when it’s done through unlicensed machines. As the GAO pointed out early this year, officials simply don’t track the happenings at individual machines — and indeed, the federal agency in charge doesn’t require operators to share the locations of their machines.

Concerned about a potential crackdown, and about its reputation, the industry has begun rallying to its own defense. A group of BTM companies has converged in what they’ve named the Cryptocurrency Compliance Cooperative, establishing some ground rules like making their customers use an ID, sticking consumer warnings about potential scams to their machines and more.

Seth Sattler, chief compliance officer for the crypto ATM operator DigitalMint, serves as the Cooperative’s executive director. He sees the industry’s problems as, in part, growing pains that can be addressed by the companies themselves.

“Any time there is an emerging technology that has a large-scale amount of publicity but not a large-scale amount of…