Crypto ATM operators are under pressure to strengthen anti-money laundering controls as regulators warn of rising scam losses and evolving criminal tactics. Enhanced monitoring, wallet screening, and consumer protections are now in focus.
Crypto ATMs have become a popular way for users to convert cash into digital assets, but their unique structure creates challenges for anti-money laundering (AML) compliance. Unlike traditional bank transfers, these machines allow customers to deposit cash and receive cryptocurrency directly, often with minimal interaction. This convenience, however, also makes crypto ATMs a target for money laundering, fraud, and scams-especially as criminals adapt their tactics to exploit gaps in oversight.
Layered AML Controls
Operators of crypto ATMs are required to implement a series of controls that go far beyond simply verifying a customer's identity. The process typically starts with Know Your Customer (KYC) checks, which may include collecting a phone number, scanning government-issued identification, or using facial recognition. The level of scrutiny often increases with the size or frequency of transactions, and state-level rules can impose strict daily limits. For example, Colorado's 2025 Virtual Currency Kiosk Act set a $2,000 daily cap per customer, but limits vary widely by jurisdiction and operator.
After initial identification, operators conduct customer due diligence to establish a risk profile. This involves assessing factors such as transaction history, location, expected volume, and the source and intended use of funds. A customer who regularly buys small amounts of Bitcoin will be treated differently from someone making large, rapid, or geographically dispersed transactions. When risk indicators are elevated, enhanced due diligence may be triggered, requiring additional documentation or manual review.
Transaction Monitoring and Blockchain Analytics
Modern crypto ATM compliance relies heavily on transaction monitoring systems that flag suspicious patterns. These systems look for behaviors such as structuring (breaking up large amounts into smaller transactions), rapid increases in activity, use of multiple machines, or transfers to wallets linked to high-risk jurisdictions or known illicit activity. Automated alerts do not automatically prove wrongdoing but prompt further investigation by compliance staff.
Blockchain analytics add another layer by screening wallet addresses for exposure to scams, ransomware, sanctioned entities, or darknet markets. Operators can check the risk profile of a destination wallet before completing a transaction and continue monitoring after funds are sent. While these tools are powerful, they are not foolproof-risk scores may reflect indirect exposure or incomplete attribution, so human judgment remains essential.
Scams, Consumer Protection, and Regulatory Pressure
One of the fastest-growing threats to crypto ATM users is scams that target vulnerable individuals, especially older adults. According to the FBI's Internet Crime Complaint Center, more than 13,400 cryptocurrency-kiosk complaints were filed in 2025, with reported losses exceeding $388 million. Over half of these complaints involved people over 50, and losses among that group topped $302 million. Scammers often impersonate banks, government officials, or tech support, instructing victims to withdraw cash and send it to a QR-coded wallet at a crypto ATM.
Operators and lawmakers have responded by adding prominent scam warnings to machines and tightening transaction limits. Some states have enacted new rules since 2023, and the regulatory trend is global. In August 2026, Australia's AUSTRAC suspended Cryptolink's registration for three months, citing concerns about its ability to manage high-risk transactions and meet AML obligations. This case highlights the shift from having an AML policy on paper to demonstrating that controls work in practice. For context, the growth of tokenized real-world asset trading and regulatory scrutiny was also explored in EgonCoin's coverage of Hyperliquid's RWA trading surge and ETF inflow slowdown.
Reporting and Compliance Challenges
When suspicious activity is detected, U.S. crypto ATM operators classified as money services businesses must comply with Bank Secrecy Act requirements, including filing Suspicious Activity Reports (SARs) and Currency Transaction Reports (CTRs) when thresholds are met. Compliance teams review customer information, transaction patterns, wallet exposure, and explanations provided by users before deciding whether to escalate or report an incident. The Financial Crimes Enforcement Network (FinCEN) has warned that failure to meet these obligations increases the risk of crypto ATMs being used for illicit purposes.
AML systems are not perfect. False positives are common, and criminals adapt their behavior to avoid detection. Scam victims present a particular challenge, as traditional models were designed to catch suspicious customers, not those being manipulated. Operators must regularly update their risk models and controls to keep pace with evolving threats and regulatory expectations.
According to the FBI's 2025 data, crypto ATM-related scam losses have reached record highs, with older adults disproportionately affected. As of June 2026, more than 30 U.S. states have enacted crypto-kiosk legislation since 2023, including 13 new laws in 2026, reflecting growing concern over consumer protection and financial crime risks in the sector.
AML compliance for crypto ATMs is a dynamic process that requires ongoing monitoring, risk assessment, and adaptation. While technology can flag suspicious activity, human oversight and regulatory alignment remain critical to protecting both the financial system and vulnerable users.
Crypto ATM AML compliance illustrates the complexity of bridging physical cash and digital assets. Unlike traditional bank transfers, crypto ATMs must manage risk with limited transaction context and fast-moving blockchain transfers. The combination of automated monitoring, blockchain analytics, and human review is essential, but no system can perfectly distinguish between a scam victim and a money launderer. As regulations evolve and criminal tactics change, operators must continually refine their controls to balance access, security, and consumer protection.
