Alaska's Bitcoin ATM Law Takes Effect Oct 1 - The Industry Has Itself to Blame

The phone rings. The voice knows your name, maybe your grandson's name too. He's calling from the Alaska State Troopers, he says. Or the IRS. Or your bank's fraud department.

There's a warrant out. Your accounts have been compromised. Whatever the story, there's
one fix, and it has to happen now: drive to the gas station on the corner, find the machine
that looks like an ATM but says "Bitcoin" across the top, and start feeding it cash.

I've read enough of these scripts by now that I could recite one from memory. So could the Alaska legislature, apparently, because that's what Senate Bill 249 does. It takes effect
October 1, 2026, and it doesn't ban Bitcoin ATMs.

What it does is regulate them more tightly than almost any other consumer financial product in the state, with a level of granularity that tells you the drafters weren't working from a hypothetical.

They were working from someone's actual mother.

SB 249 passed the Alaska Senate 20-0. It passed the House 40-0. Then the Senate concurred in the House's amendments, 20-0. Zero no votes, anywhere, on a bill that hands the state licensing authority, transaction caps, and strict liability over an entire financial technology sector.

In a legislature that argues about almost everything, this one didn't argue.

The sponsor was Sen. Cathy Tilton (R-Wasilla), and she hasn't been shy about why. Her
mother was targeted by scammers who walked her straight to a cryptocurrency kiosk.

Tilton has brought that story up in committee testimony, in op-eds, in press statements, enough times that it clearly wasn't a talking point, it was the reason the bill exists, with fifteen cosponsors behind it by the end.

The numbers back her up. Alaska's Attorney General and the bill's sponsors have pointed to FBI figures showing Alaskans lost more than $26 million to online fraud in 2024 alone, with seniors eating roughly a third of that.

A more specific number tied to the legislative record: $16.25 million lost across 600-plus senior victims, with crypto kiosks flagged as the fastest growing cash-out tool criminals use to get stolen money somewhere untraceable.

Alaska's Department of Law put out its own warning earlier this year: no legitimate bank, business, or officer will ever tell you to feed cash into a crypto ATM. That line, more or less verbatim, is now baked into the statute.

This isn't a short bill. It adds a whole new article to Alaska's money transmission statute, and it's more granular than most state financial legislation I've read this year. A few pieces
matter more than the rest.

Every kiosk operator needs a money transmission license, the statute defines operating a
virtual currency kiosk as money transmission, and every physical location has to be
registered with the Department of Commerce, Community, and Economic Development
before it can take a dollar.

Transactions are capped at $1,000 per user per day, $10,000 per user over any 30-day
stretch, and that cap applies across everything the operator offers so you can't route around it through some online side-channel. Fees top out at 10 percent of the transaction.

Worth pausing on that number: CoinFlip, the second-largest operator in the country, has disclosed fees running anywhere from about 5 to nearly 22 percent depending on where you are.

A 10 percent ceiling knocks out the worst offenders. It doesn't touch what a decently-run operator was already charging.

Then there's the warning language, and this is the part that reads like it was written by
someone who's actually stood next to a victim mid-scam. The statute requires this, close to
word for word, printed on every kiosk:

Operators also have to disclose, in plain terms, that virtual currency isn't legal tender, isn't
insured by the FDIC or SIPC, and can lose value fast, and get an actual acknowledgment from the customer before the transaction goes through, not a buried checkbox.

ID verification is mandatory. Government-issued ID, name, date of birth, phone, address,
email, collected before any cash changes hands. Every transaction gets run through
blockchain analytics to flag wallets tied to known fraud or to overseas exchanges that
shouldn't be touching US money at all.

The state gets quarterly location reports and a heavier annual report covering revenue, complaints, refunds paid out, and Bank Secrecy Act filings. There's a dedicated line, staffed in the US, for law enforcement, and operators are on the hook to hand over trace data when asked.

If fraud is proven, the victim gets everything back, the transaction and all fees, as long as they report within 90 days and follow up with a police report or sworn statement within 120 days of that.

One clause deserves its own paragraph, because it's the one that should be sitting in every
operator's inbox right now: violating the ID-verification requirement is strict liability. Not
negligence. Not recklessness. There's no good-faith exception written in anywhere. Miss the check once, and you're already liable.

Take the politics out of it, and what you've got is a fairly standard money-services-business
regime with three features that aren't standard at all: an aggressive fee cap, mandatory
blockchain analytics, and that strict liability clause hanging over KYC.

The strict liability piece is the one I'd flag first if I were advising an operator. Most states tie
compliance failures to some standard of care; did you act negligently, recklessly, willfully?
Alaska skipped that step entirely.

One lapsed ID check is a violation regardless of intent, and it's independently an unfair trade practice under AS 45.50.471, which opens the door to civil penalties, seizure of the machine, and forfeiture of fees earned during the period you were out of compliance.

That's a different risk category than the licensing exposure operators are used to.

There's also a tension here that hasn't gotten nearly enough air time. The same ID requirement that gives a scam victim a "speed bump" to break the spell also means Alaska
now has a running, quarterly record of exactly who is converting cash into bitcoin, how
much, and which wallet it's landing in.

For a technology whose whole draw, for a lot of people, is that it doesn't ask permission and doesn't generate a government paper trail, that's not a footnote. Consumer protection and financial privacy don't have to be at odds.

Here, they are, and the legislature picked a side without much debate about the trade-off it was making.

None of which makes the law wrong, to be clear. The fraud numbers are real. The victims are real people, not statistics for a floor speech. And an industry that spent years treating "know your customer" as a suggestion rather than a rule brought this on itself.

An industry that won't police its own machines eventually gets policed by someone else's
legislature, and that legislature won't be gentle about it.

Alaska isn't out ahead of anyone here. It's catching up.

Legal trackers now count something like two dozen-plus states that have introduced or passed crypto kiosk regulation over the last two years, and most of them are converging on the same playbook Alaska just adopted, licensing, transaction limits, fraud warnings, analytics, refund rights.

Wisconsin and South Dakota passed similar laws this year. Indiana went further and banned the machines entirely back in March. Tennessee and Minnesota did the same. New Jersey is debating a ban right now, and the industry's biggest operators have already testified against it, and lost.

Meanwhile the Crypto ATM Fraud Prevention Act of 2025, S. 710, has been sitting in the
Senate Banking Committee since February 2025 with no floor vote in sight. So states are
writing the actual rules for this industry, one legislature at a time, and nobody in Washington looks close to stepping in to preempt any of it.

Read against that backdrop, SB 249 isn't really an Alaska story at all. It's the national floor
hardening into place; license it, cap it, disclose it, put liability behind it, while a smaller but
growing list of states decides that floor still isn't enough and reaches for a ban instead.

Every operator still standing has effectively already chosen which of those two futures it's betting on.

Track how this plays out in states considering similar bills, and get analysis like this twice a
week, at thebitcoinact.xyz.

Satoshi’s Lawyer: The author is a Bitcoin Counsel and writer of The Bitcoin Act, a twiceweekly Bitcoin-only legal intelligence newsletter followed by 800+ Bitcoiners.

Twitter/X: @The_Bitcoin_Act
Nostr: [email protected]