Alabama law adds refunds and limits for crypto ATMs

The Cryptocurrency Kiosk Fraud Prevention Act took effect in Alabama on 1 October 2026, changing refund entitlements, transaction limits and fraud disclosures for cryptocurrency ATM operators.

The Alabama Securities Commission announced the effective date on 30 September and described the Act’s obligations. The Commission’s material is an official explanation of the statute, not an adjudication of any operator’s conduct or liability.

For a new consumer fraudulently induced to make a cryptocurrency ATM transaction, the operator must issue a full refund of the transaction value and all fees. For an existing consumer, the refund is one-half of the transaction value plus all fees.

The customer must complete three steps within 60 calendar days of the transaction:

- Contact the operator.
- Contact a law enforcement agency and the ASC.
- File a report with a law enforcement agency or the Commission concerning the fraudulently induced transaction.

The ASC material does not specify the operator’s investigation process or how a dispute over fraudulent inducement must be resolved. It identifies the refund amounts and the customer-facing deadline once the statutory conditions are met.

Limits and disclosures apply from the effective date

The Act prevents an operator from executing a transaction when a new consumer exceeds $1,000 in a single day or $10,000 in a month. It defines a new consumer as a person making a first transaction and transactions during the following 30 days.

The provision has implementation implications for transaction-limit controls. Operators will need to apply the statutory definition and thresholds, but the supplied ASC material does not specify the technical method for linking transactions, whether limits apply across terminals or how the controls must be configured.

Operators must display all fees collected by the operator, the total amount in cryptocurrency and US dollar value, the exact US dollar amount of the transaction, the exchange rate and the cryptocurrency charged to the customer.

They must also provide information to help customers recognise fraud or scams and prompt users with questions designed to put them on notice of potential fraud. The ASC said the Act provides a dedicated United States-based customer service line and penalties for noncompliance. The material does not state the penalty amounts or service-level requirements.

ASC Director Amanda Senn said: "If someone is directing you to deposit money into a crypto ATM, you are likely being scammed." She said the Act would not eliminate fraud attempts but would minimise financial losses through additional protections and refunds.

The ASC material identifies cryptocurrency ATM and kiosk operators and the consumers using those machines as the parties affected by the statutory changes. It does not specify a technical implementation method, a cross-terminal aggregation rule, an operator refund workflow or an enforcement timetable. Those matters cannot be resolved from the announcement alone.

The Act’s effective date is 1 October 2026. The supplied ASC material identifies no next docket or implementation event and does not specify penalty amounts, service-level requirements or the process for resolving disputes over fraudulent inducement.