Operating Bitcoin ATM Business in the US: MTL & AML/BSA Guide

February 18, 2021  |   By: Max Dilendorf, Esq.

A recent surge in the acceptance of Bitcoin as a payment mode has led to a spike in Bitcoin ATM installations. According to the data source, Coin ATM Radar, Bitcoin ATM installations increased by 85 percent before the end of 2020, with 11,798 machines being added last year. Fears surrounding coronavirus have also propelled growth within the contactless payment market. Consequently, Bitcoin’s borderless network of money transfers is even more attractive to investors.

A Bitcoin ATM allows an individual to purchase the cryptocurrency directly from the operator, without going through an exchange. Some machines are one-way, allowing for the purchase of Bitcoin only, while others facilitate the purchase of bitcoin and the sale of cryptocurrency for cash.

Some would-be ATM operators have expressed confusion over state-by-state cryptocurrency regulations, and how to comply with FinCen’s KYC and AML requirements. As experts in all aspects of cryptocurrency and related laws, the Dilendorf Law Firm is fully equipped to help clients set up a Bitcoin ATM that meets all of the state and federal requirements.

Key information about setting up a Bitcoin ATM

Every state has different laws and requirements regarding the setup and operation of Bitcoin ATMs. For example, some states require a money transmitter license (MTL), while others do not. When embarking on such an endeavor, it is important to follow the state laws, while also maintaining compliance with all of the FinCen KYC and AML regulations.

Obtaining the necessary licenses and letters

Even if the ATM will be operated in one of the 35 states that currently do not require an MTL, it is recommended for an operator to obtain a no-action letter from the state. For example, California, Georgia, and Florida are three of the states that allow for the buying and selling of cryptocurrency through an ATM, while Arizona, Maryland and North Carolina are “buy only” states. Knowing whether your state is on one of these lists is an important first step in obtaining the proper permissions.

For example, South Carolina’s Office of the Attorney General determined that:

The exchange of virtual currency for fiat currency through an ATM that acts as a third party exchanger that facilitates contemporaneous exchanges of virtual currency for fiat currency, such as where the operator of the ATM receives the buyer’s fiat currency in exchange for a promise to make it available to the seller, is money transmission and requires a license under the Act.  When an ATM does not act as a third-party, and only facilitates a sale or purchase of virtual currency by the ATM operator directly with the customer, there is no money transmission because at no time is fiat currency received an exchange for a promise to make it available at a later time or different location, and therefore no license is required under the Act.

How the Dilendorf Law Firm can help

Our team has been immersed in all aspects of crypto for the past five years. Thousands of hours of research, analysis and face-to-face meetings with top industry contacts and regulators enabled us to develop a cutting-edge legal framework for issuing, launching and trading digital securities in the US.

We work diligently to keep abreast of new developments governing this fast-paced industry, including federal and state securities, tax and consumer-protection laws, broker-dealer, anti-money laundering (AML) and know-your-customer (KYC) regulations, as well as the local and international market dynamics.

For our clients considering the launch of a Bitcoin ATM, the Dilendorf Firm offers guidance and advice on incorporating the necessary AML and KYC checks, selecting vendors, and abiding by all state and federal laws.

How hard is it to set up a Bitcoin ATM?

As mentioned above, the level of difficulty in setting up the ATM is primarily dependent upon state laws. Aside from determining which laws pertain to that state, it is usually necessary to obtain a no-action letter from the state.  When requesting such a letter, it is important to include explanatory and detailed information about the proposed ATM, including its location, vendor name and machine type, description of the company’s AML/BSA policies and the business plan.

What type of machine is best?

The type of machine a company can operate will largely depend on the state where the machine will be located. Only a handful of states are currently allowing for Bitcoin ATMs that buy and sell. Most of the 35 states allowing ATMs are “buy only” states.

Our firm has worked with numerous ATM vendors and we are aware of the nuances between machines, including how well their software and internal processes addresses AML and KYC compliance issues. It is important to note that Bitcoin ATMs are currently cash only. The financial industry has yet to work through the legal issues of allowing for the use of credit cards, but we are told this could be coming soon.

How can Bitcoin ATMs comply with KYC and AML requirements?

It is important for any company looking to launch an ATM to develop their own AML and KYC policies, as these will be set up within the ATM’s CAS software. Most vendors use cloud services that keep everything compliant, but it is important to ask for specifics. Third-party services are often used to provide automated and compliant KYC verification. Without such a setup, registration within the software would need to be approved manually.

BSA/AML/OFAC Compliance Program

The Bank Secrecy Act (BSA) requires Bitcoin ATM operators to establish and maintain an effective written AML program reasonably designed to prevent ATM machines from being used to facilitate money laundering and the financing of terrorist activities.   The best practice  AML/BSA should include KYC and customer identification program, transaction monitoring, a designated BSA compliance officer, recordkeeping and record retention requirements and periodic independent reviews.

What happens when a customer approaches the machine?

Know-Your-Customer (KYC) verification is done in a number of ways. First, the operator will request certain pieces of information from the customer. Most vendors support validation through the following methods:

  • Cell phone number
  • Selfie
  • ID Card Scans
  • Two Documents confirming identity
  • Fingerprint scans
  • Email address
  • Name
  • Third-party validation.

Additionally, each ATM will incorporate security measures within its validation software. These include:

  • TeleSign Integration: Utilizes CAS within a phone identity check and can restrict transactions to customers with a “known” phone identity. When enabled, a customer’s phone number will be checked against a list maintained by the telecom provider, which can mitigate certain fraud tactics.
  • Rejecting PEPs: A PEP is a politically exposed person, who has been entrusted with a prominent public function. By virtue of their position and influence, these individuals generally represent a higher risk for potential bribery and corruption. When enabled within the CAS, transactions by PEPs can be rejected.
  • OFAC Scan: During the validation/approval process, an individual can be checked against the OFAC Sanctions List, and depending on the result, the Operator may reject or register the individual.
  • EU Sanction List: Similarly, the Operator can compare an identity against the EU Sanctions List, and then manually reject or register the individual based on results.
  • CipherTrace: By using a “transaction scoring” process, high-risk wallet addresses (as defined by CipherTrace) can be rejected when presented as a buyer, and incoming coins will not automatically be enabled for cash withdrawals.
  • Limits: By setting up generic limits for their customers, ATM Operators can restrict individual transaction amounts on a more granular level. For example, the Operator could limit customers to a certain amount of cash per transaction, per hour, per day, week, month, or longer.

Also, machine limits may be imposed that restrict location amounts, not just the Identity – preventing mule operations at specific locations.

Mechanics of Bitcoin ATMs

Operators should be aware of the strict regulations required, and design programs that meet their individual state’s requirements.

It is currently not legal for a customer using an ATM to purchase Bitcoin directly from an exchange. Instead, when a transaction is made the software sends the coins from the Operator’s hot wallet to the customer’s hot wallet. Afterward, the software buys back the transaction difference from the exchange to the Operator’s wallet, as a way to keep the wallet topped up.

The Bitcoin comes to the customer through the owner of the ATM, and that owner/operator takes a commission of 5 to 6 percent. Additionally, the ATM machine company takes 0.5 to 4 percent commission. Users should be made aware of how these commissions might impact their margins on the investment.

Recent FinCen proposal: How do ATMs comply?

A recent notice of proposed rulemaking (NPRM) from FinCen requires all transactions above $3,000 in value to go through additional KYC and AML checks, which require the operator to perform additional steps to verify the user’s identity. These proposed new rules are designed to prevent cybercrimes in the crypto industry, specifically scams involving money laundering, but add extra burdens for small businesses in the crypto space.

How to ensure a Bitcoin ATM is fully compliant with the law

When launching a new ATM, it is important to work with a professional legal consultant specializing in cryptocurrency compliance. Our team at the Dilendorf Law Firm knows how to ensure that ATM operators meet all state and federal requirements and will confirm that a Bitcoin ATM vendor provides the required level of security checks to ensure full compliance with the law.


State Money Transmitter Licensing Authorities:

State State Money Transmitter Licensing Authority
Alabama Alabama Securities Commission
Alaska Alaska Division of Banking and Securities
Arizona Arizona Department of Financial Institutions
Arkansas Arkansas Securities Department
California California Department of Business Oversight
Colorado Colorado Division of Banking
Connecticut Connecticut Department of Banking
Delaware Delaware Office of the State Bank Commissioner
District of Columbia District of Columbia Department of Insurance, Securities and Banking
Florida Florida Office of Financial Regulation
Georgia Georgia Department of Banking and Finance
Hawaii Hawaii Department of Commerce and Consumer Affairs
Idaho Idaho Department of Finance
Illinois Illinois Department of Financial & Professional Regulation
Indiana Indiana Department of Financial Institutions
Iowa Iowa Division of Banking
Kansas Kansas Office of the State Bank Commissioner
Kentucky Kentucky Department of Financial Institutions
Louisiana Louisiana Office of Financial Institutions
Maine Maine Office of Consumer Credit Protection
Maryland Maryland Department of Labor, Licensing & Regulation
Massachusetts Massachusetts Office of Consumer Affairs and Business Regulation
Michigan Michigan Department of Insurance and Financial Services
Minnesota Minnesota Department of Commerce
Mississippi Mississippi Department of Banking and Consumer Finance
MIssouri MIssouri Division of Finance
Montana Montana Division of Banking & Financial Institutions
Nebraska Nebraska Department of Banking and Finance
Nevada Nevada Department of Business & Industry
New Hampshire New Hampshire Banking Department
New Jersey New Jersey Department of Banking & Finance
New Mexico New Mexico Regulation and Licensing Department
New York New York Department of Financial Services
North Carolina North Carolina Commissioner of Banks
North Dakota North Dakota Department of Financial Institutions
Ohio Ohio Department of Commerce
Oklahoma Oklahoma Banking Department
Oregon Oregon Division of Financial Regulation
Pennsylvania Pennsyvlania Department of Banking and Securities
Rhode Island Rhode Island Department of Business Regulation
South Carolina South Carolina Attorney General
South Dakota South Dakota Division of Banking
Tennessee Tennessee Department of Financial Institutions
Texas Texas Department of Banking
Utah Utah Department of Financial Institutions
Vermont Vermont Department of Financial Regulation
Virginia Virginia State Corporation Commission
Washington Washington State Department of Financial Institutions
West Virgnia West Virginia Division of Financial Institutions
Wisconsin Wisconsin Department of Financial Institutions
Wyoming Wyoming Division of Banking

New York



  • OFR-560-01 – Application to Register as a Money Services Business
  • OFR-560-02 – Location Notification Form
  • OFR-560-03 – Declaration of Intent to Engage in Deferred Presentment Transactions
  • OFR-560-04 – Money Services Business Quarterly Report Form
  • OFR-560-05 – Pledge Agreement
  • OFR-560-06 – Money Services Business Surety Bond Form
  • OFR-560-07 – Security Device Calculation Form
  • Chapter 560, Florida Statutes – Money Services Businesses
  • Rule 69V-560, Florida Administrative Code – Money Transmitters
  • Form OFR-560-09 – Disciplinary Guidelines for Money Services Businesses
  • Security Device Calculation Form


This article is provided for your convenience and does not constitute legal advice. The information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations. Prior results do not guarantee a similar outcome.

Other Resources


Our Founding Partner


Max (Maksim) Dilendorf, Esq.

Max (Maksim) Dilendorf’s legal practice is laser-focused on digital assets and cyber-crime cases, a domain he has passionately pursued since 2017. Over the past 7 years, Max built a distinct digital asset law practice, dedicating tens of thousands of hours to managing diverse client cases, research and engaging ...

Learn More about Max (Maksim) Dilendorf, Esq.
Max (Maksim) Dilendorf, Esq.

Adam Pollock

Adam is one of the nation’s leading young whistleblower lawyers.  He brings with him a special ability not just to litigate, but to investigate – and understand – complex organizations and transactions.  His extensive familiarity with tech issues is built on a computer science degree and work as a ...

Learn More about Adam Pollock
Adam Pollock

Bari Zahn, Esq.

Bari Zahn has nearly 20 years of experience practicing at global law firms in New York. Bari has represented a broad array of multinational clients on U.S. and cross-border transactions. She has supervised legal teams worldwide and has extensive management experience as the Founder, former CEO and General ...

Learn More about Bari Zahn, Esq.
Bari Zahn, Esq.

Steve Cohen

Steve contributes extensive business and problem-solving experience to challenges that may require litigation – or may help avoid it.  Indeed, his perspective on litigation is influenced by his experience as a three-time internet start-up CEO.

Steve served on Ronald Reagan’s 1980 presidential campaign ...

Learn More about Steve Cohen
Steve Cohen

Robin Gerofsky Kaptzan, Esq.

A New York licensed attorney with three decades of legal and business experience in the U.S. and Asia, Robin recently joined the law firm as a partner and leads the Asia-Pacific practice.

While acting as an international business lawyer and global corporate general counsel, Robin is sought out by clients ...

Learn More about Robin Gerofsky Kaptzan, Esq.
Robin Gerofsky Kaptzan, Esq.

Craig S. Redler

Craig S. Redler has held positions with Amicorp in its offices in Auckland New Zealand and Miami Florida, and Southpac Trust International, Inc. with offices in the Cook Islands and Tauranga New Zealand. His responsibilities included serving as Trustee for off-shore trusts settled by high net-worth clients ...

Learn More about Craig S. Redler
Craig S. Redler