Alabama's enrolled HB303 creates the Cryptocurrency Kiosk Fraud Prevention Act and adds Section 8-7A-28 to the Code of Alabama 1975, requiring kiosk operators to provide disclosures, receipts, fraud-protection measures, refunds for fraudulently induced transactions, and barring privacy coins—with civil and criminal penalties attached. The act becomes effective October 1, 2026.
For operators, October 1 is a hard compliance deadline, not a soft launch. The statute caps how much money customers can move through a kiosk, makes operators financially responsible for refunding certain scam victims, and names the Alabama Securities Commission (ASC) as the enforcer. If you run kiosks in Alabama, the configuration work—transaction limits, fraud disclosures, refund workflows, and privacy-coin blocks—needs to be substantially complete before the fourth quarter begins.
What HB303 Actually Requires
The Cryptocurrency Kiosk Fraud Prevention Act bundles several distinct obligations that, together, reshape how a kiosk transaction can legally occur in Alabama.
HB303 Core Requirements:
- Disclosures and receipts: Operators must provide consumer disclosures and transaction receipts.
- Fraud-protection measures: Operators must implement measures designed to protect consumers from fraudulently induced transactions.
- Transaction limits: New consumers are limited to $1,000 per day and $10,000 per calendar month; existing consumers are limited to $10,500 per day.
- Refund duties: Operators must refund fraudulently induced transactions on defined terms when statutory reporting steps are completed.
- Privacy-coin prohibition: Operators may not permit the buying, selling, or sending of privacy coins from cryptocurrency kiosks or online platforms.
- Enforcement: The Alabama Securities Commission may assess civil penalties for violations, and the act carries civil and criminal penalties.
The Transaction Caps: A Two-Tier Structure
HB303 distinguishes between new consumers and existing consumers, and the gap between them is deliberate. A new consumer—someone without an established transaction history with the operator—faces the tightest limits: $1,000 per day and $10,000 per calendar month. An existing consumer operates under a single daily ceiling of $10,500.
The tiered structure forces operators to verify customer identity and transaction history before permitting higher-value transactions. That verification is not optional. Operators must build or configure systems that distinguish first-time users from returning customers and apply the correct cap in real time.
The logic tracks the fraud data. First-time kiosk users coached by phone scammers are the highest-risk population, so the statute throttles how much a brand-new customer can lose. A $1,000 daily cap and a $10,000 monthly cap mean a victim being walked through a machine for the first time cannot hemorrhage tens of thousands of dollars before anyone intervenes.
The Refund Provision: A New Liability for Operators
The most consequential provision for operators is the mandatory refund requirement, and HB303 splits it by consumer type. For a fraudulently induced transaction by a new consumer, the operator must provide a full refund plus fees—provided the statutory reporting steps are completed. For a fraudulently induced transaction by an existing consumer, the operator must refund one-half of the transaction value, including fees, on the same condition.
To qualify, the defrauded consumer must complete a defined reporting sequence: contact the operator, law enforcement, and the Alabama Securities Commission, and file a report—all within 60 calendar days of the transaction.
Refund mechanics at a glance:
- New consumer: Full refund plus fees if reporting steps are completed.
- Existing consumer: One-half of transaction value, including fees, if reporting steps are completed.
- Reporting deadline: Contact the operator, law enforcement, and the ASC, and file a report within 60 calendar days of the transaction.
This shifts the financial burden of fraud from victims to operators—a structural change that converts scam losses from a pure customer problem into a direct cost on the operator's balance sheet. It also gives operators a concrete incentive to detect and interrupt scams at the point of sale, precisely the moment when a coached victim is feeding cash into a machine.
The 60-day clock is unforgiving. A defrauded consumer who misses any of the three required contacts—or files the report late—may forfeit the statutory refund entirely. Operators should treat the refund duty as a live liability line, not a disclosure footnote.
The Privacy-Coin Prohibition
HB303 bars operators from permitting the buying, selling, or sending of privacy coins—anonymity-enhanced cryptocurrencies designed to obscure transaction trails—not only from cryptocurrency kiosks but also from online platforms. That dual scope is notable: the prohibition does not stop at the physical machine.
Privacy coins defeat the blockchain forensics law enforcement relies on to trace stolen funds, which is why they draw legislative attention in fraud-prevention statutes. Most major kiosk operators already do not support privacy coins at the point of sale, so for the largest players the kiosk-side prohibition may be a formality. The online-platform language is the piece operators with companion web services should scrutinize most closely before October 1.
Enforcement: The Alabama Securities Commission
HB303 names the Alabama Securities Commission as the enforcing authority and empowers it to assess civil penalties for violations. The act also carries criminal penalties. Locating enforcement at the securities regulator—rather than a general consumer-finance agency—signals that Alabama views kiosk fraud as an investor-protection matter, and state securities regulators have historically moved faster and more aggressively than federal agencies on crypto enforcement.
The refund duty and the reporting requirement are written directly into the statute, which means a defrauded consumer who completes the 60-day reporting sequence has a statutory claim against the operator independent of any separate ASC action. Operators should assume both channels—consumer-initiated claims and ASC penalty authority—are live.
What This Means for Alabama Consumers
Alabamians who use crypto kiosks gain concrete protections—but only for transactions occurring on or after October 1, 2026, and only within the law's limits and deadlines.
If you use a crypto ATM in Alabama after October 1, 2026:
- Expect on-screen disclosures and a printed receipt before completing a transaction. Read the warnings—they describe the exact scams that drain victims' accounts.
- As a new customer, you cannot move more than $1,000 per day or $10,000 per calendar month through any single operator's kiosks. If someone is pressuring you to send more—or to split a payment across multiple machines—that pressure is itself a red flag.
- If you are defrauded, you may recover a full refund (new consumers) or one-half of the transaction value (existing consumers), including fees—but only if you contact the operator, law enforcement, and the Alabama Securities Commission, and file a report, within 60 calendar days.
- Document everything immediately: the kiosk location, transaction time, your receipt, and the person who directed you to the machine.
- Never let anyone on the phone walk you through a kiosk transaction. No legitimate agency, utility, or company collects payment this way. File complaints with the Alabama Securities Commission and review our consumer protection resources before using any kiosk.
What This Means for Operators
October 1 is the deadline, and the compliance checklist is concrete. Operators with Alabama kiosks need to configure transaction-limit logic to the statute's tiers, stand up disclosure and receipt workflows, document and staff refund procedures, and disable privacy-coin buying, selling, and sending across both kiosks and any online platforms.
Operator compliance checklist for October 1:
- Configure new-consumer caps ($1,000/day, $10,000/calendar month) and existing-consumer caps ($10,500/day) into kiosk transaction logic—including logic to distinguish new from existing consumers.
- Build refund workflows that handle the two-tier structure: full refund plus fees for new consumers, one-half plus fees for existing consumers, gated on completed reporting.
- Establish a 60-day intake process so consumer reports to the operator are logged, time-stamped, and reconciled against law-enforcement and ASC filings.
- Ensure consumer disclosures and printed receipts are live at every Alabama kiosk.
- Disable privacy-coin buying, selling, and sending on both kiosks and online platforms accessible to Alabama consumers.
- Price the refund duty into Alabama unit economics—it is a recurring liability, not a one-time build cost.
The refund split between new and existing consumers is worth modeling carefully. Because new consumers are entitled to a full refund plus fees, the operator's fraud exposure on first-time customers is total—precisely the population already capped at $1,000 per day. The cap and the full-refund duty work in tandem: Alabama limits new-customer exposure on the front end and shifts the loss entirely to the operator when fraud is established.
What to Watch Before October 1
The open questions for operators are operational. Will the ASC publish guidance defining which assets count as "privacy coins," and how operators must verify the new-versus-existing consumer distinction that drives both the limits and the refund tiers? How quickly must an operator process a refund once a consumer completes the 60-day reporting sequence, and what documentation satisfies the statutory threshold for a "fraudulently induced transaction"?
The enrolled text sets the duties and the deadline; the first enforcement actions and civil-penalty assessments after October 1 will reveal how aggressively the Alabama Securities Commission intends to use them. Until then, the statute's text—not agency guidance—defines the compliance floor.