Bitcoin Depot's Compliance Fix Lasted Nine Months: New CCO Tony Gagliardi Replaces Phillip Brown

Bitcoin Depot (NASDAQ: BTM) hired Phillip Brown in July 2025 as Chief Compliance Officer with an explicit mandate: fix the compliance failures at the center of a growing wave of attorney general enforcement actions. Less than nine months later, Brown is out — replaced by Tony Gagliardi, whose appointment became effective April 8, 2026, according to a company press release dated April 13. The SEC processed the corresponding EFFECT filing on April 10.

This is not routine executive turnover. Brown was the announced compliance rescue operation. Bitcoin Depot introduced him via a full GlobeNewswire press release on July 21, 2025, positioning the hire as a direct response to regulatory pressure over scam facilitation and fee transparency. His departure — without public explanation — means the very fix the company told investors and regulators it was implementing has already failed or been abandoned. For an operator facing active lawsuits from the Massachusetts and Iowa attorneys general, plus a civil investigative demand from Missouri, losing the person brought in to solve the compliance crisis raises serious questions about what went wrong and whether Gagliardi can succeed where Brown did not.

Brown Was the Fix — And the Fix Didn't Hold

When Bitcoin Depot hired Phillip Brown on July 21, 2025, the company was already deep in regulatory trouble. The Massachusetts Attorney General had filed a consumer protection and securities fraud lawsuit on February 3, 2025, alleging that more than 80% of customers depositing $10,000 or more were scam victims — and that the company generated $10.6 million in scam-related revenue. The Iowa Attorney General had filed a parallel consumer protection lawsuit on February 26, 2025. Missouri's civil investigative demand, issued in December 2024 as part of a simultaneous probe targeting five major operators, added a third front.

Brown's hiring was a signal to regulators and investors that Bitcoin Depot was taking the compliance crisis seriously. His July 2025 introduction via a detailed press release — with biography and professional background — followed the playbook companies use when they want the market to see a leadership change as substantive, not cosmetic.

Now Brown is gone, and Bitcoin Depot has offered no explanation. The company's April 13 press release announcing Gagliardi's appointment does not mention Brown's departure, does not explain the circumstances of the transition, and does not include a biography for the new CCO. The contrast with Brown's own introduction — a full GlobeNewswire release with professional details — is stark.

What Bitcoin Depot Said (and Didn't Say)

Bitcoin Depot did issue a press release about Gagliardi's appointment on April 13, 2026, which was picked up by outlets including Investing.com. But the release is thin. It announces Gagliardi as the new CCO with an effective date of April 8, 2026, and little else. Notably absent:

For a publicly traded company under active investigation by multiple state attorneys general — where the core allegation is compliance failure — this level of disclosure is inadequate. When Bitcoin Depot appointed Alex Holmes as CEO on March 24, 2026, it filed an 8-K and issued a detailed press release with his background. When it hired Brown last July, it did the same. Gagliardi gets a bare-bones announcement. The discrepancy suggests the company either doesn't want to draw attention to the transition or doesn't yet have a narrative for it.

The Compliance Crisis Gagliardi Inherits

Gagliardi is stepping into one of the most exposed compliance roles in the Bitcoin ATM industry. The issues are not hypothetical — they are the subject of active litigation:

The securities fraud dimension of the Massachusetts case is particularly significant for a CCO. That lawsuit alleges Bitcoin Depot misled investors about scam rates on its platform — meaning the compliance function's handling of scam data and its communication to SEC filings is directly at issue. Brown was presumably working on this problem. Gagliardi now inherits it, potentially without the institutional knowledge Brown built over his months in the role.

A Pattern of Executive Churn

The CCO swap is the latest in a series of rapid leadership changes at Bitcoin Depot that, taken together, paint a picture of an organization in flux at precisely the moment it needs stability:

Buchanan's CEO tenure lasted less than three months. Brown's CCO tenure lasted less than nine. The company has not publicly explained either departure. For regulators already skeptical of Bitcoin Depot's compliance infrastructure, this level of churn in the two roles most responsible for regulatory engagement and corporate governance is not reassuring.

Each new leader needs time to assess the organization, build relationships with examiners and opposing counsel, and develop strategy. When a company is simultaneously defending multiple lawsuits and responding to investigative demands, that onboarding clock is a liability — not just an inconvenience.

Why This CCO Change Is Different

At a typical publicly traded company, a CCO transition might be routine. At Bitcoin Depot, it represents the failure of a specific, publicly announced strategy.

Companies under regulatory pressure typically follow a predictable arc: acknowledge the problem, hire a seasoned compliance professional, announce the hire publicly to signal reform, then give that person time and authority to fix things. Bitcoin Depot followed steps one through three with Brown. Step four — letting the fix work — never happened. Nine months is not enough time to overhaul a compliance program at a company operating in 33 states plus Puerto Rico, especially while actively litigating with multiple attorneys general.

The core allegation across the AG actions is that Bitcoin Depot's compliance function failed to prevent — and may have profited from — scam transactions targeting vulnerable consumers, including elderly victims. The Massachusetts AG specifically alleges the company knew about high scam rates among large-value customers and did not take adequate steps to intervene. The CCO is the person ultimately responsible for those intervention systems: the transaction monitoring, the customer due diligence, the scam-detection protocols, and the escalation procedures.

Brown was brought in to build or fix those systems. Whether he was unable to, was not given the authority to, or chose to leave for other reasons is unknown — but each scenario carries different implications for what Gagliardi can expect.

What This Means for Bitcoin Depot Customers

What This Means for Operators

Bitcoin Depot's compliance leadership churn is a cautionary signal for the entire industry — and it carries a specific lesson: hiring a CCO is not the same as fixing compliance.

Regulators pay attention to who holds the compliance role and how long they last. Rapid turnover can signal internal disagreement about compliance direction, insufficient authority granted to the CCO, or resource constraints that make the job impossible. State examiners may view it as a risk factor during reviews, and opposing counsel in AG lawsuits will almost certainly probe the circumstances of Brown's departure in discovery.

The Missouri AG's simultaneous civil investigative demands to five operators — issued in December 2024 — mean compliance officers across the industry are already under scrutiny. Every operator that received a CID should be asking whether their current CCO has the bandwidth, authority, and institutional support to respond effectively — and whether that person will still be in the role when the matter reaches resolution.

The Massachusetts AG's securities fraud theory creates a new category of CCO risk. If compliance data about scam prevalence doesn't make it into SEC filings accurately, the CCO and the company both face exposure. For reference, Bitcoin Depot and Athena Bitcoin Global (OTCID: ABIT) are both publicly traded Bitcoin ATM operators, and both face active AG enforcement actions. Operators considering public listings should study this situation carefully.

For a comprehensive view of enforcement exposure across the industry, see our operators directory.

What to Watch Next

The most important question is not who Tony Gagliardi is — it's whether he has been given something Phillip Brown apparently was not: the authority, resources, and time to actually fix Bitcoin Depot's compliance infrastructure. The attorneys general in Massachusetts, Iowa, and Missouri will be watching for the same answer. If Gagliardi is gone in another nine months, the narrative shifts from "compliance challenges" to "compliance in name only" — and regulators will adjust their posture accordingly.

Bitcoin Depot owes its investors, its regulators, and its customers a substantive explanation of what happened to the compliance overhaul it announced last July. A thin press release about a new name in the CCO chair does not constitute one.