Congress Advances Bipartisan Crypto ATM Bill After $333M Fraud Loss

Congress is advancing bipartisan legislation that would impose federal transaction caps, mandatory scam warnings, fraud alerts, fee disclosures, suspicious activity reporting, and recordkeeping requirements on Bitcoin ATM operators nationwide. The bill follows reports that Americans lost more than $333 million to crypto ATM scams in 2025.

For operators, this is the moment the federal government stops watching from the sidelines. Until now, the pressure has come almost entirely from state attorneys general and state legislatures — a patchwork of bans, fee caps, and consent orders that varied wildly by jurisdiction. A federal floor changes the math: every operator in the country would face the same baseline obligations, enforced through the Treasury Department and the Bank Secrecy Act, regardless of which states they operate in.

What the Bills Require

Two related proposals are driving the debate. The House vehicle is the bipartisan Stop Crypto ATM Scams Act, introduced by Representatives María Elvira Salazar (R-FL-27) and Sean Casten (D-IL-06). On the Senate side, Senator Dick Durbin's Crypto ATM Fraud Prevention Act sets the parallel frame and has also been offered as an amendment to the GENIUS Act, with Senator Jack Reed publicly backing the approach.

Both bills impose federal transaction caps on new crypto ATM customers: a $2,000 daily limit and a $10,000 aggregate limit during the first 14 days after a customer's first transaction. The House version goes further, setting a $7,500 daily cap for existing customers, with an inflation adjustment every five years and authority for Treasury to revise the limits through formal rulemaking.

Enforcement Runs Through the Bank Secrecy Act

The Stop Crypto ATM Scams Act requires operators to register as money transmitting businesses with the Treasury Department, pulling them squarely under existing Bank Secrecy Act anti-money-laundering obligations. That means customer identity verification, Suspicious Activity Reports, Currency Transaction Reports, recordkeeping, and designation of a BSA compliance officer — with exposure to civil or criminal penalties for non-compliance.

This is a deliberate choice of enforcement architecture. Rather than create a new federal regulator or assign authority to the FTC or CFPB, the bill leans on Treasury and FinCEN's well-established BSA penalty regime — the same machinery that already governs banks and traditional money services businesses. Operators already familiar with money-transmitter compliance will recognize the framework; those who treated registration loosely now face a federal mandate with teeth. Treasury's rulemaking power to adjust the caps gives the government an ongoing lever rather than a one-time statute.

Fraud Losses Accelerated in 2025

FBI data cited in recent coverage shows fraudsters extracted approximately $333.5 million from U.S. victims via Bitcoin ATM scams from January through November 2025 — up from roughly $250 million in 2024 and more than double 2023 losses.

That escalating loss curve is the political engine behind the bills. A doubling of losses in two years gives bipartisan sponsors cover to act, and frames transaction caps as a direct response to the dollar figure that keeps appearing in headlines.

How Federal Caps Stack on State Rules

The federal proposal lands on top of an already-dense state landscape. State legislatures have spent the past year building enforcement templates that go in multiple directions at once — outright bans, fee ceilings, refund mandates, and transaction caps. The federal bill's $2,000 daily cap for new customers mirrors caps already adopted in states such as North Dakota, while its registration and disclosure requirements echo the consumer-protection codes moving through Maine, Alabama, and New Hampshire's SB 482-FN.

State-level enforcement has accelerated over the past two years. Massachusetts filed a consumer protection lawsuit against Bitcoin Depot in February 2025, alleging that more than 80% of customers making transactions of $10,000 or more were scam victims. Minnesota and Tennessee have enacted total bans, and California has secured consent orders with multiple operators.

Where the federal bills diverge from those state actions is on fees. State cases have targeted specific fee levels and scam-revenue figures, while these proposals focus on disclosure of pricing rather than a hard fee ceiling. The federal bills require operators to show their fees clearly, but they do not establish a federal cap on what those fees can be.

An open question is how a federal baseline interacts with stricter state laws. Federal registration and caps would not automatically preempt state bans or state fee caps, leaving operators potentially navigating overlapping obligations. Whether the final legislation addresses preemption — and how — is one of the most consequential details still unsettled.

What This Means for Consumers

If enacted, the bill would build several protections directly into the kiosk experience — but it does not change the most important rule for avoiding loss. Scam warnings displayed on kiosk screens could interrupt fraud in progress, and transaction caps would limit total losses in the critical window when victims are most vulnerable to coercion.

What This Means for Operators

The compliance burden is shifting from a state-by-state patchwork to a federal baseline — and the baseline is the Bank Secrecy Act. The most significant exposure isn't the caps; it's the move to designate operators as money transmitting businesses subject to SAR/CTR filing, a named BSA compliance officer, written policies, ongoing training, and civil or criminal penalties for failure. Those are fixed costs that could squeeze thin margins.

Transaction caps present a different challenge. High-volume customers — the segment that generates disproportionate revenue, and the same segment state AGs have flagged as scam-heavy — would face limits that could push legitimate large transfers to competing platforms. The $7,500 daily cap for existing customers would constrain operators who built business models around high-dollar purchases.

• Build the BSA infrastructure now. Identity verification, SAR/CTR workflows, and recordkeeping systems are non-trivial to stand up and would not benefit from a wait-and-see posture.
• Model the revenue impact of tiered caps. The $2,000/$10,000 new-customer regime and $7,500 existing-customer daily cap reshape transaction economics, particularly for operators whose revenue concentrates in high-dollar transfers.
• Watch the preemption language. A federal floor that doesn't displace state bans or fee caps means dual compliance, not relief.
• Track Treasury's rulemaking authority. Inflation-indexed, Treasury-adjustable caps mean the numbers in the bill are a starting point, not a fixed ceiling.

That convergence arrives as the sector is already contracting. Industry-leader Bitcoin Depot, the largest U.S. operator by kiosk count, filed voluntary Chapter 11 petitions on May 17, 2026 in the U.S. Bankruptcy Court for the Southern District of Texas and took its network offline, as disclosed in its May 18 Form 8-K. The Iowa Attorney General continues to investigate more than a dozen crypto ATM companies over fraudulent transfers, and kiosk counts have been falling across the U.S. and Europe through 2026. Federal legislation enters a market that is shrinking and litigating at the same time.

What Comes Next

The open question is procedural: will sponsors push the caps through as a standalone bill, or fold the framework into the broader GENIUS Act crypto package, where Durbin has already offered it as an amendment — and does the House version's tougher existing-customer cap survive committee? The bipartisan sponsorship suggests momentum, but industry lobbying could shape final caps and disclosure requirements before any floor vote.

For operators already absorbing state-level shocks and watching the sector's largest player wind down, the speed of that answer will determine how much runway they have to comply. The question is no longer whether federal regulation is coming, but whether they can adapt their compliance posture before the first enforcement actions arrive.