Kentucky's ATM Bill Has a Hidden Provision That Would Outlaw Hardware

The Bitcoin Policy Institute sent a letter to the Kentucky Senate on March 20, 2026, urging lawmakers to remove Section 33 from House Bill 380 — a last-minute floor amendment that would require hardware wallet manufacturers to help users reset seed phrases and access credentials, a requirement that is technically impossible for non-custodial wallets by design. The stakes extend well beyond Kentucky. If Section 33 survives the Senate, it would create the first state law in the country mandating that hardware wallet makers build backdoor recovery mechanisms into devices engineered specifically to prevent third-party access. It would also directly contradict Kentucky's own HB 701, enacted in March 2025, which explicitly protects residents' rights to self-custody and independent private key control.

How a Bitcoin ATM Bill Became a Hardware Wallet Regulation

HB 380 started as a straightforward consumer protection bill targeting unregulated cryptocurrency ATM kiosks — and the core provisions are substantive. The bill passed the Kentucky House 85-0 on March 13, 2026, with bipartisan support for measures including:

HB 380 Core Kiosk Provisions (Pre-Amendment):

$2,000 daily transaction limit for new kiosk users
$10,500 daily limit for existing, verified users
Licensing requirements for kiosk operators
Mandatory identity verification at point of transaction

These kiosk-focused provisions align with the broader national trend of states imposing transaction caps and licensing requirements on Bitcoin ATM operators. California, Iowa, and Maine have enacted $1,000 daily caps — the strictest in the country — while Kentucky's proposed $2,000 cap for new users falls in a moderate range. The problem is Section 33, which Rep. Tom Smith introduced as Floor Amendment 3 — a piggyback amendment attached to an already-popular bill late in the legislative process. Because the underlying bill had unanimous support, Section 33 received no dedicated committee scrutiny before the full House vote.

Why Section 33 Is Technically Impossible

Non-custodial hardware wallets from manufacturers like Ledger and Trezor — which together hold approximately 60% of the global market — are built on a fundamental security principle: no one except the user can access or recover their private keys. The seed phrase (typically 12 or 24 words) is the only recovery mechanism, and it exists solely in the user's possession.

~60%

Global hardware wallet market held by Ledger + Trezor

$560M+

Estimated market exposure if manufacturers must comply or exit

85-0

House vote on HB 380 (with Section 33 attached)

Section 33 would require these manufacturers to "provide mechanisms for resetting passwords, PINs, seed phrases" — which would mean either: 1. **Storing user credentials centrally**, converting non-custodial wallets into custodial ones, defeating their entire purpose and creating a massive honeypot for hackers. 2. **Building backdoor access**, undermining the cryptographic security model that makes hardware wallets trustworthy. 3. **Exiting the Kentucky market entirely**, denying residents access to self-custody tools that Kentucky itself protected just one year earlier under HB 701. The Bitcoin Policy Institute's letter to the Senate makes this technical argument explicitly, framing Section 33 as incompatible with the physical reality of how non-custodial wallets function.

The Legislative Contradiction

The most striking aspect of Section 33 is its direct conflict with existing Kentucky law. HB 701, signed into law in March 2025, established that Kentucky residents have the right to: - Self-custody of digital assets - Independent control of private keys - Use of non-custodial wallets without government-mandated intermediaries Section 33 of HB 380 would effectively reverse these protections by requiring the very intermediary access mechanisms that HB 701 was designed to prevent. If both laws remained on the books, hardware wallet manufacturers would face contradictory mandates — protect user self-custody under HB 701 while simultaneously building manufacturer-accessible recovery systems under HB 380.

The Consumer Harm No One Is Talking About: Transaction Limits and Bans

While the debate over Section 33 dominates headlines, there's a quieter cost being imposed by the wave of Bitcoin ATM regulations sweeping the country — one that affects legitimate users who have done nothing wrong. Transaction limits and outright bans on Bitcoin ATM operations don't just stop scammers. They stop everyone. A Kentucky resident who uses a Bitcoin ATM to send $3,000 to a family member abroad — a perfectly legal, time-sensitive transaction — would be blocked under HB 380's $2,000 new-user cap. A small business owner who converts daily cash revenue to Bitcoin would hit the ceiling within a single transaction. A freelancer receiving payment in cash who wants to move it into Bitcoin quickly and locally would be turned away. These aren't hypothetical edge cases. They are the everyday use cases that Bitcoin ATMs were built for — financial access for people who are unbanked, underbanked, or simply prefer cash-to-crypto conversion without a multi-day bank transfer and the identity surveillance that comes with centralized exchanges. The data on scam harm is real and serious: FBI figures show $333 million in Bitcoin ATM fraud losses in 2025, and the elderly are disproportionately victimized. No one disputes that. But the policy response of blanket transaction caps creates its own category of consumer harm — one that is invisible because it shows up as transactions that simply don't happen. There's no FBI complaint form for "I couldn't send money to my family because the kiosk told me my limit was reached." There's no AG investigation into the remittance that was delayed three days because a legitimate user had to find an alternative after being locked out of a kiosk. States with the most aggressive caps — California, Iowa, and Maine at $1,000 per day — have already pushed legitimate high-volume users off Bitcoin ATMs entirely, driving them either to peer-to-peer markets with fewer consumer protections, or to centralized exchanges that many cash-reliant users can't easily access. Kentucky's $2,000 cap is more moderate, but it still creates a hard ceiling that treats every new user as a potential scam victim until proven otherwise.

The hidden cost of transaction caps:

Legitimate transactions that would otherwise clear are being blocked by daily limits
Cash-reliant and unbanked users — who depend most on Bitcoin ATMs — are disproportionately affected
Users pushed off regulated kiosks may turn to peer-to-peer markets with fewer protections
No state has published data on the volume of legitimate transactions blocked by caps
The policy debate counts scam dollars prevented but never counts legitimate commerce lost

This isn't an argument against regulation. It's an argument for honest accounting. If legislators are going to impose transaction caps, they should be required to study and disclose the impact on legitimate users — not just the scam victims they're designed to protect. Right now, the conversation is entirely one-sided: every dollar prevented by a cap is assumed to be a dollar of fraud averted. That assumption is wrong, and no state has produced data to test it.

The AARP Question: Effective Advocacy or Uninformed Policy?

AARP Kentucky supports HB 380's kiosk provisions — and on the kiosk provisions specifically, the organization has a legitimate case. Bitcoin ATM scams disproportionately target elderly consumers. The Massachusetts AG's lawsuit against Bitcoin Depot, filed February 3, 2025, found that the median scam victim was 67 years old, with over 70% aged 60 and older. The DC AG's case against Athena Bitcoin found a median victim age of 71. FBI data shows Bitcoin ATM fraud losses hit $333 million in 2025. AARP has every reason to push for transaction caps and operator licensing. But AARP's fingerprints are showing up on a troubling pattern across state legislatures: broad, technically uninformed provisions getting attached to bills that protect seniors from real harms. Section 33 is the clearest example. The amendment treats a hardware wallet — a cryptographic security device — as if it were a consumer appliance that should come with a password reset button. That framing suggests the amendment's drafters either did not understand the technology or did not consult anyone who did. This is not an isolated incident. AARP-backed consumer protection coalitions have been among the most influential forces driving state-level crypto ATM legislation across the country. Their advocacy has been effective — transaction caps in California, Iowa, and Maine all reflect priorities that AARP and allied senior-advocacy groups championed. And in the narrow context of Bitcoin ATM kiosk regulation, much of that advocacy addresses real, documented harms. The problem arises when that advocacy extends beyond kiosks into adjacent technologies that the advocates don't fully understand. Hardware wallets are not Bitcoin ATMs. They are not used in the kiosk-based scam pipeline that drives AARP's concerns. A scam victim who is socially engineered into feeding cash into a convenience store kiosk is not the same user as someone who purchases a Ledger device to self-custody their Bitcoin. Conflating the two in a single bill suggests a "regulate everything crypto" approach that overreaches beyond the actual harm.

The core tension:

AARP's advocacy on kiosk transaction caps and operator licensing is grounded in real data — elderly scam losses are documented and significant
But AARP-backed coalitions appear to lack the technical expertise to distinguish between kiosks (the actual scam vector) and hardware wallets (a security tool)
The legislative strategy of attaching broad crypto provisions to popular senior-protection bills exploits bipartisan goodwill to bypass technical scrutiny
Other states watching Kentucky may replicate this approach, making Section 33 a template rather than an anomaly

The question legislators in Kentucky and elsewhere need to ask is simple: are the advocacy groups driving this legislation qualified to define the technical requirements they're proposing? Transaction limits and licensing are policy questions where AARP's expertise in consumer protection is directly relevant. Mandating seed phrase recovery mechanisms is an engineering question — and getting it wrong doesn't just fail to protect seniors, it actively harms every consumer who relies on non-custodial wallets for security.

The Bitcoin ATM Provisions Are Solid — But Come With Trade-Offs

The kiosk-focused provisions of HB 380 represent targeted regulation that addresses documented scam facilitation problems driving enforcement actions in Massachusetts, Iowa, Missouri, and DC against operators including Bitcoin Depot, CoinFlip, and Athena Bitcoin. The FBI recently reported that Bitcoin ATM fraud losses hit $333 million in 2025, with complaints rising 33%. Kentucky's core bill provisions — new-user transaction caps, operator licensing, mandatory ID verification — directly target the mechanics that make kiosk-based scams possible. But these provisions are not cost-free. Every transaction cap is simultaneously a fraud prevention tool and a barrier to legitimate commerce. The policy question isn't whether caps reduce fraud — they almost certainly do. The question is whether the specific cap levels are calibrated correctly, and whether legislators have accounted for the legitimate users who will be turned away alongside the scam victims who will be protected. The opposition from the Bitcoin Policy Institute and crypto advocates is specifically and solely directed at Section 33's hardware wallet mandate, not the consumer protection framework for ATM kiosks. That distinction matters. When advocacy groups bundle unrelated provisions into a single bill, they risk turning potential allies into opponents — and delaying the very protections seniors need most.

Where This Fits in the National Regulatory Push

Kentucky's HB 380 doesn't exist in a vacuum. It arrives during the most aggressive period of Bitcoin ATM enforcement in history. Attorneys General in Massachusetts, Iowa, Missouri, and DC have filed lawsuits or issued civil investigative demands against major operators. Missouri's December 2024 CIDs hit five operators simultaneously — Bitcoin Depot, CoinFlip, Athena Bitcoin, RockItCoin, and Byte Federal — signaling industry-wide scrutiny. The core kiosk provisions of HB 380 echo the remedies these AGs are seeking through litigation: transaction caps, better KYC, and operator accountability. The Massachusetts AG's lawsuit against Bitcoin Depot alleged that over 80% of customers who spent $10,000 or more at its kiosks were scam victims. Kentucky's $2,000 new-user cap would have prevented many of those high-dollar losses from occurring in a single transaction. The irony is that by stapling Section 33 onto an otherwise strong consumer protection bill, Kentucky legislators have given opponents a legitimate reason to delay or challenge the entire package — potentially leaving kiosk consumers unprotected while the hardware wallet fight plays out.

What This Means for Bitcoin ATM Operators in Kentucky

If HB 380 passes with the kiosk provisions intact, operators should prepare for:

$2,000 daily cap for new users — requires robust user-tier tracking systems
$10,500 cap for existing users — operators must implement verified user databases
State licensing — unlicensed operators will need to apply or exit Kentucky
Mandatory identity verification — KYC processes at the kiosk level, not just at account creation
Reduced transaction volume — legitimate high-value transactions will be blocked, not just fraudulent ones, and operators should model the revenue impact of the $2,000 new-user cap

These requirements are consistent with the direction of travel across multiple states. Operators already facing enforcement actions or civil investigative demands should view Kentucky's bill as a template for what other state legislatures are likely to adopt. The operators directory tracks enforcement actions and trust scores across the industry. The Section 33 hardware wallet provisions do not directly affect kiosk operators, but they signal a broader risk: well-intentioned Bitcoin ATM regulation can be hijacked to regulate adjacent technologies when amendments are attached without adequate review. Operators who support sensible kiosk regulation should be paying attention to how legislative sausage gets made — because the next piggyback amendment could target them.

What This Means for Consumers

Three separate issues for three types of users:

Hardware wallet users: Section 33 could force manufacturers to either build recovery backdoors (weakening your security) or stop selling products in Kentucky. Neither outcome benefits you.
Bitcoin ATM users vulnerable to scams: The core provisions of HB 380 are designed to protect you — particularly the transaction caps that limit how much a scam victim can lose in a single day.
Legitimate Bitcoin ATM users: Transaction caps will affect you too. If you regularly transact above $2,000 at a kiosk, you'll need to build a verified transaction history before you can access the $10,500 tier — and even that ceiling may block some legitimate use cases. There is no exemption for non-fraudulent transactions.
Everyone: Contact your state senator if you have an opinion on Section 33 or the transaction cap levels. The bill's fate will be decided in the Senate, not by a court.

For more on protecting yourself at Bitcoin ATM kiosks, see our consumer protection resources.

What Happens Next

The Kentucky Senate now has the bill. The Bitcoin Policy Institute's March 20 letter is the most prominent public call to strip Section 33, but the core question is procedural: will the Senate hold committee hearings on Section 33 separately, or will the amendment ride through on the unanimity of the kiosk provisions? If the Senate passes HB 380 intact, expect immediate legal challenges from hardware wallet manufacturers arguing both constitutional grounds and the direct statutory conflict with HB 701. If the Senate strips Section 33 and passes the kiosk provisions cleanly, Kentucky joins the growing list of states imposing meaningful transaction limits and licensing requirements on Bitcoin ATM operators — and the industry moves one step closer to a de facto national regulatory standard, with the legitimate-use trade-offs that entails. But the larger lesson from Kentucky may be about the legislative process itself. When advocacy groups with genuine, data-backed concerns about elderly fraud victims push legislation they don't fully understand technically, the result is provisions like Section 33 — well-intentioned mandates that are literally impossible to implement. And when legislators set transaction caps without studying the impact on legitimate users, they create invisible consumer harm that no one tracks and no one accounts for. State legislatures need both technical review mechanisms for crypto-related amendments and economic impact assessments that count the cost to legitimate users — not just the savings from fraud prevention. Watch the Kentucky Senate Banking and Insurance Committee for scheduling. And watch whether any state that has imposed transaction caps is willing to publish data on how many legitimate transactions those caps have blocked. So far, none has.

Kentucky's Bitcoin ATM Bill Has a Hidden Provision That Would Outlaw Hardware Wallets as We Know Them