Update — September 15, 2026
SB 482 is final law. Governor Kelly Ayotte signed the bill on June 19, 2026, and it was enacted as Chapter 187, codified at RSA 358-U. Its operational requirements — the $2,000 daily cap, the first-transaction hold, the 14-day scam refund, the mandatory wallet screening, and the fee-disclosure duties — do not take effect until December 16, 2026. As of today, no New Hampshire kiosk is yet bound by any of them.
This week, New Hampshire state officials and law enforcement publicly promoted the incoming consumer protections for digital asset transaction kiosks under SB 482, alongside warnings to residents about rising crypto ATM scams. That shift — from legislative advocacy to implementation messaging — is the part operators should read closely. The state is building public expectation of these protections roughly three months before the statute becomes enforceable.
The enforcement mechanism is RSA 358-A, not a licensing regime
The final law does not create a kiosk license, a registration roll, an examination schedule, or a certification program. Instead, a violation of RSA 358-U is treated as an unfair or deceptive act or practice under RSA 358-A, New Hampshire's consumer protection statute. That places primary enforcement with the New Hampshire Attorney General and the Department of Justice's Consumer Protection and Antitrust Bureau, using existing investigative and remedial powers rather than a new banking-department supervisory apparatus.
Practically, that means there is no scheduled audit for operators to prepare for. Exposure arrives through complaints, investigative demands, and the mandatory government contact lines the statute requires operators to maintain and monitor. Operators accustomed to state banking examinations should not expect a checklist inspection here; they should expect an AG inquiry triggered by a victim report.
What the statute does not answer:
- No named analytics vendor, approved-list standard, or minimum data coverage for wallet screening
- No risk threshold defining when a flagged address must be blocked
- No lookback period for address history
- No stated process for a customer or counterparty to dispute a false-positive wallet flag
- No licensing, registration, examination, reporting, or certification program
The screening mandate is broader than OFAC
One question raised when the bill passed has now been resolved by the codified text. RSA 358-U:4 is not an OFAC-only sanctions screen. It requires operators to block wallet addresses flagged for scams, theft, sanctions violations, or other illicit activity — a materially wider obligation than the sanctions-list check most operators already run. Sanctions screening is a bounded, government-published list. Scam- and theft-attribution data is vendor-dependent, probabilistic, and inconsistent across providers. The statute imposes the duty without resolving which vendor's attribution controls.
Who actually has machines in New Hampshire
Our earlier reporting relied on market-share estimates that included Bitcoin Depot as the dominant New Hampshire operator with roughly 70 machines. That picture has changed. Bitcoin Depot Inc. and related debtor entities filed voluntary Chapter 11 petitions on May 17, 2026 in the U.S. Bankruptcy Court for the Southern District of Texas, and the company announced in Exhibit 99.1 to its May 18, 2026 Form 8-K that its BTM network had been taken offline. We could not verify any currently operating Bitcoin Depot machine in New Hampshire through an accessible company location page.
What is verifiable as of September 15, 2026, from the operators' own public locators: at least 32 active New Hampshire kiosks, with CoinFlip listing 16, Byte Federal listing 9, and Athena Bitcoin listing 7. That is a substantially smaller state footprint than the ~127 figure cited during the legislative debate, and it changes the compliance math: the December 16 deadline now lands on a shorter list of operators than lawmakers were modeling in April.
Correction (September 15, 2026): This article originally reported that Bitcoin Depot dominated the New Hampshire market with around 70 machines and that no major operator had announced plans to exit the state. Bitcoin Depot filed Chapter 11 on May 17, 2026 and stated its BTM network had been taken offline as of its May 18, 2026 Form 8-K; we could not verify any currently operating Bitcoin Depot kiosk in New Hampshire. The operator counts above reflect what is independently verifiable through operator locators as of September 15, 2026.
Still unanswered
No reviewed operator statement publicly acknowledges the December 16, 2026 deadline or describes a New Hampshire-specific implementation plan. No operator has announced an exit from the state. And no legal challenge to SB 482 on preemption or constitutional grounds has surfaced in our review — a notable absence given the litigation that followed restrictive measures in other states. Whether any of the three verified New Hampshire operators intends to contest the statute, comply quietly, or pull machines before December is, at this point, undisclosed.
Why New Hampshire Acted Now
For the past two years, New Hampshire has been an anomaly. As neighboring states imposed transaction limits and fraud-prevention requirements on Bitcoin ATMs, the Granite State had none. Law enforcement officials told legislators that scammers noticed — deliberately steering victims toward New Hampshire kiosks precisely because there were no caps or cooling-off periods to interrupt the fraud. The numbers bore that out. New Hampshire residents lost approximately $22 million to scams routed through cryptocurrency kiosks in 2024 alone, according to data cited during legislative hearings. The state's Attorney General and local police chiefs pushed for the legislation, framing SB 482-FN as a direct response to that surge. The bill passed both chambers on April 24, 2026. It joins legislation from 24 other states that have already enacted some form of crypto kiosk safeguard. Supporters, including the bill's sponsor Senator Birdsell, have described SB 482-FN as a "moderate, reasonable approach" — strict enough to deter fraud without destroying an industry that does serve legitimate users.What SB 482-FN Actually Requires
The bill, if signed, takes effect 180 days after passage — roughly October 2026 — giving operators a transition window to build compliance infrastructure. [Updated: the enacted law's operational requirements take effect December 16, 2026.] The requirements go well beyond a simple transaction cap.Key Provisions of SB 482-FN:
- $2,000 daily cap: No operator may accept or dispense more than $2,000 per customer per day, aggregated across all of that operator's kiosks in the state
- 48-hour hold for first-time users: A new customer's initial transaction must be held for at least 48 hours, during which the customer can cancel and receive a full refund
- 14-day scam refund: If a customer was fraudulently induced into a transaction and reports it to the operator and law enforcement within 14 days, the operator must provide a full refund including all fees
- Blockchain analytics: Operators must use blockchain analytics tools to screen and block transfers to wallet addresses associated with scams, theft, sanctions, or other illicit activity
- Fraud warnings and screening questions: Kiosks must display prominent scam warnings, ask fraud-screening questions, and block the transaction if the customer's answers indicate potential fraud
- Fee transparency: All fees and exchange rate markups must be disclosed on-screen and on receipts
- Identity verification: Operators must verify customer identity and only allow transactions under the customer's true name, in compliance with state and federal laws
The 14-Day Refund Mandate: Bold or Unworkable?
The refund provision is the bill's most aggressive feature — and its biggest open question. Under SB 482-FN, if a customer reports to both the operator and law enforcement within 14 days that they were "fraudulently induced" into a transaction, the operator must refund the full amount plus any fees charged. This is not how Bitcoin ATM transactions work in practice. When a scam victim feeds cash into a kiosk, the operator converts it to cryptocurrency and sends it to the wallet address the victim provides — which is controlled by the scammer. Within minutes, those funds are typically moved through multiple wallets, mixers, or cross-chain bridges. They're gone. The refund mandate means operators absorb the loss. That's a fundamental shift: it transforms Bitcoin ATM operators from transaction processors into something more like insurers against customer fraud. The bill doesn't specify a cap on refund liability, nor does it detail what evidence constitutes being "fraudulently induced" beyond the customer's report and a law enforcement filing. This is by design. The bill's sponsors and the New Hampshire Attorney General's office pushed for the refund mandate specifically because the alternative — expecting law enforcement to recover crypto from overseas scammers — has proven essentially impossible. If operators must eat the cost of every scam they fail to stop, the economics of lax compliance change dramatically. But it also raises questions about gaming. What stops a non-scam customer from claiming fraud to get a refund? The law enforcement filing requirement creates a filing-a-false-report deterrent, but operators will need clear procedures for investigating refund claims — and the bill's text leaves those details largely to implementation. For operators running thin margins, this creates a direct financial incentive to either invest heavily in front-end fraud prevention — the screening questions, the blockchain analytics, the 48-hour holds — or exit the state. The bill's architects are betting that operators will choose prevention.Blockchain Analytics: What It Means Operationally
The requirement that operators use "blockchain analytics tools" to block transfers involving flagged wallet addresses sounds technical, but the concept is straightforward. Companies like Chainalysis, Elliptic, and TRM Labs maintain databases of cryptocurrency wallet addresses linked to known scams, sanctioned entities, ransomware groups, and other illicit activity. Major exchanges already screen outgoing transfers against these databases as part of anti-money-laundering compliance. SB 482-FN requires Bitcoin ATM operators to do the same. Before completing a transaction, the machine would check the destination wallet against these screening databases. If the wallet is flagged, the transaction gets blocked. This is operationally comparable to the OFAC sanctions screening that banks perform daily. [Updated: the codified text at RSA 358-U:4 is broader than OFAC screening — it reaches addresses flagged for scams, theft, sanctions violations, or other illicit activity.] The major operators — Bitcoin Depot, CoinFlip, and Byte Federal — already claim to use some form of blockchain analytics. The question is whether smaller operators, which account for a meaningful share of the New Hampshire market, have the infrastructure and vendor relationships to comply within 180 days. The limitation is obvious: blockchain analytics can only flag wallets that are already known to be illicit. A scammer using a fresh wallet that hasn't been flagged won't be caught by this screen. The requirement is a meaningful layer of defense, but not a complete one.How New Hampshire Compares to Other States
The regulatory landscape for Bitcoin ATMs is now splitting into three distinct approaches:State Regulatory Approaches (2026):
- Outright bans: Tennessee (signed by Governor Bill Lee on April 23, 2026, effective July 1, 2026) and Indiana have banned crypto ATMs entirely, with criminal penalties for non-compliance
- Strict regulation: New Hampshire (SB 482-FN) and roughly 24 other states have enacted varying levels of consumer protection — transaction caps, warnings, licensing, refund mandates, or some combination
- Minimal oversight: A shrinking number of states still rely primarily on existing money-transmission licensing and general fraud statutes, without crypto-ATM-specific rules
Who's Affected: The Operator Landscape
Approximately 10 companies operate the roughly 127 crypto ATMs in New Hampshire. Bitcoin Depot (NASDAQ: BTM) dominates the market with around 70 machines, followed by CoinFlip with approximately 18 and Byte Federal with roughly 10. None of these operators have publicly announced plans to exit the state — a meaningful contrast with Tennessee, where the outright ban is forcing operators to physically remove machines by July 1. [Updated: see the September 15, 2026 update and correction above — Bitcoin Depot filed Chapter 11 on May 17, 2026 and reported its BTM network offline; verified New Hampshire counts as of September 2026 are CoinFlip 16, Byte Federal 9, Athena Bitcoin 7.] But compliance will cost money. The blockchain analytics requirement means ongoing subscription costs with third-party providers. The 48-hour hold on first-time transactions means delayed revenue and potentially lost customers who decide the wait isn't worth it. The fee transparency requirements may pressure operators who currently bury margin in opaque exchange-rate markups. And the 14-day refund mandate creates an entirely new category of financial exposure — one that's impossible to model precisely until operators see how many refund claims materialize.Operator Compliance Checklist:
- Blockchain analytics integration: Contract with a screening provider (Chainalysis, Elliptic, TRM Labs, or equivalent) for real-time wallet screening before executing transactions
- Refund reserves: Build financial reserves or insurance to cover 14-day refund obligations; model expected fraud-refund volume based on current transaction patterns
- KYC upgrades: Implement full identity verification for all transactions, not just those exceeding federal thresholds
- 48-hour hold infrastructure: Build systems to identify first-time customers and delay crypto delivery for 48 hours while enabling cancellation
- Fraud screening UX: Redesign kiosk interfaces to include mandatory warnings, screening questions, and transaction-blocking logic
- Fee disclosure: Ensure on-screen and receipt disclosures show both fees and exchange rate markups in plain language
- Cross-kiosk tracking: Implement systems to enforce the $2,000 daily cap across all of the operator's machines in the state, not just per kiosk
What This Means for Operators Before December 16
Three compliance realities deserve attention in the ninety days remaining:
Ahead of the December 16, 2026 deadline:
- Nobody is going to inspect you — until a complaint lands. There is no examination schedule under Chapter 187. Exposure runs through the AG's Consumer Protection and Antitrust Bureau via RSA 358-A, which means your first compliance test may arrive as an investigative demand tied to a single victim report.
- Your screening vendor choice is your liability posture. The statute names no vendor, threshold, sanctions list, or lookback period. Whatever attribution standard you pick becomes the standard you will defend. Document the selection rationale now.
- Build the false-positive path yourself. RSA 358-U does not describe a process for disputing a wallet flag. If a legitimate customer is blocked, you own the remediation and the complaint that follows.
- The government contact line is a live obligation. The statute requires operators to maintain and frequently monitor a contact line for government inquiries. That is the channel through which enforcement will most likely reach you first.
What This Means for New Hampshire Consumers
What Changes for Bitcoin ATM Users in New Hampshire:
- If you're a first-time user: Your initial transaction will be held for 48 hours before processing — giving you time to reconsider or cancel for a full refund
- Daily limits: You cannot transact more than $2,000 per day across all machines operated by the same company
- If you've been scammed: Report it to the operator and law enforcement within 14 days of the transaction to receive a full refund including fees. Document everything — the transaction receipt, any communications with the scammer, and your police report
- Fee transparency: You will see the exact fees and exchange-rate markup before completing any transaction, both on-screen and on your receipt
- Fraud screening: Expect on-screen warnings and questions about whether someone is directing you to make the transaction
- The law isn't in effect yet: SB 482-FN is awaiting the governor's signature. If signed, these protections take effect 180 days later — likely late October 2026 [Updated: signed June 19, 2026 as Chapter 187; protections become effective December 16, 2026]