The North Carolina Commissioner of Banks has opened a public comment period on proposed rules under 04 NCAC 03 Subchapter 3N governing virtual currency kiosks. Comments are accepted from September 15 through November 15, 2026. The rules are proposed. Nothing in Subchapter 3N is final, in effect, or enforceable today.
That distinction matters more than usual here. The numbers operators keep quoting — the 12% fee cap, the $2,000 new-customer daily limit, the $5,000 existing-customer limit, the refund obligation, the 48-hour hold — are not creations of this rulemaking. They come from Session Law 2026-45. The seven proposed rules do something narrower and, for compliance teams, more consequential: they tell you how the Commissioner intends to measure, verify, and adjudicate those statutory requirements.
That is where the operational cost lives. And it is the only part still open to influence.
Rulemaking: Proposed 04 NCAC 03 Subchapter 3N, Rules .0101–.0107
Agency: North Carolina Commissioner of Banks (NCCOB) / Banking Commission
Comment period: September 15 – November 15, 2026
Proposed effective date: January 1, 2027
Authorizing statute: Session Law 2026-45
Status: Proposed — not adopted, not final
What the Proposed Rules Actually Do
The filing proposes seven rules, 04 NCAC 03N .0101 through .0107, with a proposed effective date of January 1, 2027. Read them as procedural plumbing attached to a statute that already exists, not as a new substantive regime. Operators reading secondhand summaries are likely to get that backwards.
Statute vs. rule — what comes from where:
- From Session Law 2026-45: the 12% fee cap, the $2,000 new-customer daily limit, the $5,000 existing-customer daily limit, refund duties, the 30-day reporting window, and the 48-hour transaction hold.
- From proposed Rule .0105: each daily limit is measured over a rolling 24-hour period beginning at the time shown on the customer's completed-transaction receipt.
- From proposed Rule .0102: the evidentiary standard and document-production duties that apply when NCCOB reviews a fraud claim.
Two provisions carry the most operational weight.
Rule .0105 defines the clock. Each statutory daily limit would be measured over a rolling 24-hour period that begins at the time shown on the customer's completed-transaction receipt. That is a specific, testable design requirement. It is not a calendar day, and as written it is not a per-kiosk or per-location window. Any operator running limit logic off midnight resets, terminal-local time, or a per-machine counter has a software change ahead of it, not a policy memo.
The rolling window also closes an obvious workaround. A new customer trying to move $4,000 cannot split it across two calendar days to sidestep the $2,000 cap.
Rule .0102 defines the evidentiary record. When the Commissioner evaluates whether a transaction was fraudulent, the rule lists what NCCOB may consider: the consumer's narrative, law-enforcement reports, transaction receipts, bank records, communications between the consumer and the alleged fraudster, operator records, and blockchain-analytics results.
What Rule .0102 would require operators to hand over during a fraud review:
- Identification-verification records
- An image captured at the time of the transaction
- Wallet-verification information
- User identifiers
- Relevant transaction histories
That list is a retention mandate wearing a production mandate's clothing. You cannot produce a transaction-time image in response to a fraud complaint filed 30 days after the fact unless you retained it, indexed it to the transaction, and can pull it on a regulator's timeline. The proposed rules, as described in the filing, do not spell out a retention period or a production deadline. That is a gap worth writing a comment about.
The Refund Asymmetry: Who Gets Made Whole
Session Law 2026-45 — not this rulemaking — draws a hard line between new and existing customers on refunds. It is the sharpest line in the whole framework.
A new customer who reports fraud to NCCOB within 30 days receives a full refund if the Commissioner determines the transaction was fraudulent. An existing customer meeting identical conditions — same 30-day report, same affirmative fraud determination — recovers only the operator-imposed fees. The principal is gone.
Put plainly: a North Carolina resident scammed on their second visit to a kiosk gets back the fee, not the money. Under a 12% cap, a $5,000 loss returns at most $600.
That structure rests on an assumption worth testing during the comment period — that repeat kiosk users are sophisticated enough to protect themselves. Pig-butchering and government-impersonation victims routinely make multiple trips to multiple kiosks over days or weeks. Whether the second visit should extinguish the refund right is exactly the sort of question a comment letter exists to raise.
The tier itself is statutory and this rulemaking cannot change it. What the comment period can shape is everything downstream: how quickly a determination gets made, what evidence a victim must assemble, and how fast an operator must pay once the Commissioner rules for the consumer. On that last point, the proposed rules leave the payment deadline unspecified. A refund right with no payment clock is a weaker right.
The Legislative Backdrop
The rulemaking follows the 2025–2026 session, where HB 920 became the vehicle for what is now Session Law 2026-45. Earlier versions carried a 3% fee cap and lower transaction limits before landing on the 12% cap and the $2,000/$5,000 thresholds in the final law.
Which stakeholders drove those numbers upward is not established in the public record. A published comment log would answer it. NCCOB has not said whether one is coming.
What's Missing From the Record
Several things a serious commenter would want are not in the published materials reviewed for this article.
Open questions in the rulemaking record:
- The deadline itself. Public references disagree on whether comments close November 15 or November 16, 2026. File by November 15 and do not test it.
- Rules Review Commission calendar. No published date for RRC consideration, which controls whether January 1, 2027 survives contact with reality.
- Fiscal analysis. No published cost estimate for operators or for NCCOB's own fraud-adjudication workload.
- Comment log or agency response. No indication whether NCCOB will publish received comments or explain revisions.
- Refund payment deadline. Nothing specifying how quickly an operator must pay after a favorable determination.
- Record retention period. Rule .0102 says what must be produced. It does not say how long it must be kept.
- Licensed-operator count. No official figure for how many operators or active kiosks the rules would cover.
Each of those is a legitimate comment. Regulators respond to specificity. A comment that says "the rules are burdensome" goes in a pile. A comment that says "Rule .0102 requires production of a transaction-time image but Subchapter 3N specifies no retention period, creating an unresolvable conflict for operators purging imagery on a 90-day cycle" gets a response in the adoption package.
Why This Matters Beyond North Carolina
North Carolina is not writing on a blank page. New Hampshire enacted a kiosk law with $2,000 daily caps, a 14-day scam-refund window, and mandatory blockchain screening. Pennsylvania's HB 2643 has been moving through the House. Arizona's attorney general recovered $171,332 in full refunds for 35 crypto ATM scam victims under that state's kiosk law — the clearest evidence to date that these statutes produce real money for real victims when an agency works them.
What North Carolina adds is the implementing detail. Most state kiosk laws specify a refund right and leave the adjudication mechanics to agency discretion. Subchapter 3N is an early, unusually explicit attempt to write down what "the Commissioner determines the transaction was fraudulent" actually means — what evidence counts, who produces it, and how the clock runs.
Other state regulators drafting their own implementing rules will read this one. If NCCOB's evidentiary list becomes the template, the compliance architecture it implies — retained transaction imagery, indexed wallet-verification data, rolling-window limit engines, preserved blockchain-analytics results — becomes a de facto national standard regardless of what any single legislature writes.
That is the bellwether question. It will be answered by whichever version of .0102 and .0105 clears the Rules Review Commission.
What This Means for Operators
The comment period is the cheapest point of influence in this process. After adoption, the options narrow to compliance or litigation.
- Audit your limit logic against the rolling-24-hour rule now. Rule .0105 keys the window to the completed-transaction receipt timestamp. If your system resets at midnight, counts per-kiosk, or uses terminal-local time, that is a build, not a config change — and January 1, 2027 is the proposed date.
- Inventory what you can actually produce under .0102. Transaction-time imagery, wallet-verification records, ID-verification records, user identifiers, and transaction history, retrievable by transaction ID. If you cannot pull all five for a 30-day-old transaction today, say so in your comment and explain what retention period would make it feasible.
- Comment on the gaps, not the policy. The 12% cap and the tiered refund are statutory. Arguing them here wastes the filing. The unspecified retention period, the missing refund payment deadline, and the November 15/16 ambiguity are live and fixable.
- Quantify everything. Agencies discount unquantified objections. Bring cost figures.
- File by November 15. Do not rely on the later date.
What This Means for North Carolina Consumers
Nothing in Subchapter 3N protects you yet. The statutory rights under Session Law 2026-45 are the operative ones, and the proposed rules would govern how a claim gets evaluated no earlier than the adopted effective date.
If you are scammed at a North Carolina kiosk, the 30-day reporting window to NCCOB is the deadline that determines whether you have a claim at all. Keep the receipt — under Rule .0105 it would establish the transaction time, and under .0102 it is listed among the evidence the Commissioner may consider. File a law-enforcement report; that is on the evidence list too. And understand the new-versus-existing customer distinction before assuming a full refund is available. Our consumer protection resources cover the reporting steps that apply today.
Consumers can comment as well. Regulators rarely hear from victims during rulemaking, and a first-person account of what evidence a scam victim can realistically assemble within 30 days is information NCCOB cannot get from an operator's compliance department. Comments go through the Commissioner of Banks' proposed rules page.
What to Watch
Three signals will tell you whether North Carolina's framework arrives on schedule and with teeth.
First, whether NCCOB publishes a comment log and agency response explaining revisions — that document, if it exists, will show which stakeholders moved the text. Second, when the Rules Review Commission calendars the package; the January 1, 2027 effective date depends entirely on that timing. Third, whether the adopted version of .0102 attaches a retention period and a refund payment deadline to the evidence it demands.
If it does, North Carolina will have written the most operationally specific kiosk fraud-adjudication rule in the country. If it doesn't, operators inherit a production mandate with no retention floor, consumers inherit a refund right with no payment clock — and the next state to copy this text inherits both problems.