The Most Detailed ATM Regulation Any State Has Passed

South Dakota's Senate Bill 98 imposes a 3% fee cap on all Bitcoin ATM transactions, mandates a 72-hour hold on every first-time customer's transaction, and requires operators to deploy blockchain analytics software to block transfers to addresses linked to fraud — making it the most prescriptive state-level regulation the Bitcoin ATM industry has faced to date. The law, introduced by Senator Steve Kolbeck and signed into law in March 2026, takes effect July 1, 2026, giving the approximately 170 crypto kiosks currently operating in the state a narrow six-week compliance window. For an industry already reeling from attorney general lawsuits in Massachusetts, Iowa, and DC, and a multi-state investigative push from Missouri, South Dakota's approach is different: rather than suing operators after the fact, the state has legislated specific operational requirements that will fundamentally reshape how Bitcoin ATMs work within its borders — and potentially serve as a template for other states.

Maximum total fee per transaction

$2,500

Daily limit for new customers

$10,500

Daily limit for existing customers

72 hrs

Mandatory hold on new customer transactions

What the Law Actually Requires

SB 98 doesn't just set limits — it creates a comprehensive regulatory framework that touches every aspect of Bitcoin ATM operations. Here's what it mandates, section by section.

The 3% Fee Cap — And How It's Calculated

Section 9 of the law prohibits licensees from collecting charges exceeding 3% of the transaction amount, "whether directly or indirectly." That language is critical. The statute defines "charges" broadly to include not just explicit fees but also the spread — "the difference between the market price of virtual currency at the time of the transaction and the price charged to the user." This is a direct strike at the drip pricing practices that have been the subject of enforcement actions against Bitcoin Depot, CoinFlip, Athena Bitcoin, and others. Operators currently charging 15–25% total fees — when combining the displayed markup with hidden spreads — would need to cut their revenue per transaction by roughly 80% or more to comply. To put a finer point on it: most Bitcoin ATM operators would not have a viable business at a 3% total fee cap under their current cost structures.

Two-Tier Transaction Limits

The law creates two customer categories with different limits:

Transaction Limits Under SB 98:

Supporting source image for sb 98 3% fee cap statutory language. — SB 98 3% Fee Cap Statutory Language Source: sdlegislature.gov

New customers (registered ≤72 hours): $2,500 daily limit, with a mandatory 72-hour hold on all transactions
Existing customers (registered >72 hours): $10,500 daily limit, no mandatory hold
Both limits are adjusted annually by CPI inflation
Limits apply across all operator products — affiliated kiosks, online portals, and over-the-counter transactions cannot be used to circumvent them

The anti-circumvention provision is notable. It means an operator can't simply direct a kiosk customer to an online portal or different machine to process additional volume beyond the daily cap.

The 72-Hour Hold: A Cooling-Off Period for First-Timers

Section 7 is the law's most innovative — and most disruptive — provision. Every new customer's transaction must be held for 72 hours. During that hold period: - The customer can cancel the transaction and receive a full refund (minus any irreversible third-party network fees) - The operator cannot provide provisional credit, vouchers, or off-chain ledger postings - The operator cannot represent to any party that funds or virtual currency are available or transferable This is designed to interrupt the scam pipeline. FBI data shows Bitcoin ATM fraud losses of $240 million in the first half of 2025 alone, with elderly victims disproportionately targeted. A 72-hour hold gives victims — or their family members, or law enforcement — time to intervene before the crypto leaves the operator's control. The hold applies only to new customers. Once someone has been a registered customer for more than 72 hours, their transactions process without the mandatory delay.

Blockchain Analytics Mandate

Section 13 requires operators to "employ software that analyzes data from publicly accessible distributed ledgers and traces addresses capable of sending or receiving virtual currency to identify risk indicators." The software must block transactions to destination addresses "reasonably likely or known to be connected to fraudulent activity." The law goes further: operators must also block transfers to addresses associated with overseas platforms that don't permit U.S. user access — targeting the offshore exchanges commonly used to launder scam proceeds. This provision essentially mandates tools like Chainalysis or TRM Labs as a cost of doing business in South Dakota.

Identity Verification and Strict Liability

Section 14 requires operators to obtain a government-issued ID and collect the user's full legal name, date of birth, phone number, mailing and physical addresses, and email address — for every transaction, not just those above certain thresholds. The kicker: the licensee "is strictly liable for any violation of this section." That means no intent requirement. If an operator processes a transaction where someone uses someone else's identity, the operator is liable regardless of whether it knew or should have known.

Disclosure and Warning Requirements

Section 6 mandates disclosures in the user's chosen language, covering standard risk warnings (no FDIC insurance, no government backing, price volatility). But it also requires a "prominent warning in bold type, provided separately from the other disclosure provisions," stating:

Required Scam Warning (Paraphrased from SB 98, Section 6):

This technology may be used to defraud you
If anyone — claiming to be a friend, family member, government agent, software representative, bill collector, or law enforcement officer — asks you to deposit money at this kiosk, stop the transaction immediately and call local law enforcement and the kiosk operator
Do not send money to anyone you do not personally know

Critically, the law states that a user's acknowledgment of these disclosures "does not affect or prevent a fraud victim's eligibility for a refund." In other words, operators can't use a "you clicked agree" defense to deny refunds.

Reporting and Transparency

The law requires operators to report to the South Dakota Division of Banking: - Transaction count, dollar volume, and gross revenue per kiosk - All complaints filed with the BBB or any state or federal agency, plus outcomes - Refund request volume, approval/denial rates, and amounts issued - SAR filing count and dollar amounts - Wallet addresses used by the operator - Number of transactions declined for suspected fraud - Contact information for the compliance officer This level of transparency is unprecedented. No other state requires operators to report per-kiosk revenue, refund denial rates, or SAR data to a state regulator.

The Licensing Framework

Section 2 requires all virtual currency kiosk operators in South Dakota to hold a money transmission license under SDCL Chapter 51A-17. The law explicitly treats virtual currency transactions as "a form of money transmission," eliminating any ambiguity about whether crypto kiosks fall under the state's existing licensing regime. This is the same approach that Nebraska took when it issued a cease and desist to Bitstop for operating without a license — but South Dakota has gone further by codifying kiosk-specific requirements on top of the general money transmission framework.

Additional Operational Requirements

The law also mandates: - **Live customer service** from 8:00 a.m. to 10:00 p.m. local time, with a toll-free number displayed on the kiosk - **Dedicated law enforcement liaison** — a phone line or email for fraud reports, monitored frequently, with operators required to assist investigations upon request - **Annual fraud training** for staff at kiosk locations (convenience store clerks, gas station attendants, etc.) - **Staff protection** — operators "may not prohibit or prevent staff at the location of the kiosk from educating users about fraud" - **Written anti-fraud policy** with risk identification, controls, monitoring, and periodic review

How SB 98 Compares to Other State Actions

South Dakota's approach is distinct from the enforcement-first strategies being used elsewhere:

State-by-State Comparison:

Chart summarizing key sourced metrics. — Key sourced metrics. Visualize the strongest filing metrics as a simple chart. Source: Bitcoin ATM News reporting

Massachusetts: Sued Bitcoin Depot (Feb. 2025) — alleging more than 80% of $10K+ customers were scam victims and charging drip pricing violations
Iowa: Sued Bitcoin Depot and CoinFlip — focusing on elderly scam facilitation and fee practices
DC: Sued Athena Bitcoin (Apr. 2026) — alleging hidden fees
Missouri: Issued civil investigative demands (Dec. 2024) to five operators including Bitcoin Depot, CoinFlip, Athena Bitcoin, RockItCoin, and Byte Federal
Tennessee: Passed an outright ban
South Dakota (SB 98): Detailed prescriptive regulation — allowing continued operation within strict guardrails

South Dakota is effectively betting that Bitcoin ATMs can be made safe through regulation rather than banned or litigated out of existence. Whether that bet pays off depends entirely on whether the 3% fee cap leaves enough margin for operators to comply with all the other requirements and still run a business.

What This Means for Bitcoin ATM Users in South Dakota

Starting July 1, 2026:

Your fees will drop dramatically — from the current industry average of 15–25% to a maximum of 3% total, including spreads
First-time transactions will be delayed 72 hours — you can cancel during that window for a full refund
You'll need a government ID for every transaction, plus your full name, date of birth, phone number, addresses, and email
Daily limits apply: $2,500 for your first 72 hours as a customer, $10,500 after that
If you're a scam victim, file a police report within 120 days and the operator must process your cancellation during the 72-hour hold period
Live customer service will be available 8 a.m. to 10 p.m. via a toll-free number on the machine

The most immediate impact: some or all of the approximately 170 kiosks currently operating in South Dakota may go offline if operators determine they can't be profitable at the 3% fee cap. Users in rural areas may lose access entirely. For those kiosks that remain, however, the consumer protections are the strongest in the country.

What This Means for Operators

SB 98 is an existential challenge to the current Bitcoin ATM business model. The math is straightforward: **Revenue impact:** A transaction that currently generates $150–$250 in fee revenue on a $1,000 transaction will generate a maximum of $30 under SB 98. Meanwhile, the law adds costs — blockchain analytics software, live customer service 14 hours a day, dedicated law enforcement liaisons, annual staff training, quarterly compliance reporting, and the working capital needed to hold new customer funds for 72 hours. **Compliance timeline:** With a July 1, 2026 effective date, operators have approximately six weeks from today to implement all requirements or pull their machines. **Strategic questions operators must answer now:** - Can you be profitable at 3% all-in fees at South Dakota transaction volumes? - Do you already hold a South Dakota money transmission license under SDCL 51A-17? - Can your software implement 72-hour holds with cancellation workflows? - Do you have blockchain analytics tools deployed that can block flagged addresses in real time? - Can you staff live customer service lines 8 a.m. to 10 p.m. Central time? Operators who decide the economics don't work will exit the state. Those who stay will be operating under the tightest regulatory framework in the country — and will likely need to treat South Dakota as a test case for similar legislation elsewhere. AARP is pushing Bitcoin ATM legislation in 30 states, and SB 98's specific provisions — particularly the 3% fee cap and 72-hour hold — could become the model bill.

The Bigger Question

South Dakota has roughly 170 Bitcoin ATMs serving a state of 920,000 people. In isolation, this law affects a tiny fraction of the industry. But the precedent is enormous. A U.S. senator has already suggested that federal market structure legislation could address crypto ATM scams. Australia's financial watchdog is considering the power to ban crypto ATMs outright. Tennessee has already passed a ban. SB 98 represents the middle path: heavy regulation rather than prohibition. The question the industry should be asking isn't whether operators can survive in South Dakota. It's whether they can survive if twenty more states pass something similar. Operators who want to understand their compliance standing across states can review the operators directory, and consumers concerned about Bitcoin ATM fraud can visit our consumer protection resources.

South Dakota's SB 98: The Most Detailed Bitcoin ATM Regulation Any State Has Passed