Utah's New ATM Law Sets Graduated Transaction Limits, Fraud

Utah's enrolled HB 72 — signed March 25 and effective May 6, 2026 — creates an entirely new regulatory chapter for Bitcoin ATMs in the state, imposing graduated daily transaction limits, mandatory fraud prevention warnings in English and Spanish, and penalties of up to $2,500 per violation. The law caps new customers at $2,000 per calendar day for their first three days, then $5,000 per day afterward — a tiered structure designed to slow scam-driven cash extraction while preserving access for legitimate users. For operators running kiosks in Utah, this is a compliance overhaul. The law doesn't just limit transactions — it mandates receipts with specific content, a toll-free customer service line, annual location reports filed with the state, 30-day notice after installing or removing a kiosk, complete transaction and customer recordkeeping, blockchain analytics to block transactions to known fraudulent addresses, and cooperation with law enforcement investigations. Operators who violate any of these requirements face administrative fines of $2,500 per violation, civil penalties of $2,500 per violation in court, and up to $5,000 for violating an administrative or court order. For an industry facing outright bans in Indiana and Tennessee, and ban proposals advancing in Minnesota and other states, Utah's approach represents a different theory: regulate the machines heavily rather than eliminate them. Whether operators view that as a lifeline or a burden depends on how prepared they are for the compliance work that starts in nine days.

$2,000/day

New Customer Limit (First 3 Days)

$5,000/day

Established Customer Limit

$2,500

Fine Per Violation

90%+

Utah Kiosk Transactions Tied to Scams (Per Investigation)

Who Pushed This Law — and Who Pays the Price

HB 72 didn't emerge from abstract policy debate. Its path to the governor's desk was paved substantially by AARP lobbying and a vocal coalition of elderly scam victims and their families. This is a well-organized and deeply sympathetic advocacy group, and their testimony was devastating — stories of retirees losing life savings to fraudsters who coached them through Bitcoin ATM transactions. No legislator wants to vote against protecting grandparents.

AARP Utah State Director Alan Ormsby thanks Representative Wilcox and Senator Brammer for passing HB 72 in an Instagram video — AARP Utah State Director Alan Ormsby thanks Representative Ryan Wilcox and Senator Brady Brammer for leading HB 72. Source: @aarputah on Instagram, March 18, 2026

Law enforcement witnesses described cases including an elderly Utah man who was manipulated into feeding roughly $50,000 in cash into Bitcoin ATMs over a period of weeks. During those hearings, one investigation was cited claiming over 90% of money sent through Utah crypto kiosks was tied to scams — a figure the bill's sponsor, Representative Wilcox, placed at the center of the case for regulation.

"An elderly Utah man was scammed into feeding roughly $50,000 in cash into Bitcoin ATMs over a period of weeks."

— Example cited in Utah legislative hearings on HB 72

The Utah experience mirrors national trends. The FBI received nearly 11,000 crypto ATM fraud complaints in 2024 totaling more than $246 million in losses. Adults 60 and older represent approximately 86% of those losses. The elderly victims who testified were vocal, sympathetic, and well-organized. Legislators responded accordingly. But the political dynamics obscure an important reality about who actually uses Bitcoin ATMs. Scam victims — overwhelmingly elderly, overwhelmingly new to the machines — represent a small fraction of total kiosk users. The vast majority of Bitcoin ATM customers are repeat users making routine purchases: unbanked individuals, immigrants sending remittances, small investors buying cryptocurrency, and people who prefer the privacy and immediacy of cash-to-crypto conversion. These are people who have never been scammed and are statistically very unlikely to be. The data supports this distinction. Most scams target first-time or very new users. A scammer coaches a victim to a Bitcoin ATM they've never used before, pressures them to deposit cash, and the victim — once they realize what happened — never returns. They don't become repeat Bitcoin ATM customers. The scam transaction is typically their first and last. This is exactly why the graduated limit structure matters, and why it's also the law's most revealing tension. The $2,000 cap during the first three days targets the actual risk window — the period when scam victims are most vulnerable. That part of the law makes sense. But the $5,000 daily cap for established customers — people who have already demonstrated they're legitimate, repeat users — is harder to justify on anti-fraud grounds. A customer who has been using an operator's kiosks for months or years poses virtually no scam risk. Yet they now face a permanent daily ceiling that didn't exist before. The super majority of regular Bitcoin ATM users now face low daily limits of $5,000 despite being very unlikely victims of scams. A small business owner who periodically converts $8,000 in cash to Bitcoin must now split that transaction across two days. A regular user who wants to make a $6,000 purchase simply cannot, no matter how long they've been using the machine. The $5,000 cap is a concession to the political reality that AARP and allied advocates carried the bill. The industry, to its credit, successfully negotiated the limit up from tighter proposals — Arizona and Wisconsin impose flat $2,000 daily caps with no escalation — but the result is still a restriction that falls disproportionately on legitimate users to solve a problem concentrated among people who use the machines once and never come back.

The Core Tension:

Scam victims are overwhelmingly new, one-time users — the $2,000 first-three-day cap directly addresses this group.
Repeat, established customers — the super majority of Bitcoin ATM users — are extremely unlikely scam victims, yet they now face a permanent $5,000 daily cap.
The law was driven by AARP lobbying and elderly victim testimony — a vocal and sympathetic minority whose experience, while devastating, does not reflect how most people use these machines.
The graduated structure was an industry-negotiated compromise. Without it, Utah might have joined the ban camp.

This isn't unique to Utah. Across the country, Bitcoin ATM regulation is being shaped by the most visible and sympathetic harm — elderly fraud — while the everyday users who would be most affected by restrictions have no organized advocacy and no seat at the table. AARP has lobbyists. A 34-year-old immigrant using a Bitcoin ATM to send money to family does not.

What the Law Actually Requires

HB 72 creates a new chapter in Utah code — Title 13, Chapter 82, Virtual Currency Kiosk Regulation — and imposes requirements across five categories: transaction limits, disclosures, fraud prevention, recordkeeping, and enforcement cooperation. It also requires all crypto kiosk operators to obtain a money transmitter license and register every machine with the state — formalizing a requirement that FinCEN already imposes at the federal level under the Bank Secrecy Act but that many states have been slow to codify specifically for kiosks.

Graduated Transaction Limits

The bill's most operationally significant provision is a two-tier daily cap system. During the three calendar days following a customer's first-ever transaction with an operator, that customer cannot transact more than $2,000 in cash (or virtual currency equivalent) per calendar day. After that three-day introductory period, the daily limit rises to $5,000. Under these limits, a new customer could deposit no more than $6,000 total in their first three days ($2,000 × 3). The elderly victim described in testimony lost $50,000 — a sum that would now take at minimum 12 days to reach even at maximum daily limits, dramatically expanding the window for family members, bank staff, or law enforcement to intervene. That's the strongest argument for the limits. The weakest argument is applying the $5,000 cap permanently to someone who has been using the same operator's kiosks for two years without incident. The structure reflects industry negotiation. The graduated approach replaced earlier, more restrictive proposals and was specifically designed so that the tighter cap falls on the window when scam vulnerability is highest — those first few days when a fraudster is actively coaching the victim. Whether $5,000 is the right permanent ceiling for established users is debatable, but the tiered logic is sound from a fraud-prevention standpoint for the introductory period.

Fraud Prevention Warnings

Every kiosk must display a prominent fraud prevention warning in both English and Spanish. The warning must communicate that cryptocurrency transactions are irreversible and that no government official will ever demand payment via a cryptocurrency machine. The bilingual requirement reflects the demographics of Bitcoin ATM users in Utah and the reality that scammers target non-English-speaking victims.

Disclosure and Receipt Requirements

Operators must provide all disclosures in the customer's chosen language. Each transaction must generate a receipt showing the transaction hash, fees charged, exchange rate applied, and the operator's refund policy. These aren't optional add-ons — they're statutory requirements enforceable by fine.

Customer Service and Recordkeeping

The law mandates a toll-free customer service line. Operators must maintain complete transaction and customer records. The combination serves dual purposes: giving scam victims a way to report fraud immediately and giving law enforcement a data trail to follow.

Location Reporting and Blockchain Analytics

Operators must file annual reports with the state listing every kiosk location in Utah. They must also provide 30-day notice after installing or removing a kiosk. This creates a state registry of every Bitcoin ATM — something most states lack entirely. The enrolled bill also requires operators to implement blockchain analytics tools to block transactions to known fraudulent wallet addresses (Section 7-29-203(2)). This pushes compliance beyond traditional know-your-customer checks into active transaction monitoring — a capability that larger operators already use but smaller ones may struggle to implement.

Full Requirements Under HB 72 (Effective May 6, 2026):

Transaction limits: $2,000/day for first 3 days; $5,000/day thereafter
Fraud warnings: Prominent display in English and Spanish on every kiosk
Disclosures: Provided in the customer's chosen language
Receipts: Must include transaction hash, fees, exchange rate, and refund policy
Customer service: Toll-free phone line required
Records: Complete transaction and customer records; law enforcement cooperation mandated
Location reporting: Annual reports plus 30-day notice for installations or removals
Blockchain analytics: Must block transactions to known fraudulent addresses
Licensing: Money transmitter license required; every machine registered with the state

Enforcement and Penalties

Utah places enforcement authority with the Division of Consumer Protection rather than a banking regulator — a choice that signals the legislature views Bitcoin ATMs primarily as a consumer protection issue, not a financial services licensing question.

Penalty Structure Under HB 72

Administrative Fine

The Division of Consumer Protection may impose up to $2,500 for each violation, without court involvement.

Court-Imposed Civil Penalty

A court may impose up to $2,500 for each violation in a civil enforcement action.

Order Violation Penalty

Violation of an administrative or court order subjects the operator to up to $5,000 for each subsequent violation — effectively doubling the penalty for operators who ignore initial enforcement actions.

The "per violation" language is significant. An operator running 50 kiosks without proper fraud warnings could theoretically face $125,000 in administrative fines — one violation per machine. An operator who continues operating after a cease-and-desist order faces the elevated $5,000-per-violation tier. At $2,500 per violation, these penalties are mid-range compared to other states. They're meaningful enough to get operators' attention but far less than the existential-level enforcement actions seen elsewhere — the Massachusetts Attorney General filed a full consumer protection and securities fraud lawsuit against Bitcoin Depot in February 2025. Tennessee's new ban makes operating an unlicensed kiosk a criminal offense. The critical unknown is staffing. The Division of Consumer Protection will need to monitor compliance across every kiosk operator in the state, verify annual location reports, and investigate complaints. How aggressively Utah resources this program will determine whether HB 72 functions as a real deterrent or a paper framework.

How Utah Compares to Other States

Utah's approach arrives during the most active period of state-level Bitcoin ATM regulation in the industry's history. The landscape is splitting into three camps:

State-by-State Comparison: Bitcoin ATM Regulation (April 2026)

Ban states: Indiana and Tennessee have enacted outright prohibitions. Minnesota's ban bill has passed both chambers.
Heavy regulation states: Utah (HB 72), South Dakota (SB 98), and Rhode Island have enacted detailed operational frameworks with transaction limits, disclosure requirements, and enforcement mechanisms.
Flat daily cap states: Arizona and Wisconsin impose flat $2,000 daily caps with no escalation.
Light or no regulation states: Many states still rely only on federal MSB requirements and general consumer protection statutes.

Utah's $5,000 established-customer limit is notably more permissive than Arizona and Wisconsin's flat $2,000 caps. This reflects the industry negotiation that shaped the bill — operators successfully argued that legitimate customers need higher limits after an initial trust-building period. Arizona's newer HB 2387 takes yet another approach, with $2,000 for new customers but $10,500 for established ones — recognizing even more explicitly that the risk drops dramatically after the initial period. The fraud warning requirement in both English and Spanish is increasingly standard, but Utah's mandate that all disclosures be provided in the customer's chosen language goes further than most states. The 30-day kiosk installation and removal notification is also unusual and creates a real-time registry of Bitcoin ATM locations that could prove valuable for law enforcement tracking fraud patterns.

What This Means for Utah Bitcoin ATM Users

What Changes for You After May 6, 2026:

Your first three days are capped at $2,000/day. If you've never used a particular operator's kiosks before, you cannot transact more than $2,000 in cash or crypto per calendar day for three days.
After three days, your daily limit is $5,000. This applies per operator — using a different company's kiosk resets the clock.
You'll see fraud warnings in English and Spanish on every machine, stating that crypto transactions are irreversible and no government official will ever ask you to pay via a kiosk.
You'll get real receipts showing the transaction hash, fees, exchange rate, and refund policy.
You can call someone. Every operator must maintain a toll-free customer service line. If you believe you've been scammed, call immediately.
Disclosures must be in your chosen language, not just English.
If someone is pressuring you to deposit cash at a Bitcoin ATM, stop. Visit our consumer protection resources or call the Utah Division of Consumer Protection.

If you're a regular Bitcoin ATM user buying a few hundred dollars in crypto, these changes won't affect your daily life. You'll see new signage and get better receipts, both of which are genuine improvements. If you're an established user who occasionally makes larger purchases — say, $6,000 or $7,000 at a time — you'll now need to split those across multiple days. This is the trade-off the Utah legislature made: a permanent daily cap on all users, driven primarily by the fraud experiences of first-time users who will never use the machines again. Whether you think that's reasonable depends on whether you believe the political alternative — an outright ban — was a real possibility. If someone is pressuring you to deposit cash at a Bitcoin ATM, the new law is designed specifically to slow that process and give you time to recognize the scam. But the most important thing hasn't changed: no government agency, utility company, or law enforcement officer will ever ask you to pay via a cryptocurrency kiosk. Ever.

What This Means for Operators

May 6 is nine days away. Operators with kiosks in Utah face an immediate compliance checklist:

Operator Compliance Checklist — Due May 6, 2026:

Transaction limit enforcement: Systems must distinguish new customers from established ones and enforce the $2,000/$5,000 graduated caps per calendar day across all of your Utah kiosks. If a customer uses your kiosk in Provo and then walks into another of your machines in Salt Lake City, your system must recognize that customer and enforce the cumulative daily cap.
Fraud warning signage: Install prominent English and Spanish fraud prevention warnings on every Utah kiosk by May 6.
Multi-language disclosures: Ensure all disclosures can be displayed in the customer's chosen language.
Receipt generation: Confirm receipts include transaction hash, fees, exchange rate, and your refund policy.
Toll-free customer service line: Establish or verify a working toll-free number — this must be operational, not just listed.
Blockchain analytics: Deploy tools to screen and block transactions to known fraudulent wallet addresses.
Location reporting: Prepare to report every Utah kiosk location to the Division of Consumer Protection annually. Implement a process to notify the state within 30 days of adding or removing any kiosk.
Money transmitter license: Confirm valid Utah licensure. Operating without one exposes you to additional regulatory action.
Recordkeeping and law enforcement cooperation: Maintain complete transaction and customer records. Formalize processes for responding to investigations.

The blockchain analytics mandate may be the steepest technical hurdle. Major operators like Bitcoin Depot and CoinFlip likely already use tools from companies like Chainalysis or Elliptic. But smaller operators running a handful of kiosks may need to contract with third-party providers. The cost of blockchain analytics subscriptions can run into five or six figures annually, which could push marginal operators out of the Utah market entirely. The cross-machine daily limit tracking is the most operationally complex requirement. Operators without robust identity verification and centralized transaction monitoring will need to invest in infrastructure — or reduce their Utah footprint. The 30-day installation and removal notice is operationally unusual as well. Most states don't require notification when an operator places or pulls a kiosk. Every missed or late filing is a potential $2,500 violation. Operators should also note what HB 72 signals about the political environment. The AARP-driven lobbying coalition that pushed this bill exists in every state. Utah's outcome — heavy regulation instead of a ban — was an industry win relative to Indiana, Tennessee, and Minnesota. But it only happened because operators engaged with the legislative process and negotiated on limits. In states where the industry is absent from the table, the ban camp wins by default. The price of staying in business is showing up and accepting that some restrictions — even ones that disproportionately burden legitimate customers — are the cost of avoiding prohibition.

The Bigger Picture: Regulation vs. Prohibition

Utah's approach is significant precisely because it isn't a ban. At a moment when Tennessee has criminalized Bitcoin ATMs, Minnesota is advancing prohibition legislation, and at least one more state has a ban bill on a governor's desk, Utah chose to regulate the industry rather than eliminate it. That choice carries an implicit bet: that fraud warnings, transaction limits, blockchain screening, and enforcement penalties can reduce scam losses without eliminating consumer access to crypto kiosks. The test of that theory is whether operators actually comply and whether the Division of Consumer Protection enforces the rules aggressively enough to matter. A law with $2,500 fines but no enforcement staff is just paper. A law backed by consistent inspection and meaningful penalties could become a model for states still deciding between regulation and prohibition. But there's a harder question embedded in Utah's law that no state has grappled with honestly: how much should the majority of users be restricted to protect a vulnerable minority? The 90% scam figure cited in legislative hearings is alarming, but even if accurate, it measures the share of money flowing through kiosks that was scam-related — not the share of users who are victims. Most scam victims use a kiosk once, lose money, and never return. The repeat, established customers who make up the ongoing user base are a fundamentally different population with fundamentally different risk profiles. The graduated limit structure acknowledges this distinction — $2,000 for new users, $5,000 for established ones — but the permanent cap on established users suggests the legislature wasn't fully persuaded by its own logic. States watching Utah's experiment include New Hampshire, where the House recently rejected a pro-industry amendment to its own crypto ATM scam bill, and South Dakota, which passed its own detailed regulatory framework. If Utah's fraud numbers improve measurably after May 6, the regulation model gains credibility as an alternative to the bans sweeping other states. If operators skirt the rules and enforcement is thin, it becomes ammunition for the prohibition camp. The question every operator in Utah should be asking: when the Division of Consumer Protection starts reviewing annual location reports and transaction data after May 6, what will it find? And the question every regular Bitcoin ATM user should be asking: who was in the room when these limits were set — and why wasn't anyone there representing you?

Note: No official press release or statement from the Utah governor's office has been located alongside the enrolled bill. The enrolled text is published on the Utah Legislature's website and the bill was signed March 25, 2026.

Supporting source image for filing source document. — Filing source document Source: le.utah.gov

Utah's New Bitcoin ATM Law Sets Graduated Transaction Limits, Fraud Warnings, and $2,500-Per-Violation Penalties