18%
Maximum Fee Per Transaction
$2,000
Daily Limit — New Users
$10,000
Monthly Limit — All Users
90 Days
Scam Refund Window
What the Law Actually Requires
Virginia's new Chapter 22.2 of Title 6.2 (Sections 6.2-2239 through 6.2-2266) creates an entirely new licensing category under the State Corporation Commission. Every operator with a kiosk in Virginia must obtain a license before conducting any transactions. Operating without one voids all transactions and strips the operator of any right to collect fees. The law's key provisions break into five categories: licensing, transaction limits, fee caps, fraud prevention, and consumer refunds.Licensing and Reporting
Operators must apply through the Commission with detailed information about ownership structure, principal officers, and all kiosk locations. Applications require a surety bond between $1,000 and $25,000. The Commission can investigate applicants' financial responsibility, character, and fitness before granting a license. Once licensed, operators face a reporting burden unlike anything in the current state landscape:Virginia's Reporting Requirements:
- Annual report (due March 31): Gross revenue, total transaction count and value, total refunds issued, all consumer complaints filed with any agency, suspicious activity report counts and dollar amounts, virtual currency addresses used at each location
- Quarterly report (within 45 days of quarter end): Legal name and address of each kiosk location, start/end dates of operation, virtual currency addresses used, and number of transactions declined due to suspected illicit activity
- Event reports (within 15 days): Bankruptcy filings, regulatory proceedings, felony indictments or convictions of any principal, and AG enforcement actions
Transaction Limits and the 48-Hour Hold
Virginia creates a tiered system based on user history: New users — defined as anyone within their first 14 days of transacting — are capped at $2,000 per day. All users face a $5,000 daily maximum and a $10,000 monthly cap. But the most operationally significant provision is the mandatory 48-hour hold for all new user transactions. During that hold period, the new user can contact the operator to cancel and receive a full refund. The transaction simply doesn't complete for two days. This is designed to break the scam cycle. Most Bitcoin ATM fraud follows a pattern: a scammer pressures the victim into depositing cash immediately, the crypto is transmitted within minutes, and it's gone forever. A 48-hour hold gives victims — and their families — time to recognize the fraud and reverse it. A person who transacts on three or more days within the 14-day new user period graduates to regular user status, with the higher $5,000 daily limit.The 18% Fee Cap
Section 6.2-2256 states plainly: "No licensee shall collect any charge from a user relating to a single virtual currency kiosk transaction that exceeds 18 percent of the value of such transaction." Virginia's definition of "charge" is broad — it includes "any difference between the market price of virtual currency and the price of such virtual currency charged to the user," plus standard transaction fees, wallet creation fees, exchange fees, and transfer fees. This is designed to prevent the drip pricing that has drawn lawsuits in Iowa, Massachusetts, and elsewhere, where operators display one price on screen and bury additional fees in the exchange rate spread. At 18%, Virginia's cap is meaningful but imperfect. It's well below the 20–25% effective rates that state attorneys general have alleged in recent enforcement actions against operators like Bitcoin Depot and CoinFlip. But it's far higher than what consumers pay for comparable financial services. A traditional ATM charges a flat fee of $2–3. A wire transfer costs a flat $25–30. Paying $180 in fees on a $1,000 transaction is still an extraordinary cost, and it falls disproportionately on the unbanked and underbanked populations that Bitcoin ATMs are often marketed to serve. Virginia's cap will cut the worst abuses, but legislators should revisit this number as more data comes in about what it actually costs to operate a compliant kiosk.Fraud Prevention Mandates
The law requires every operator to: - Use blockchain analytics and tracing software to screen transactions against wallets associated with fraudulent activity - Block transactions to virtual currency wallets associated with overseas exchanges not accessible to U.S. users - Maintain a written anti-fraud policy addressing risk identification, monitoring procedures, and periodic policy review - Verify user identity via government-issued ID before accepting payment - Post conspicuous scam warnings at every kiosk, including a toll-free customer service number - Provide annual staff training materials to every location detailing how criminals exploit kiosks, including red flag indicators The mandatory on-screen scam warning must include this exact language:"WARNING: This technology can be used to defraud you. If someone asked you to deposit money in this machine or is on the phone with you and claims to be a friend or family member, government agent, computer software representative, bill collector, law-enforcement officer, or anyone you do not know personally: STOP THIS TRANSACTION IMMEDIATELY and contact your local law enforcement and the kiosk operator. This may be a scam. NEVER SEND MONEY to someone you don't know."
— Mandatory disclosure, Virginia Code § 6.2-2253(C)
The Scam Refund Provision
Virginia requires operators to refund all transaction fees to fraud victims — in the originating currency — regardless of any acknowledgments the user clicked through before completing the transaction. That last clause is critical: it means operators cannot use their own terms of service or consent screens as a defense against refund claims. To receive a full refund, a victim must:Virginia Scam Refund Requirements (§ 6.2-2254(F)):
- Have engaged in a transaction affected by fraud — whether they authorized it or not
- Notify the operator of the fraud within 90 days of the transaction
- Submit a police report, government agency report, or sworn statement to the operator within 120 days of the transaction
Additional Provisions: ATM Branding Ban, Local Preemption, and Consumer Protection Act Integration
Several other provisions in the law deserve attention: **No "ATM" branding.** Section 6.2-2260 prohibits operators from using the words "automated teller machine" or "ATM" in connection with a virtual currency kiosk. This targets the consumer confusion that regulators have flagged — people who see a machine labeled "Bitcoin ATM" and assume it carries the same protections as a bank ATM. **Local governments can go further.** Section 6.2-2240 explicitly states the law establishes "minimum standards" and does not preempt local ordinances that impose stricter requirements. Counties and municipalities in Virginia can adopt their own regulations — lower transaction limits, additional licensing requirements, or outright bans — without running afoul of state law. **Consumer Protection Act violations.** Section 6.2-2266 declares that any violation of the new chapter constitutes a prohibited practice under Virginia's Consumer Protection Act (§ 59.1-200). This gives the Attorney General full enforcement authority, including the ability to seek injunctions, damages, restitution, and attorney fees. **Live customer service required.** Every operator must provide live customer service during all operating hours and between 8 a.m. and 10 p.m. daily. A toll-free number must be displayed on every kiosk.Effective Dates: A Two-Phase Rollout
The law lists two effective dates: July 1, 2026 and July 1, 2027. A close reading of the enacted text — Chapter 654 of the 2026 Acts of Assembly — indicates that the licensing framework takes effect first, with the substantive consumer protection and operational requirements following a year later.Implementation Timeline:
- July 1, 2026: Licensing provisions take effect — operators must obtain a license from the State Corporation Commission before operating any kiosk in Virginia. The Commission can begin accepting applications, conducting investigations, and requiring surety bonds. Operating without a license voids all transactions.
- July 1, 2027: Consumer protection and operational provisions take effect — fee caps (18% maximum), transaction limits ($2,000/day new users, $5,000/day all users, $10,000/month), the 48-hour hold for new users, fraud prevention mandates, blockchain analytics requirements, mandatory scam warnings, scam refund obligations, quarterly reporting, the ATM branding ban, and customer service requirements.
Editorial Assessment: What Virginia Gets Right — and Wrong
Virginia's law is the most thoughtfully constructed Bitcoin ATM regulation we've seen from any state. It avoids the nuclear option Tennessee and Indiana chose — outright bans that eliminate consumer access entirely and push activity to unregulated peer-to-peer channels. It also goes far beyond the minimal frameworks some states have adopted. Several provisions deserve genuine praise.What Virginia Gets Right
**The 48-hour hold targets the real risk window.** The mandatory hold for new user transactions is the strongest anti-scam mechanism any state has enacted short of a ban. The overwhelming majority of Bitcoin ATM scam victims are first-time users who have never touched a kiosk before. A scammer directs them to a machine, walks them through the process over the phone, and the money is gone in minutes. The 48-hour hold breaks that cycle entirely. Research and law enforcement experience consistently show that the first 24 to 48 hours are the critical danger window — the period when a victim is still under the psychological control of the scammer. After that window closes, victims often come to their senses on their own, or a family member, friend, or law enforcement officer intervenes. A scammer simply cannot maintain the pressure and urgency that makes these scams work over a two-day hold. This single provision may prevent more fraud than every scam warning label on every kiosk in America combined. The 14-day new user classification period is a reasonable structural choice — it ensures the hold applies to anyone still early in their kiosk usage — though the real anti-scam power comes from the 48-hour hold itself, not the 14-day window. Virginia legislators appear to have understood what matters most: blocking the immediate, impulsive transaction that a scammer demands. **Quarterly declined-transaction reporting is an accountability mechanism with teeth.** By forcing operators to report how many transactions they block for suspected fraud, Virginia creates a metric regulators can actually use. An operator reporting zero declined transactions across hundreds of kiosks is either not screening or not being honest — either way, the Commission will know where to look. **The broad definition of "charge" closes the drip pricing loophole.** By explicitly including exchange rate spreads in the definition, Virginia has addressed the exact pricing deception that triggered lawsuits from the Massachusetts, Iowa, and DC attorneys general. Operators can't advertise "low fees" while hiding the real cost in an inflated exchange rate. **The refund override of consent screens is long overdue.** Operators have historically used "I agree" buttons as liability shields — arguing that scam victims consented to the transaction and therefore can't claim a refund. Virginia's statute neutralizes this defense entirely. That's the right call. A scam victim clicking "I agree" under duress is not meaningfully consenting.Where Virginia Falls Short
**The one-year delay on consumer protections is a missed opportunity.** Licensing first, protections later makes logistical sense — but it means Virginia consumers remain exposed through mid-2027 to the same high fees, lack of holds, and minimal fraud screening that prompted the law in the first place. The Commission should use its regulatory authority under Section 6.2-2259 to accelerate at least the scam warning and blockchain screening requirements if possible. **The transaction limits are too restrictive for legitimate commerce.** A $2,000 daily cap for new users is one thing — that's the anti-scam provision, and it works. But the $5,000 daily maximum and $10,000 monthly cap for all users, including established customers with months or years of transaction history, is a different problem. These limits don't just restrict scam victims. They restrict every legitimate Bitcoin buyer in the state who prefers to use cash. A person selling a used car for $12,000 and wanting to convert the proceeds to Bitcoin over two weeks can't do it. A small business owner who wants to build a Bitcoin position can't transact more than $10,000 a month through any combination of kiosks in the state. Virginia is a state that collects sales tax on these transactions. Every dollar pushed out of state-regulated kiosks and into unregulated peer-to-peer markets, online exchanges, or kiosks across state lines is a dollar Virginia can't tax and can't monitor. The monthly cap particularly punishes established users who have already proven they're not scam victims — the exact population that poses the least risk and generates the most taxable economic activity. The law gives the Commission regulatory authority that could be used to adjust these figures over time. It should. **The 18% fee cap is better than nothing but still high.** As noted above, 18% is an extraordinary cost for what is essentially a currency exchange transaction. Virginia should study actual operator cost structures — compliance costs, machine maintenance, cash handling, licensing fees — and revisit whether the cap can come down as the market matures. **Civil penalties max out at $1,000 per violation.** Section 6.2-2264 limits Commission-imposed fines to $1,000 per violation. For a large-scale operator processing thousands of transactions per month, that's barely a rounding error. The Consumer Protection Act enforcement authority provides the Attorney General with more powerful tools, but the Commission's direct penalty authority is underwhelming.The Broader State Landscape
Virginia's law arrives amid a nationwide crackdown. The FBI reported approximately $114 million in Bitcoin ATM scam losses in 2023, $250 million in 2024, and over $333 million in 2025. About 67% of crypto ATM fraud victims in 2024 were over 60 years old, according to federal data. The median loss per incident was approximately $10,000. Multiple state attorneys general have filed lawsuits against major operators. The Massachusetts AG sued Bitcoin Depot alleging more than 80% of customers depositing $10,000 or more were scam victims. The Iowa AG sued both Bitcoin Depot and CoinFlip, alleging approximately 95% of CoinFlip transactions were scam-related. The DC AG sued Athena Bitcoin, alleging a median victim age of 71 and 93% of transactions tied to fraud. The Missouri AG issued civil investigative demands to five operators in December 2024, signaling an industry-wide probe. Virginia legislators cited these patterns in pushing HB 665 through with bipartisan support — the companion Senate bill passed unanimously, and the House version passed 84–13. The bill had eight sponsors led by Delegate Michelle Maldonado (D-020).What This Means for Virginia Consumers
What Virginia Bitcoin ATM users should know:
- Starting July 1, 2026: Every kiosk operator in Virginia must be licensed by the State Corporation Commission. If an operator isn't licensed, its transactions are legally void and it has no right to collect fees from you.
- Starting July 1, 2027: Fees cannot exceed 18% of your transaction — including any spread between market price and the price the operator charges you
- If you're a new user (after July 1, 2027): You cannot transact more than $2,000/day, and your first transaction will be held for 48 hours before it completes — you can cancel for a full refund during that window
- All users (after July 1, 2027): $5,000/day maximum, $10,000/month maximum
- If you were scammed (after July 1, 2027): You have 90 days to notify the operator and 120 days to submit a police report or sworn statement — the operator must refund your transaction fees regardless of any consent screens you clicked
- Every kiosk must display (after July 1, 2027): The operator's toll-free phone number, a scam warning, and risk disclosures about virtual currency not being FDIC-insured
- Make your voice heard: If you believe Virginia's protections should take effect sooner — or if you support the current framework — contact your state delegate or senator. Local governments can also enact stricter rules under this law. Your county board of supervisors and city council have the power to set lower transaction limits or impose additional requirements
- Visit our consumer protection resources for guidance on reporting Bitcoin ATM fraud
What This Means for Operators
Every operator with kiosks in Virginia faces a compliance overhaul — but the two-phase timeline gives you a structured runway. **By July 1, 2026:** Obtain a license from the State Corporation Commission. File a surety bond of up to $25,000. Provide full ownership structure, principal officer information, and all kiosk locations. Ensure your legal or fictitious name on the license matches what appears on your machines. Any kiosk operated without a license after this date is illegal and all transactions are void. **By July 1, 2027:** Reprogram kiosks to enforce the $2,000 new user daily cap, $5,000 user daily cap, and $10,000 monthly cap. Implement the 48-hour hold mechanism for new users. Adjust pricing to stay at or below 18% all-in — including exchange rate spreads. Deploy mandatory scam warning language on every screen. Implement blockchain analytics screening that blocks transactions to wallets associated with overseas exchanges inaccessible to U.S. users. Establish a live customer service line available during all operating hours and 8 a.m. to 10 p.m. daily. Remove any "ATM" branding from machines and marketing materials. Build systems to handle fraud refund requests within the 90/120-day statutory windows. **Ongoing:** Prepare for examinations at least once every three years. File quarterly reports within 45 days of each quarter's end — including the number of transactions declined for suspected illicit activity. File annual reports by March 31 with full revenue, transaction, and SAR data. Provide annual staff training materials to every host location. Report any regulatory proceedings, felony indictments, or AG actions within 15 days. Operators should pay particular attention to the non-preemption clause. Virginia's law is a floor, not a ceiling. Local jurisdictions — particularly in Northern Virginia, Richmond, and Hampton Roads — could impose additional requirements or lower limits. Operators with kiosks across multiple Virginia localities may face varying compliance obligations. The fee cap will squeeze margins for operators currently pricing above 18%. But the refund mandate may be the bigger financial exposure: operators who fail to screen for fraud and process high volumes of scam transactions will owe refunds on every fee collected from those victims, with the AG empowered to enforce under the Consumer Protection Act. The $10,000 monthly cap will reduce revenue from high-volume legitimate users. Operators who have built their business model around large cash-to-crypto conversions will feel this most acutely. The business case for Virginia kiosks now depends almost entirely on transaction volume from moderate-sized purchases — which means location strategy matters more than ever.A note for operators — and consumers — in states without these protections:
Virginia is one of a growing number of states enacting Bitcoin ATM regulations. If your state hasn't acted yet, that isn't permanent. The pace of legislative activity in 2025 and 2026 has been extraordinary, with at least 11 states passing new crypto kiosk laws since 2023. Operators who want to shape these regulations rather than react to them should be engaging with their state legislators now — before a bill is drafted without industry input. And consumers who want stronger protections — or who have been scammed and found no recourse — should contact their state representatives and share their experiences. The laws being written this year and next will define this industry for a decade. Sitting on the sidelines is not a strategy.