FIN-2025-NTC1, Notice on the Use of CVC Kiosks for Scam Payments and Other Illicit Activity (also saved by another researcher at sources/kyc-aml/)
Document text
Research, not advice. Part of the Bitcoin research archive (October 2026). Claims labelled unverified, contested or fringe are reported, not endorsed; statuses of bills and rules are as of the date checked. Government, court and patent records are public domain; the research notes are CC BY 4.0.
FIN-2025-NTC1 August 4, 2025
FinCEN Notice on the Use of Convertible Virtual Currency
Kiosks for Scam Payments and Other Illicit Activity
The U.S. Department of the Treasury’s Financial Crimes
Suspicious Activity Report
Enforcement Network (FinCEN) is issuing this Notice
(SAR) Filing Request
to financial institutions1 urging them to be vigilant in
FinCEN requests that financial identifying and reporting suspicious activity involving
institutions reference this Notice convertible virtual currency (CVC) kiosks. CVC kiosks—also
in SAR field 2 (Filing Institution called cryptocurrency (crypto) Automated Teller Machines
Note to FinCEN) and the
(ATMs)—are ATM-like devices or electronic terminals that
narrative by including the key
allow customers to exchange real (or fiat) currency for
term “FIN-2025-CVCKIOSK”.
virtual currency and vice versa.2
While CVC kiosks can be a simple and convenient way for consumers to access CVC, scammers
and other illicit actors can also exploit their simplicity and convenience. According to the Federal
Bureau of Investigation’s (FBI) Internet Crime Complaint Center (IC3), criminals engaged in fraud
schemes often direct victims to use a CVC kiosk to send payments under false pretenses. In 2024,
the FBI’s IC3 received more than 10,956 complaints reporting the use of CVC kiosks, with reported
victim losses of approximately $246.7 million.3 This represents a 99 percent increase in the number
of complaints and a 31 percent increase in reported victim losses from 2023.4 The Federal Trade
Commission (FTC) likewise identified, based on an analysis of consumer reports, that fraud losses
through CVC kiosks have skyrocketed.5
FinCEN, through analysis of Bank Secrecy Act (BSA) information, has observed that CVC kiosks
have also been used to launder suspected drug proceeds. The Drug Enforcement Administration
(DEA) reports that transnational criminal organizations (TCOs) such as Cartel Jalisco Nueva
Generación are increasingly adopting CVC because it enables rapid international funds
transfers.6 In areas that face a significant drug-related threat and that have a significant
1. See 31 U.S.C. § 5312(a)(2); 31 CFR § 1010.100(t).
2. FinCEN previously discussed illicit finance risks related to CVC kiosks in a 2019 advisory. See FinCEN, FIN-
2019-A003, “Advisory on Illicit Activity Involving Convertible Virtual Currency” (May 9, 2019), at p. 7. This Notice
supplements the information provided in that 2019 advisory.
3. FBI, IC3, “Internet Crime Report 2024” (“2024 IC3 Report”), at p. 36.
4. Id.
5. See FTC, “Bitcoin ATMs: A payment portal for scammers” (“FTC Report”) (Sept. 3, 2024).
6. See DEA, “2025 National Drug Threat Assessment” (May 2025), at pp. 10, 64.
1
F I N C E N N O T I C E
number of CVC kiosks, TCOs may launder money through CVC kiosks as an alternative to bulk
cash smuggling.7
This Notice describes illicit finance typologies associated with CVC kiosks, provides red flag
indicators to assist with identifying and reporting related suspicious activity, and reminds financial
institutions of their reporting requirements under the BSA. Illicit activity involving CVC kiosks is
linked to fraud, certain types of cybercrime, and drug trafficking organization activity, which are
three of FinCEN’s Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT)
National Priorities.8
The information contained in this Notice is derived from FinCEN’s analysis of BSA data, open-
source reporting, and information from law enforcement partners.
How CVC Kiosks Work
Whereas a traditional ATM enables customers to withdraw or deposit cash from a bank account,
CVC kiosks enable customers to buy, and in some cases sell, CVC from a CVC wallet9 or
exchange.10 CVC kiosks generate revenue for their operator through the collection of fees and are
generally located in businesses with heavy foot traffic, long operating hours, and convenient access,
such as convenience stores, gas stations, cafes, and supermarkets.11
Purchasing CVC at a CVC kiosk may resemble using an ATM, which may appeal to a customer
who wishes to transact in CVC but lacks familiarity with blockchain technology. After providing
the CVC kiosk with identification, which can range from a phone number to a scan of a
government-issued ID, the customer enters the address of the CVC wallet that will receive the
purchased CVC. The address could be the customer’s own CVC wallet or that of a third party,12
and is normally embedded in a quick response (QR) code, which is a square barcode that can be
scanned and read with a smartphone or kiosk camera. Finally, the customer inserts cash or a debit
or credit card into the machine to finalize the purchase of CVC.
7. For example, according to the DEA, large volumes of illicit proceeds are laundered throughout Illinois, with Chicago
serving as the primary collection point for U.S. currency generated through illegal drug sales. With the presence of
CVC kiosks in the area growing rapidly (with approximately 1,626 in Illinois and 1,167 in Chicago alone), virtual
currency continues to be a popular and growing method used to launder illicit proceeds derived from drug sales.
Law enforcement reporting indicates that individuals are traveling from other states to Chicago to use these kiosks.
See DEA, “The Illegal Drug Threat to Illinois” (Sept. 2024), at pp. 2, 5.
8. FinCEN, “Anti-Money Laundering and Countering the Financing of Terrorism National Priorities” (June 30, 2021).
9. CVC wallets are interfaces housing the technical components required for storing and transferring CVC. There are
different wallet types that vary according to the technology employed, where and how the value is stored, and who
controls access to the value. See FinCEN, FIN-2019-G001, “Application of FinCEN’s Regulations to Certain Business
Models Involving Convertible Virtual Currencies” (“FinCEN 2019 CVC Guidance”), at pp. 15–17.
10. See Id. at p. 17. CVC kiosks most commonly support bitcoin transactions, but many also handle other CVCs such as
litecoin, ether, tether, and U.S. dollar coin (USDC). Federal Reserve Bank of Kansas City, “Payments System Research
Briefing: The Controversial Business of Cash-to-Crypto Bitcoin ATMs” (“Federal Reserve Report”) (Aug. 30, 2023), at p. 1.
11. See FTC Report, supra note 5.
12. Some operators may require that users certify that the destination wallet belongs to the user and not a third party,
which could discourage fraud. See New Jersey Commission of Investigation, “Bitcoin ATMs: Scams, Suspicious
Transactions and Questionable Practices at Cryptocurrency Kiosks” (Feb. 2021), at p. 9.
2
F I N C E N N O T I C E
CVC kiosks may connect directly to a separate CVC exchanger,13 which performs the CVC
transmission, or the kiosk may draw upon CVC held by its operator.14 The operator must maintain
sufficient CVC and cash balances to run the kiosk and may use accounts at CVC exchanges and
depository institutions for this purpose.15
Non-compliant CVC Kiosk Operators
CVC kiosk operators generally facilitate money transmission16 between a CVC exchanger and a
customer’s CVC wallet or operate as a CVC exchanger themselves and, as such, are considered
money services businesses (MSBs) under the BSA.17 CVC kiosk operators that meet their
obligations under the BSA play a key role in combating fraud and other illicit activity.
In some states, CVC kiosk operators may also be subject to state law designed to, among other
things, deter illicit activity and protect customers from fraud, including by imposing additional
requirements on businesses subject to those state laws.18 However, the rapid growth in the number
of CVC kiosks in the United States19 has coincided with substantial rates of non-compliance with
AML/CFT rules by CVC kiosk operators. For example, a 2021 report by the State of New Jersey
Commission of Investigation found that more than a third of the companies operating CVC
13. A CVC exchanger is a person or entity offering to exchange fiat currencies for virtual currencies or one virtual currency
for another virtual currency. Depending on the specifics of their business model, CVC exchangers may be subject to
obligations under the BSA. See FinCEN 2019 CVC Guidance, supra note 9, pp. 12–14; 31 CFR § 1010.100(ff)(8)(iii).
14. Under either formulation, CVC kiosk operators are subject to BSA obligations. See FinCEN 2019 CVC Guidance, supra
note 9, at pp. 17-18.
15. See Federal Reserve Report, supra note 10.
16. Money transmission involves the “acceptance of currency, funds, or other value that substitutes for currency and
the transmission of currency, funds, or other value that substitutes for currency to another location or person by any
means.” 31 CFR § 1010.100(ff)(5)(i)(A). Transmitting CVC (other value that substitutes for currency) may constitute
money transmission. See FinCEN 2019 CVC Guidance, supra note 9, at pp. 6-7.
17. As an MSB, any non-exempt person engaged in money transmission must register with FinCEN within 180 days of
starting to engage in money transmission. See 31 CFR § 1022.380. Money transmitters must also comply with the
recordkeeping, reporting, and transaction monitoring obligations set forth in parts 1010 and 1022 of 31 CFR chapter X.
Examples of such requirements include the filing of Currency Transaction Reports (31 CFR § 1022.310) and Suspicious
Activity Reports (31 CFR § 1022.320), as well as general recordkeeping obligations (31 CFR § 1010.410).
18. For example, California’s Digital Financial Assets Law, among other requirements, prohibits kiosk operators from
accepting or dispensing more than $1,000 in a day from or to a customer via a kiosk. See Cal. Fin. Code § 3902; see
also California Department of Financial Protection & Innovation, “Digital Financial Assets Law: Information for Kiosk
Operators.” CVC kiosk operators may also be subject to state laws and regulations that are not specific to CVC kiosk
operators. For example, on February 26, 2025, the Iowa Attorney General announced lawsuits against two CVC kiosk
operators for alleged failures that allowed Iowans to transfer millions of dollars to scammers through their kiosks
in violation of the Iowa Consumer Fraud Act. See Iowa Office of the Attorney General, “Attorney General Bird Sues
Crypto ATM Companies for Costing Iowans More than $20 Million” (Feb. 26, 2025).
19. The website Coin ATM Radar reports that the number of CVC kiosks in the United States increased from 4,128 on
January 1, 2019, to 37,342 on January 1, 2025. See Coin ATM Radar, “Bitcoin ATM Installations Growth” (last accessed
Feb. 27, 2025). The data on Coin ATM Radar are self-reported by operators and are not comprehensive, as some large
operators and perhaps many small kiosk operators do not report to the website. See Federal Reserve Report,
supra note 10.
3
F I N C E N N O T I C E
kiosks in the state did not register with FinCEN as MSBs.20 Some non-compliant kiosk operators
have been prosecuted for operating an unlicensed money transmitting business and other related
offenses.21 CVC kiosks operated by non-compliant operators are especially vulnerable to abuse by
scammers and other criminals. According to law enforcement, scammers have directed victims
to specific CVC kiosks, in some cases across state lines, likely to avoid CVC kiosk operators with
strong AML/CFT controls.
In some cases, a non-compliant operator may represent to other financial institutions that the
CVC kiosk business is registered with FinCEN—implying that it also complies with other BSA
requirements—while failing to implement an AML/CFT program or other BSA obligations, such
as collecting, retaining, and verifying customer identification.22 These non-compliant CVC kiosk
businesses also often lack reasonably designed policies, procedures, and internal controls to
respond to requests from law enforcement.23
In some instances, non-compliant CVC kiosk operators have provided financial institutions
with false information to acquire accounts or engaged in money laundering. For example, kiosk
operators have assisted in structuring transactions24 or falsely represented the nature of their
business to CVC exchanges and depository institutions at which they hold accounts. Some non-
compliant operators may use a personal account or accounts in the names of fake businesses or
other entities to make cash deposits and withdrawals.25 If asked about the purpose of transactions,
the operators may avoid answering or provide misleading answers to financial institutions.26
20. New Jersey Commission of Investigation, “Bitcoin ATMs: Scams, Suspicious Transactions and Questionable Practices
at Cryptocurrency Kiosks” (Feb. 2021), at p. 9.
21. See, e.g., U.S. Attorney’s Office (USAO), Central District of California, Press Release, “Westwood Man Agrees to Plead
Guilty to Federal Narcotics, Money Laundering Charges for Running Unlicensed Bitcoin Exchange and ATM” (Aug.
23, 2019); USAO, Eastern District of California, Press Release, “Bitcoin ATM Company Forfeited Over $1 Million for
Conspiring to Violate the Bank Secrecy Act” (Sept. 12, 2023).
22. MSBs are required to register with FinCEN as part of their obligations under the BSA, but that registration with
FinCEN and a company’s appearance on the FinCEN MSB Registrant Search Page is not a recommendation,
certification of legitimacy, or endorsement of the business by FinCEN or any other U.S. government agency. Further,
while MSBs must register with and are regulated by FinCEN, FinCEN does not license MSBs to operate in the United
States. Any claim that a registration with FinCEN is a recommendation, certification of legitimacy, or endorsement
by FinCEN of the business, or equates registration as a license to operate in the United States, is false and may be part
of a scam. See FinCEN, FIN-2024-Alert005, “FinCEN Alert on Fraud Schemes Abusing FinCEN’s Name, Insignia, and
Authorities for Financial Gain,” (Dec. 18, 2024). The FinCEN MSB Registrant Search Page contains entities that have
registered as MSBs pursuant to the BSA implementing regulations at 31 CFR § 1022.380. See FinCEN, MSB Registrant
Search.
23. See 31 CFR § 1022.210(d)(1)(i)(D).
24. Structuring transactions is prohibited by federal law and includes the practice of breaking a transaction into smaller
amounts to prevent a CTR from being filed or to evade reporting requirements. See 31 U.S.C. § 5324; 31 CFR §
1010.314.
25. See, e.g., USAO, District of New Hampshire, Press Release, “Three Plead Guilty to Wire Fraud In Connection with
Unlawful Virtual Currency Sales Business” (Apr. 18, 2022); see also FinCEN, FIN-2019-A003, “Advisory on Illicit
Activity Involving Convertible Virtual Currency” (May 9, 2019), at p. 7.
26. See, e.g., USAO, District of New Hampshire, Press Release, “Six Charged with Crimes Related to Virtual Currency
Exchange Business” (Mar. 16, 2021).
4
F I N C E N N O T I C E
Case Study:
Orange County Man Sentenced for Operating Illegal CVC Kiosk Network That
Laundered Millions of Dollars of Bitcoin and Cash for Criminals’ Benefit
On May 28, 2021, the U.S. Attorney’s Office for the Central District of California announced
that a court sentenced Kais Mohammad, a.k.a. “Superman29,” to 24 months in federal prison
for operating an illegal CVC MSB that exchanged up to $25 million—some of it on behalf of
criminals—through in-person transactions and a network of CVC kiosks. Mohammad pleaded
guilty in September 2020 to a three-count criminal information charging him with operating an
unlicensed money transmitting business, money laundering, and failing to maintain an effective
anti-money laundering program.
From December 2014 to November 2019, Mohammad owned and operated Herocoin. As part
of his business, Mohammad offered Bitcoin-to-cash exchange services, charging commissions of
up to 25 percent—significantly above the prevailing market rate.
During the time of Herocoin’s operation, Mohammad, a former bank employee who trained
others on compliance matters, intentionally failed to register his company with FinCEN.
Mohammad was aware that he was required to—but chose not to—develop and maintain an
effective anti-money laundering program, file currency transaction reports for exchanges of
currency in excess of $10,000, conduct due diligence on customers, and file suspicious activity
reports for transactions over $2,000 involving customers he knew, or had reason to suspect,
were involved in criminal activity.
With respect to his CVC kiosk network, Mohammad’s machines allowed customers to conduct
financial transactions without requiring any identification and permitted customers to conduct
multiple, consecutive transactions of up to $3,000 each without ever reporting suspicious
activity to regulators or law enforcement.
After FinCEN contacted Mohammad in July 2018 about his need to register his company,
Mohammad did so, but he continued to fail to comply fully with federal law concerning money
laundering, conducting due diligence, and reporting suspicious customers.27
Use of CVC Kiosks to Facilitate Scam Payments
The speed and difficulty of reversing CVC transactions28 makes CVC an attractive payment
mechanism for scammers. Once a victim makes the transfer with a CVC kiosk, the recipient (i.e., a
27. See U.S. Attorney’s Office, Central District of California, Press Release, “Yorba Linda Man Sentenced to 2 Years in
Prison for Operating Illegal ATM Network that Laundered Bitcoin and Cash for Criminals” (May 28, 2021).
28. Because most CVCs operate on permissionless blockchains (i.e. decentralized, digital ledgers anyone can use) to
record transactions, there often is no centralized authority who can easily reverse a transaction in the event of
fraud. See National Institute of Standards and Technology, “Blockchain Networks: Token Design and Management
Overview” (Feb. 2021).
5
F I N C E N N O T I C E
criminal actor associated with the scam) instantly owns the CVC, and often immediately transfers
the funds into another CVC wallet or exchange account they control. This generally differs from
traditional bank or wire transfers where a payment transaction can remain pending for one to two
days before settlement. The nature of CVC transactions can also make law enforcement’s recovery
of the funds difficult. Scammers often seek to persuade victims to withdraw money from their
traditional financial accounts, such as investment or retirement accounts, and use that money
to send a payment via CVC kiosk.29 CVC kiosks can have high transaction fees relative to other
means of transferring funds for senders and recipients, ranging from 7–20 percent, but scammers
are willing to accept these costs for the quick receipt of CVC from victims, according to BSA and
open-source information.30
CVC Kiosks and Elder Fraud
Criminals targeting older individuals are particularly likely to direct victims to use CVC kiosks
to send payments.31 According to FTC data, people aged 60 and over were more than three
times as likely as younger adults to report a loss using a CVC kiosk.32 More than two of every
three dollars reported lost to fraud using CVC kiosks was lost by an older adult.33 In addition,
according to law enforcement, CVC kiosks have increasingly facilitated elder fraud, especially
among tech/customer supports scams, government impersonation, confidence/romance scams,
emergency/person-in-need scams, and lottery/sweepstakes scams.34
Many scammers using CVC kiosks initiate contact with potential victims through unsolicited calls.35
For example, a scammer may claim to be the victim’s bank calling about an unauthorized charge or
pose as a government agency demanding taxes or fees. The most common scam typology associated
with CVC kiosks is tech and customer support scams, in which scammers impersonate well-known
companies as tech and customer support representatives to falsely claim that a virus or other
malware has compromised the victims’ computers and direct victims to make payments by CVC
29. See FBI, IC3, “The FBI Warns of Fraudulent Schemes Leveraging Cryptocurrency ATMs and QR Codes to Facilitate
Payment” (Nov. 4, 2021) (“FBI Crypto ATM PSA”).
30. FinCEN, “Elder Financial Exploitation: Threat Pattern & Trend Information, June 2022 to June 2023” (Apr. 2024), at p. 4.
See also Federal Reserve Report, supra note 10, at p. 3.
31. FBI, IC3, “2023 Elder Fraud Report” (2023), at p. 16.
32. See FTC Report, supra note 5.
33. In contrast, younger adults were more likely to report virtual currency fraud losses not involving CVC kiosks,
primarily those due to fake virtual currency investment opportunities. Ibid.
34. FBI, IC3, “2023 Elder Fraud Report” (2023), at p. 16. See also FinCEN, FIN-2022-A002, “Advisory on Elder Financial
Exploitation” (June 15, 2022); see also FBI, IC3, “FBI Warns of the Impersonation of Law Enforcement and Government
Officials” (Mar. 7, 2022); FBI, IC3, “Tech/Customer Support and Government Impersonation”; FBI, IC3, “Technical and
Customer Support Fraud” (Mar. 16, 2023).
35. According to FTC data, phone calls were the initial contact method in about 47 percent of reported fraud cases
involving CVC kiosks, followed by online ads or pop-ups (16 percent), and emails (9 percent). See FTC Report,
supra note 5. See also FinCEN, FIN-2023-Alert005, “FinCEN Alert on Prevalent Virtual Currency Investment Scam
Commonly Known as ‘Pig Butchering’” (Sept. 3, 2023).
6
F I N C E N N O T I C E
kiosk to address the issue.36 In such schemes, scammers may use online ads and emails to contact
victims, which typically contain a phone number to call for assistance leading to the scammer.37
Regardless of the type of fraudulent scheme, the criminals typically provide detailed instructions to
prospective victims, including how to (i) withdraw cash from their bank, (ii) locate a kiosk, and (iii)
deposit and send funds using the CVC kiosk, normally using a QR code provided by the scammer
to ensure the CVC is sent to the correct destination, i.e., a CVC wallet the scammer controls. After
providing the victim with the QR code, the scammer then directs the victim to a physical CVC kiosk
to purchase and send the scammer CVC, often staying in constant online or phone communication
with the victim and providing step-by-step instructions until the payment is completed.38
According to law enforcement sources, scammers may provide victims with instructions designed
to circumvent reporting thresholds,39 transaction limits, or other safeguards. For example, the
scammer may direct the victim to separate cash deposits into multiple, lower-value transactions,
which may constitute structuring. In some cases, the scammer may also direct the victim to split
the payment across multiple different CVC kiosks, a tactic known as “smurfing.”
Scammers also often attempt to extract repeated payments from the same victim. In some cases,
the scammers may also ask the victim to make payments through a new mechanism, such as
through wire transfers or by handing cash or gold to a courier.40
A scam operation may aggregate payments made by multiple victims into a single CVC wallet
before continuing to launder the proceeds. Scammers will also often quickly swap scam
proceeds into a stablecoin,41 most frequently through cross-chain bridges that claim to operate as
decentralized finance (DeFi) services.42 Illicit actors use this technique, known as “chain-hopping,”
to make it more difficult for authorities to trace financial transactions or for service providers to
detect if incoming funds are tied to illicit activity.43
36. Tech support scams represented 46 percent of crimes related to CVC kiosks that were reported to FBI IC3 in 2023.
See FBI, IC3, “2023 Cryptocurrency Fraud Report” (2023) at p. 16; see also FinCEN, FIN-2022-A002, “Advisory on Elder
Financial Exploitation” (June 15, 2022), at p. 7.
37. See FTC Report, supra note 5.
38. See FBI Crypto ATM PSA, supra note 29.
39. As MSBs, CVC kiosk operators are required to report suspicious activity involving any transaction or pattern of
transactions that involves or aggregates funds or other assets of at least $2,000. 31 CFR § 1022.320(a)(2). Some
transactions conducted through CVC kiosks may be subject to additional reporting requirements.
40. See, e.g., U.S. Attorney’s Office, District of Arizona, Press Release, “Participants in “Tech Support” Scheme Charged
with Conspiracy to Launder Fraudulent Proceeds” (Dec. 30, 2024); see also U.S. Attorney’s Office, Southern District
of California, Press Release, “Man Charged in $1.49 Million Scam Involving Bitcoin ATM Deposits and Bulk Gold
Purchases; Victim is Retiree who Lost Life Savings” (Apr. 18, 2024).
41. A stablecoin is a digital asset that aims to maintain a stable price (e.g., a 1:1 peg) compared to a reference asset, such as
the U.S. dollar. Eva Su, “Stablecoins: Background and Policy Issues,” Congressional Research Service (Nov. 10, 2021).
42. DeFi services are virtual asset protocols and services that purport to allow for some form of automated peer-to-peer
(P2P) transactions, often using self-executing code known as “smart contracts” based on blockchain technology.
Cross-chain bridges allow users to exchange virtual assets or information from one blockchain to another.
See Treasury, “Illicit Finance Risk Assessment of Decentralized Finance” (Apr. 2023), at pp. 3, 10.
43. Id., at p. 17. Despite these challenges, blockchain analytics can help financial institutions identify this particular
type of suspicious activity because blockchain analysis often connects scam payments made through CVC kiosks
at different times or by different victims. See FinCEN, FIN-2019-A003, “Advisory on Illicit Activity Involving
Convertible Virtual Currency” (May 9, 2019).
7
F I N C E N N O T I C E
Case Study:
Man Charged in $1.49 Million Scam Involving Bitcoin ATM Deposits and
Bulk Gold Purchases; Victim Is Retiree Who Lost Life Savings
On April 18, 2024, the U.S. Attorney’s Office for the Southern District of California announced
that a California man made his first appearance in federal court to face charges that he
participated in a multinational fraud conspiracy that targeted a 70-year-old retiree who was
tricked into handing over $1.335 million.
The victim was using her computer when a pop-up window appeared, advising her to call for
help because her computer had been hacked. When she made the call, she was transferred
through a series of co-conspirators pretending to work in tech support who told her to
download software on her computer. She was also told her personal identifying and bank
account information were compromised and was subsequently referred to co-conspirators
posing as employees from her financial institutions. The victim was then told she needed to
“secure” her assets. At the direction of someone posing as a bank employee, she deposited
approximately $55,700 into CVC kiosks located in North County San Diego.
The complaint further describes how once the scammers discovered the victim had substantial
savings, they convinced her she could safeguard her funds by obtaining gold bars and sending
them to the U.S. Treasury, which would create a locker under her name. In reality, the victim
was scammed out of her life savings.44
Red Flag Indicators of Illicit Activity Involving CVC Kiosks
FinCEN has identified the following red flag indicators to help detect, prevent, and report potential
suspicious activity related to illicit activity involving CVC kiosks. Because no single red flag
is determinative of illicit or other suspicious activity, financial institutions should consider the
surrounding facts and circumstances, such as a customer’s historical financial activity, whether
the transactions are in line with prevailing business practices, and whether the customer exhibits
multiple red flags before determining if a behavior or transaction is suspicious or otherwise
indicative of illicit activity.
Red Flags for Operators of CVC Kiosks Regarding Scam Payments
A customer sends multiple payments just below the suspicious activity reporting (SAR)
threshold,45 or other applicable threshold set by state law, from multiple kiosk locations.
44. U.S. Attorney’s Office, Southern District of California, Press Release, “Man Charged in $1.49 Million Scam Involving
Bitcoin ATM Deposits and Bulk Gold Purchases; Victim is Retiree who Lost Life Savings” (Apr. 18, 2024).
45. Money transmitters must report suspicious activity involving any transaction or pattern of transactions if it involves
or aggregates funds or other assets of at least $2,000. See 31 CFR § 1022.320(a)(2).
8
F I N C E N N O T I C E
A customer structures cash deposits just beneath the Currency Transaction Report (CTR)
threshold,46 or CVC kiosk daily limit, either by using multiple machines or multiple accounts
(i.e., smurfing).
A customer with limited or no transaction history makes a substantial deposit that is rapidly
transferred through multiple addresses, commingled with multiple other deposits, or
swapped into a different CVC.
Multiple customers use CVC kiosks in geographically disparate locations to make deposits to
the same CVC address over a short period of time while certifying that they are the owners of
the deposit address.
Multiple customer accounts or transactions are linked to the same phone number or CVC
wallet address.
Blockchain analysis indicates that a customer’s transaction is received by a CVC wallet that is
identified as associated with fraud or other illicit activity.
Blockchain analysis indicates that a customer’s transaction is received by a CVC wallet
associated with a financial institution that has been identified as associated with TCOs
perpetrating CVC investment scams.
Red Flags for Other Financial Institutions Regarding Use of CVC Kiosks for Scam Payments
A customer conducting an in-person banking transaction withdraws substantial amounts of
cash from their bank account or retirement account and indicates that they have been directed
by a person on the phone or internet to deposit the funds into a CVC kiosk.
An older customer with no history of CVC-related activity conducts a high-value transaction
or series of transactions with a CVC kiosk operator.
A customer uses a debit card to make multiple payments below the CTR limit to a CVC kiosk
operator.
Red Flags for Financial Institutions Identifying Potential Non-Compliant CVC Kiosk Owner-Operators
A customer operates a CVC kiosk business that is not registered with FinCEN as an MSB or
does not maintain applicable state licenses.
A customer operates a CVC kiosk business that fails to collect required customer and
transaction information.
A customer operates a CVC kiosk business that advertises the ability for customers to conduct
transactions without identification, or with only a phone number or email address.
46. A report of each deposit, withdrawal, exchange of currency, or other payment or transfer, by, through, or to a
financial institution that involves a transaction in currency of more than $10,000. Multiple transactions may be
aggregated when determining whether the reporting threshold has been met. See 31 CFR §§ 1010.310-313, 1020.310-
313, 1021.310-313, 1022.310-313, 1023.310-313, 1024.310-313, 1026.310-313.
9
F I N C E N N O T I C E
A customer operates a CVC kiosk business that charges unusually high transaction fees
relative to similarly situated operators, has opaque rates and fees, or has other business
practices that diverge significantly from those of legitimate CVC kiosk operators.
A customer that operates a CVC kiosk business structures cash transactions below the SAR or
CTR threshold.
Reminder of Relevant BSA Obligations and Tools for
U.S. Financial Institutions
Suspicious Activity Reporting
Other Relevant BSA Reporting
USA PATRIOT ACT Section 314(b) Information Sharing Authority
Suspicious Activity Reporting
A financial institution is required to file a SAR if it knows, suspects, or has reason to suspect a
transaction conducted or attempted by, at, or through the financial institution involves funds
derived from illegal activity; is intended or conducted to disguise funds derived from illegal
activity; is designed to evade regulations promulgated under the BSA; lacks a business or
apparent lawful purpose; or involves the use of the financial institution to facilitate criminal
activity.47 All statutorily defined financial institutions may voluntarily report suspicious
transactions under the existing suspicious activity reporting safe harbor.48
When a financial institution files a SAR, it is required to maintain a copy of the SAR and the
original or business record equivalent of any supporting documentation for a period of five
years from the date of filing the SAR.49 Financial institutions must provide any requested
SAR and all documentation supporting the filing of a SAR upon request by FinCEN or an
appropriate law enforcement or supervisory agency.50 When requested to provide supporting
documentation, financial institutions should take special care to verify that a requestor of
information is, in fact, a representative of FinCEN or an appropriate law enforcement or
supervisory agency. A financial institution should incorporate procedures for such verification
into its BSA compliance or AML program. These procedures may include, for example,
independent employment verification with the requestor’s field office or face-to-face review of
the requestor’s credentials.
47. See 31 CFR §§ 1020.320, 1021.320, 1022.320, 1023.320, 1024.320, 1025.320, 1026.320, 1029.320, 1030.320.
48. See 31 U.S.C. § 5318(g)(3). Financial institutions may report suspicious transactions regardless of amount involved
and still take advantage of the safe harbor.
49. See 31 CFR §§ 1020.320(d), 1021.320(d), 1022.320(c), 1023.320(d), 1024.320(c), 1025.320(d), 1026.320(d), 1029.320(d),
1030.320(d).
50. Id.; see FinCEN, FIN-2007-G003, “Suspicious Activity Report Supporting Documentation” (June 13, 2007).
10
F I N C E N N O T I C E
SAR Filing Instructions
SARs, and compliance with other BSA requirements, are crucial to identifying and stopping
illicit activity related to CVC kiosks. FinCEN requests that financial institutions indicate a
connection between the suspicious activity being reported and the activities highlighted in this
Notice by including the key term “FIN-2025-CVCKIOSK” in SAR field 2 (Filing Institution
Note to FinCEN), as well as in the narrative. Financial institutions may highlight additional
advisory or notice keywords in the narrative, if applicable. Financial institutions also should
select all other relevant suspicious activity fields, such as those in SAR Fields 36 (Money
Laundering) and 38 (Other Suspicious Activities), if applicable.
Financial institutions should include all available information relating to the account(s) and
location(s) involved in the reported activity, identifying information and descriptions of any
legal entities or arrangements involved and associated beneficial owners, and any information
about related persons or entities involved in the activity. Financial institutions also should
provide all available information regarding other domestic and foreign financial institutions
involved in the activity; where appropriate, financial institutions should consider filing a SAR
jointly on shared suspicious activity.51
Other Relevant BSA Reporting Requirements
Financial institutions and other entities or persons also may have other relevant BSA reporting
requirements to provide information in connection with the subject of this Notice. These
include obligations related to the Currency Transaction Report (CTR),52 Report of Cash
Payments Over $10,000 Received in a Trade or Business (Form 8300),53 Report of Foreign
Bank and Financial Accounts (FBAR),54 Report of International Transportation of Currency
or Monetary Instruments (CMIR),55 Registration of Money Services Business (RMSB),56 and
Designation of Exempt Person (DOEP).57
51. See 31 CFR §§ 1020.320(e)(1)(ii)(A)(2))(i), 1021.320(e)(1)(ii)(A)(2)), 1022.320(d)(1)(ii)(A)(2), 1023.320(e)(1)(ii)(A)(2)(i),
1024.320(d)(1)(ii)(A)(2), 1025.320(e)(1)(ii)(A)(2), 1026.320(e)(1)(ii)(A)(2)(i), 1029.320(d)(1)(ii)(A)(2), 1030.320(d)(1)(ii)(A)(2).
52. A report of each deposit, withdrawal, exchange of currency, or other payment or transfer, by, through, or to a
financial institution that involves a transaction in currency of more than $10,000. Multiple transactions may be
aggregated when determining whether the reporting threshold has been met. See 31 CFR §§ 1010.310-313, 1020.310-
313, 1021.310-313, 1022.310-313, 1023.310-313, 1024.310-313, 1026.310-313.
53. A report filed by a trade or business that receives currency in excess of $10,000 in one transaction or two or more
related transactions. The transactions are required to be reported on a joint FinCEN/Internal Revenue Service form
when not otherwise required to be reported on a CTR. See 31 CFR §§ 1010.330, 1010.331. A Form 8300 also may be
filed voluntarily for any suspicious transaction, even if the total amount does not exceed $10,000.
54. A report filed by a U.S. person that has a financial interest in, or signature or other authority over, foreign financial
accounts with an aggregate value exceeding $10,000 at any time during the calendar year. See 31 CFR § 1010.350;
FinCEN Form 114.
55. A form filed to report the transportation of more than $10,000 in currency or other monetary instruments into or out
of the United States. See 31 CFR § 1010.340.
56. A form filed to register a money services business (MSB) with FinCEN, or to renew such a registration.
See 31 CFR § 1022.380.
57. A report filed by banks to exempt certain customers from currency transaction reporting requirements.
See 31 CFR § 1010.311.
11
F I N C E N N O T I C E
Information Sharing
Information sharing among financial institutions is critical to identifying, reporting, and
preventing identity theft and fraud schemes or other illicit financial activity. Financial
institutions and associations of financial institutions sharing information under the safe harbor
authorized by section 314(b) of the USA PATRIOT Act are reminded that they may share
information with one another regarding individuals, entities, organizations, and countries
suspected of possible terrorist financing or money laundering.58 FinCEN strongly encourages
such voluntary information sharing.
The Financial Crimes Enforcement Network’s Advisory Program
communicates priority money laundering, terrorist financing, and other
illicit finance threats and vulnerabilities to the U.S. financial system.
Financial institutions may use this information to support effective, risk-
based, and reasonably designed anti-money laundering and countering
the financing of terrorism (AML/CFT) programs and suspicious activity
monitoring systems to help generate highly useful information for law
enforcement and national security agencies.
For Further Information
FinCEN’s website at www.fincen.gov contains information on how to register for FinCEN Updates.
Questions or comments regarding the contents of this Notice should be addressed to the FinCEN
Regulatory Support Section by submitting an inquiry at www.fincen.gov/contact.
The mission of the Financial Crimes Enforcement Network is to safeguard
the financial system from illicit use, combat money laundering and its
related crimes including terrorism, and promote national security through
the strategic use of financial authorities and the collection, analysis, and
dissemination of financial intelligence.
58. See FinCEN, “Section 314(b) Fact Sheet” (Dec. 2020).
12