US: KYC and AML rules for a business that sells Bitcoin to the public

Research, not legal or financial advice. This file explains what the rules say and how they have been enforced. It is not a compliance program and not advice on whether or how to start a business. A real seller needs a lawyer in each state where it will operate.

• Jurisdiction: United States: federal law, plus New York, Nevada and the states with crypto-ATM ("kiosk") laws
• Covers: online exchanges, walk-in shops and teller windows, and crypto ATMs/kiosks that sell bitcoin for cash or card
• Date checked: 2026-10-09. Each item gives its own date. "(unverified)" means it was not confirmed against a primary source.
• Saved sources: sources/kyc-aml/ (see sources/kyc-aml/INDEX.md). Related files: legislation/us-state-ny.md, legislation/us-federal-fincen-wallet-registration.md, market/2026-10-09-walk-in-bitcoin-shops.md, market/2026-10-09-banking.md (banking access, written by another researcher).

Bottom line

A business that takes cash, card or bank money from the public and sends bitcoin to a customer's wallet, or the reverse, is a money transmitter under federal law. It does not matter whether it trades online, at a counter, through a kiosk, or at a coffee-shop table. As of 2026-10-09 it must:

1. Register with FinCEN as a money services business (MSB) on FinCEN Form 107 within 180 days of starting, and renew every two years.
2. Keep a written, risk-based AML program: policies and controls (including verifying customer identity), a named compliance officer, staff training, and an independent review.
3. File Currency Transaction Reports (cash over $10,000 in a business day) and Suspicious Activity Reports (suspicious transactions of $2,000 or more), keep records for five years, follow the $3,000 funds-transfer recordkeeping and Travel Rule, and screen customers against OFAC sanctions lists.
4. Hold a state money-transmitter licence, or a crypto-specific licence, in every state where it serves customers, with surety bonds and net-worth minimums. In New York that means the BitLicense (23 NYCRR Part 200). In Nevada it means an NRS Chapter 671 money-transmission licence, which the Nevada Financial Institutions Division enforces against bitcoin-kiosk operators.
5. For kiosks, obey the state kiosk statutes: daily caps, fee caps, scam warnings and refunds. Four states have enacted outright kiosk bans or a ban on cash deposits into kiosks: Indiana, Tennessee, Minnesota and Hawaii.

People prosecuted for selling bitcoin for cash without these steps were charged under 18 U.S.C. § 1960 (unlicensed money transmitting business). Most were also charged with money laundering, because they took undercover agents' "drug money", and some with failing to keep an AML program. Two federal appeals courts upheld such convictions: the First Circuit in 2025 (Freeman, New Hampshire) and the Second Circuit in 2026 (Goklu, cash-for-bitcoin meetings in Manhattan).

1. Who is covered: a "money transmitter"

• Definition. A money transmitter is a person that accepts "currency, funds, or other value that substitutes for currency" from one person and transmits it to another location or person by any means. 31 CFR 1010.100(ff)(5) (eCFR, current as of 2026-10-07; saved ecfr-31-CFR-1010.100.txt).
• Virtual currency. FinCEN guidance FIN-2013-G001 (2013-03-18) and FIN-2019-G001 (2019-05-09) say that an exchanger that sells convertible virtual currency (CVC) for real currency, or buys it, is a money transmitter. The 2019 guidance says these firms must "register with FinCEN as an MSB and comply with AML program, recordkeeping, monitoring, and reporting requirements (including the filing of SARs and CTRs)." (saved 2019-05-09-FinCEN-FIN-2019-G001-CVC-guidance.txt; the 2013 guidance is in sources/fincen/.)
• Peer-to-peer (P2P) sellers. FIN-2019-G001 § 4.1 covers people who sell bitcoin through classified ads, websites or in person. A natural person "operating as a P2P exchanger that engages in money transmission services … must comply with BSA regulations as a money transmitter acting as principal … regardless of the regularity or formality of such transactions." The only exemption is activity "on an infrequent basis and not for profit or gain."
• Kiosks. FIN-2019-G001 § 4.3: the owner-operator of a CVC kiosk "qualifies as a money transmitter both for transactions receiving and dispensing real currency or CVC." Unlike a bank-linked cash ATM, it gets no exemption. FinCEN repeated this in Notice FIN-2025-NTC1 (2025-08-04).
• Agents. A business that is an MSB only because it acts as an agent of another MSB does not register separately (31 CFR 1022.380(a)(3)). It must still carry out the AML program, which agent and principal may divide between them by contract (1022.210(d)(1)(iii)). New York does not allow this route for virtual currency. See § 12.

2. FinCEN registration: Form 107

Source: 31 CFR 1022.380 (saved ecfr-31-CFR-part-1022-MSBs.txt); FinCEN "MSB Registration" page (retrieved 2026-10-09, saved FinCEN-MSB-registration-page.txt); 31 U.S.C. 5330 (saved usc-31-5330.txt).

FinCEN registration is not a licence. FinCEN does not vet the applicant. State licensing (§ 9) is separate and usually harder.

3. The written AML program and the compliance officer

Source: 31 CFR 1022.210 (eCFR current 2026-10-07).

• The program must be "reasonably designed to prevent the money services business from being used to facilitate money laundering and the financing of terrorist activities". It must be "commensurate with the risks posed by the location and size of, and the nature and volume of the financial services provided".
• It must be in writing and available to Treasury on request.
• Minimum elements (1022.210(d)): 1. Policies, procedures and internal controls covering: verifying customer identification; filing reports; creating and keeping records; responding to law-enforcement requests. Automated systems "should" have compliance built in. 2. A designated compliance person who makes sure reports and records are done, keeps the program current, and makes sure staff are trained. 3. Training of appropriate staff, including how to detect suspicious transactions. 4. Independent review, with scope and frequency matched to risk. An employee may do it, but not the compliance officer.
• Deadline: in place within 90 days of the business being established (1022.210(e)).
• Pending change. On 2026-04-10 FinCEN proposed a rule to "fundamentally reform" AML/CFT program rules for all financial institutions, MSBs included (91 FR 18704, FR Doc 2026-07033; comments closed 2026-06-09; saved). No final rule had been published as of 2026-10-09; a Federal Register API check showed none.
• Enforcement examples of program failures: the FinCEN penalty against Eric Powers (2019-04-18), a P2P seller with no written policies; the Herocoin, Kalra and Paxful pleas to failing to maintain an effective AML program (§ 15).

4. Customer identification and verification (KYC)

• There is no stand-alone "CIP rule" for MSBs. Banks, broker-dealers and some others have formal Customer Identification Program rules; MSBs do not. Identity duties for an MSB come from (a) the AML program, which must include "verifying customer identification" (1022.210(d)(1)(i)(A)), and (b) specific triggers in the rules. (This is our reading of 31 CFR Chapter X. The 2016 beneficial-ownership "CDD rule", 31 CFR 1010.230, applies to "covered financial institutions", which do not include MSBs.)
• Federal triggers that require ID:
• Cash over $10,000 (CTR). Before completing the transaction, verify and record the name and address of the person presenting it, and record the identity, account number and SSN/TIN of anyone it is made for. Verification is by examining a document. Non-residents use a passport, alien ID card or similar (31 CFR 1010.312).
• Transmittals of $3,000 or more (funds-transfer rule). For a customer who is not established, verify identity in person and record name, address, ID type and number, and TIN, or passport number and country, or note that none was given. A transfer not made in person needs name, address, TIN and a record of the payment method (31 CFR 1010.410(e)(2), (e)(5)). FinCEN says CVC transfers are "transmittals of funds" (FIN-2019-G001 § 2).
• What enforcement treats as a failure: kiosks that need no ID. Herocoin's machines "allowed customers to conduct financial transactions without requiring any identification and permitted customers to conduct multiple, consecutive transactions of up to $3,000 each without ever reporting suspicious activity" (ICE release, 2021-05-28). In Freeman, the First Circuit described kiosks that "did not require any form of personal verification" (2025-07-29).
• States go further. New York requires a customer identification program for every account or service relationship, an OFAC check, and verified ID for any transaction over $3,000 (23 NYCRR 200.15(h)). Some kiosk laws require ID on every kiosk purchase. Wisconsin's 2026 law has a "consumer identification requirement" (Wisconsin Watch, 2026-09-28).

5. Currency Transaction Reports (cash over $10,000)

• Rule: report each "deposit, withdrawal, exchange of currency or other payment or transfer … which involves a transaction in currency of more than $10,000" (31 CFR 1010.311; MSBs via 1022.311).
• Aggregation: several cash transactions count as one if the business "has knowledge that they are by or on behalf of any person and result in either cash in or cash out totaling more than $10,000 during any one business day" (1010.313(b)).
• Deadline: within 15 days after the transaction (1010.306(a)(1)). ID must be verified first (1010.312).
• "Currency" means government cash. Bitcoin-for-bitcoin trades and card or bank payments are not CTR events. New York partly fills that gap: it requires BitLicensees to report virtual-currency-to-virtual-currency transactions over $10,000 in one day by one person to NYDFS within 24 hours (23 NYCRR 200.15(e)(2)).
• Lower CTR thresholds by order. FinCEN Geographic Targeting Orders have required certain MSBs in listed Texas and New Mexico ZIP codes to report cash transactions of $1,000 to $10,000 (latest renewal 91 FR 56776, 2026-09-04, effective 2026-09-03 for 180 days; saved). These orders do not cover New York or Nevada.
• Cases: Eric Powers made about 150 in-person cash trades of more than $10,000 each and filed no CTRs (FinCEN, 2019-04-18). An undercover agent made three back-to-back purchases totalling $14,500 at a Herocoin kiosk on 2018-09-12, and no CTR was filed (ICE, 2020-07-22).

6. Suspicious Activity Reports

Source: 31 CFR 1022.320.

• Threshold: a transaction "conducted or attempted by, at, or through" the MSB involving $2,000 or more, where the MSB "knows, suspects, or has reason to suspect" any of the following: illegal funds; a design to evade BSA rules (including structuring); no apparent lawful purpose; or use of the MSB to facilitate crime.
• Deadline: 30 calendar days after first detecting the facts. For urgent cases, such as ongoing laundering, also phone law enforcement immediately.
• Keep a copy and the supporting documents for 5 years. SARs are confidential: the business must not tell the customer one was filed, and there is a safe harbor from liability for filing.
• Kiosk red flags. FinCEN Notice FIN-2025-NTC1 (2025-08-04) asks filers to put "FIN-2025-CVCKIOSK" in SAR field 2 and the narrative for kiosk-linked scams and laundering. It reports that the FBI's IC3 received 10,956 kiosk complaints in 2024 with about $246.7 million in losses, up 99% in complaints and 31% in losses from 2023. It cites drug-cartel use of kiosks in place of bulk cash smuggling.

7. Recordkeeping

8. The Travel Rule (31 CFR 1010.410(f)): $3,000

• A transmittor's financial institution must include in a transmittal order of $3,000 or more the following: the transmittor's name and account number, if any; the transmittor's address; the amount; the execution date; the recipient's financial institution; whatever recipient details it received; and its own name or identifier. An intermediary institution must pass those details along (1010.410(f)(1)–(2)).
• Bitcoin is covered. FIN-2019-G001 says a CVC transmittal is an instruction to pay "a determinable amount of money", so CVC transfers "may fall within the Funds Travel Rule". The information may travel "in a message different from the transmittal order itself" when the blockchain cannot carry it.
• Typical walk-in sale (our reading, not FinCEN text). A customer hands over cash and asks for bitcoin to be sent to the customer's own self-hosted wallet. There is no receiving financial institution to pass data to, so the information-passing duty in (f) has nowhere to go. The recordkeeping duty in (e) still applies at $3,000 or more, including ID for a walk-in customer who is not established. When the coins go to another exchange (a "hosted" wallet), the full Travel Rule applies.
• Unhosted-wallet rule withdrawn. FinCEN's December 2020 proposal would have required reports and records for CVC transfers to self-hosted wallets. It was withdrawn on 2026-10-06 (FR Doc 2026-20430). See legislation/us-federal-fincen-wallet-registration.md.
• In 2020 FinCEN and the Federal Reserve also proposed lowering the cross-border threshold to $250. It has not been finalized (unverified; no final rule was found in the Federal Register search done for this file).

9. OFAC sanctions screening

Sources: 31 CFR 501.601, 501.603, 501.604 (saved); OFAC, Sanctions Compliance Guidance for the Virtual Currency Industry (October 2021; saved).

• OFAC liability is strict liability: a business can be penalized even if it did not know it dealt with a sanctioned person (OFAC guidance, p. 6).
• Screen customers, and the wallet addresses on OFAC's list, against the SDN list and other sanctions lists. Block sanctioned property. Report blocked property within 10 business days (501.603) and rejected transactions within 10 business days (501.604). Keep records 10 years (501.601).
• For online sellers, the OFAC guidance recommends geolocation and IP blocking of sanctioned jurisdictions and checks for VPN use. It describes a case where a firm logged users' IP addresses, did not use them, and so missed users in Crimea.
• For walk-in sellers: screen the customer's name before completing the sale. A sanctioned wallet address in the destination field is a stop. NY BitLicensees must check every new customer against the SDN list (200.15(h)(1)) and keep OFAC policies (200.15(i)).

10. Structuring

• Crime for the customer, and for anyone who helps. It is illegal to break up cash transactions to avoid a CTR, or to cause a business not to file or to file falsely (31 U.S.C. 5324, saved; 31 CFR 1010.314). The penalty is up to 5 years, or up to 10 years in aggravated cases (combined with another federal crime, or part of a pattern of more than $100,000 in 12 months).
• The seller's duty: suspected structuring is a SAR trigger (1022.320(a)(2)(ii)). NY BitLicensees may not structure or help structure (200.15(f)). Kiosk networks that allow repeated $2,999 or $3,000 purchases are a classic finding (see Herocoin, § 15).

11. Criminal exposure and the 2025 DOJ policy

• 18 U.S.C. § 1960 (up to 5 years) makes it a crime to run an "unlicensed money transmitting business" that: (A) has no required state licence where operating without one is a state misdemeanor or felony, "whether or not the defendant knew" a licence was needed; (B) fails to register with FinCEN; or (C) moves funds the defendant knows came from crime or are meant for crime.
• Is bitcoin-for-cash "transmitting"? In United States v. Goklu, No. 24-767 (2d Cir. 2026-04-07), the court held that "Goklu's exchanges of bitcoin for cash constituted 'money transmitting'". Goklu advertised on LocalBitcoins and met DEA agents in Manhattan to swap about $130,000 of bitcoin for cash at an 8% commission. He was convicted under § 1956 and § 1960 and sentenced to 16 months. In United States v. Freeman, No. 23-1839 (1st Cir. 2025-07-29), the court affirmed § 1960, money-laundering and tax convictions for a New Hampshire seller who used bitcoin kiosks, LocalBitcoins and Telegram, and rejected his "major questions doctrine" defense.
• Contested at the state level: State v. Espinoza, No. 3D16-1860 (Fla. 3d DCA 2019-01-30). A Miami trial judge dismissed charges in July 2016 against a LocalBitcoins seller, holding that bitcoin is not "money". The appeals court reversed: "even a person in the business of selling his own Bitcoin for cash" is a money transmitter under Florida law. (Summary from an Orrick law-firm note; the opinion itself was not fetched because Justia blocked automated requests.)
• DOJ charging policy since 2025-04-07. Deputy Attorney General Todd Blanche's memo "Ending Regulation by Prosecution" (saved) tells prosecutors not to charge "regulatory violations in cases involving digital assets — including but not limited to unlicensed money transmitting under 18 U.S.C. § 1960(b)(1)(A) and (B), violations of the Bank Secrecy Act … unless there is evidence that the defendant knew of the licensing or registration requirement at issue and violated such a requirement willfully." Footnote 2 says § 1960(b)(1)(C), which covers known criminal proceeds, "is therefore outside the scope of this policy". The memo is a discretionary policy, not law: it does not bind states or a future administration, and civil FinCEN and state enforcement continue (see §§ 13–15). Most criminal cases in § 15 involved real or undercover-represented criminal proceeds, which the memo leaves chargeable.

12. New York: the BitLicense, and what a walk-in seller in NYC would need

Primary text: 23 NYCRR Part 200 (adopted 2015-06-24; text via Cornell LII from the official NYCRR, retrieved 2026-10-09; saved 23-NYCRR-Part-200-BitLicense-via-LII.txt). NYDFS's own site blocked automated requests (Cloudflare challenge). Broader NY context, including enforcement and bills, is in legislation/us-state-ny.md.

Who needs a BitLicense. Anyone engaged in "Virtual Currency Business Activity" involving New York or a New York resident (200.2(q)). That covers: (1) receiving virtual currency for transmission or transmitting it; (2) holding custody for others; (3) "buying and selling Virtual Currency as a customer business"; (4) exchange services; and (5) controlling or issuing a virtual currency. A "New York Resident" includes any person "located" or "conducting business" in New York (200.2(h)).

Key requirements:

Other NY licences and bonds. Transmitting dollars is also governed by NY Banking Law Article 13-B. Section 641 requires a licence to engage "in the business of receiving money for transmission" (nysenate.gov, last updated 2014-09-22). Section 643 requires a surety bond or securities of at least $500,000, and $750,000 for travelers' checks (nysenate.gov, read 2026-10-09). A limited purpose trust charter is the alternative route used by large firms (legislation/us-state-ny.md). NY's money-transmitter net-worth minimum was not found in § 641 (gap; set by NYDFS rule, unverified).

What a walk-in bitcoin seller in New York City would need (our synthesis of the sources above):

1. A New York entity or a foreign qualification, plus normal NYC business registration. NYC-specific licensing was not researched (gap).
2. FinCEN MSB registration (Form 107) and a full federal AML program (§§ 2–10).
3. A BitLicense, or a NY trust charter. Being an "agent" of a licensed exchange does not work in New York because of 200.3(b). A shop that sold bitcoin "on behalf of" Coinbase or Bitcoin Depot without its own licence would itself be unlicensed. If it also moves customers' dollars, it may need a § 641 money-transmitter licence and a $500,000+ bond.
4. Cash-handling compliance: CTRs over $10,000/day, SARs, ID over $3,000 under NY rules, the NY daily VC-to-VC report, and 7-year records.
5. Watch two bills: - S 9891-B (Sen. Sanders) passed the Senate 59–2 on 2026-06-03 and sits in the Assembly Codes Committee. It would regulate kiosks and "cashier crypto exchanges", that is, teller windows: NYDFS licence; $1,000/day and $10,000/month per consumer; fees no more than the greater of $5 or 3%; a 72-hour hold when a consumer exceeds $1,500 in 72 hours, with a right to cancel and a refund within 7 business days; full refunds of fraud-induced transactions within 72 hours of documentation; a "STOP THIS TRANSACTION IMMEDIATELY" scam warning; and cashiers may send coins only to a wallet the consumer owns or controls (nysenate.gov, read 2026-10-09). - S 8901 (Sen. Myrie with Manhattan DA Alvin Bragg, "CRYPTO Act") would make operating an unlicensed virtual-currency business a crime, from a misdemeanor up to a class C felony, by adding Financial Services Law § 408-b. It was referred to the Banks Committee 2026-01-14; the Assembly companion is A 10246 (nysenate.gov, read 2026-10-09).

13. Nevada: money-transmitter licensing and kiosks

Primary sources saved: NRS Chapter 671 (revised 2026-04-15, includes 2025 amendments), NAC Chapter 671, AB 21 (2023), which brought in the Money Transmission Modernization Act model, the Nevada FID money-transmitter page, and five FID enforcement orders against kiosk operators.

• Licence required, "including … at a kiosk". NRS 671.040: no person may "engage in the business of money transmission or advertise, solicit or hold himself … out as providing money transmission" without a licence or acting as an authorized delegate of a licensee, "regardless of the location or method … including, without limitation, at a kiosk, through the Internet".
• Does bitcoin count? NRS 671 never uses the words "virtual currency" or "cryptocurrency"; a full-text search of the saved NRS and NAC files on 2026-10-09 found none. Money transmission includes "receiving money or credits for transmission" (NRS 671.013). "Monetary value" means "a medium of exchange, whether or not redeemable in money" (NRS 671.011). The FID's 2019-08-19 statement on cryptocurrency says a licence "may have been required" depending on the business model, decided case by case (see legislation/us-state-nv.md). In practice the FID treats bitcoin kiosks as money transmission:
• Athena Bitcoin, Inc. Administrative complaint 2025-04-17, consent order 2025-05-15. Athena's website listed "several bitcoin kiosk locations in the state of Nevada" while its licence application was pending. The FID treated this as unlicensed activity under NRS 671.040; Athena stopped operating the kiosks on 2024-04-26 and paid a $10,000 fine (NRS 671.485).
• Bitcoin Depot Operating LLC, Nevada licence MT11129 since about 2021-04-14. Complaint 2026-01-20, consent order 2026-03-11: $10,000 fine for not filing 2023 audited financial statements.
• Knack Kiosk LLC. Consent order 2026-02-02: licence lapsed while one of three kiosks kept taking transactions; $500 fine.
• Licence economics (NRS 671, as amended 2023 and 2025):
• Surety bond: the greater of $100,000 or 100% of average daily money-transmission liability in Nevada, capped at $500,000 (NRS 671.100).
• Tangible net worth: the greater of $100,000 or 3% of total assets up to $100 million, plus 2% from $100 million to $1 billion, plus 0.5% above that (NRS 671.115).
• Application: filed via NMLS with audited financial statements. Fees: a non-refundable application fee of up to $500, a licence fee of $200–$400, plus investigation costs (NRS 671.050).
• Renewal: licences expire 31 December; the renewal window is 1 November–31 December. Audited financial statements are due within 90 days of fiscal year-end (FID page, retrieved 2026-10-09). NAC 671.030 still lists a $300 renewal fee.
• BSA tie-in: licensees and authorized delegates must file all federal CTR, SAR and recordkeeping reports (NRS 671.295).
• Penalties: an administrative fine of up to $10,000 per violation (NRS 671.485); operating unlicensed is a misdemeanor, with each day a separate offense (NRS 671.495).
• No Nevada kiosk statute. As of 2026-04-03, Nevada had passed no kiosk-specific law; "some operators are licensed as money transmitters". There were 447 bitcoin kiosks, 336 of them in Southern Nevada (Nevada Current via Yahoo/Route Fifty). AARP asked for daily limits, scam warnings, refunds and fee caps. The Attorney General issued a kiosk-scam warning on 2026-06-05 (Fox5 Vegas). The Legislature next meets in regular session in February 2027 (general knowledge: Nevada sessions are in odd years; not checked).
• Federal law still applies to every Nevada seller in full (§§ 2–10). A walk-in shop in Las Vegas needs FinCEN registration, an AML program, CTRs and SARs, and either its own NRS 671 licence or a written authorized delegate contract with a licensee (NRS 671.040(1)(b), 671.205). Unlike New York, Nevada allows the delegate route. A business that transmits "on behalf of a person not licensed" is jointly liable (NRS 671.215, quoted in the Athena complaint).

14. Crypto ATM / kiosk laws in key states (status 2026-10-09)

AARP counted about 25 states with "some protective action" and 18 with comprehensive laws (AARP article on Indiana, 2026). Another report said "only eight states and Washington, D.C. have not enacted any legislation" (Yahoo, 2026-04-29). These counts conflict and are unverified. The table lists states with a primary source or a dated news source.

Enforcement against kiosk operators (selected):

• Coinme, which runs the Bitcoin machines inside Coinstar kiosks. Consent order 2026-10-07 with Georgia plus 31 other states, D.C. and Puerto Rico: Coinme must stop all kiosk operations in Georgia before 2027-01-01, hire an independent BSA/AML consultant, and pay $2.5 million shared among 34 agencies (Georgia DBF release, 2026-10-08; saved). Washington DFI had earlier issued a temporary cease-and-desist on 2025-12-01 over expired-voucher funds taken as revenue and net-worth shortfalls, and ordering it to repay more than $8 million to customers (Yahoo Finance, news).
• CoinFlip. Washington DFI statement of charges 2026-09-03: revocation sought plus a $1,029,600 fine for not enforcing its own limits and not paying refunds. Missouri AG suit 2026-05-20. Iowa AG suits against CoinFlip and Bitcoin Depot 2025-02-26. All saved in sources/exchanges/.
• Athena Bitcoin. D.C. Attorney General suit 2025-09-08 (sources/exchanges/); Nevada FID fine 2025 (§ 13).
• Bitcoin Depot filed Chapter 11 on 2026-05-18 (S.D. Tex.). Its CEO cited state transaction limits, bans and litigation, and its 9,000+ machines went offline (ATM Marketplace, news). See the market file.

15. Prosecutions of unlicensed walk-in, P2P and cash-for-bitcoin sellers

These are summarized in more detail in market/2026-10-09-walk-in-bitcoin-shops.md. Charges, in brief:

No Nevada walk-in-seller prosecution was found in the sources searched (gap).

Gaps and open questions

• NYDFS pages (Cloudflare), California leginfo and DFPI, Justia, CoinATMRadar, DEA and most justice.gov press-release pages blocked automated fetching. Items from those sources are marked as news or unverified.
• California § 3902 text and NY Banking Law § 641 net-worth rules were not saved. (Indiana HB 1116's enrolled text and Hawaii's Act 224 are saved under sources/states/in/ and sources/states/hi/; completeness check.)
• Status of the federal Crypto ATM Fraud Prevention Act in 2026 was not confirmed.
• (Resolved by the completeness check.) Nevada did join the 2026-10-07 Coinme multistate order: Appendix A of the order lists it, and Appendix B gives its penalty share as $15,297.13 (order).

Spark run on this topic (pointer added by the completeness check, 2026-10-09)

The local Spark run 20261009-144154--what-kyc-and-aml-rules-apply-in-the-us-to-a-business-selling finished on 2026-10-09. Its findings are not merged into this note yet. Its CONTESTED and UNDOCUMENTED answers, the claims its verifier rejected or found only partly supported, the facts it dropped, and the pages it refused or skipped are all listed and flagged in RESEARCH-STATUS-2026-10-09.md § 6, as the editor asked (include everything the Spark rejects, labelled). All eight of its sub-answers were CONFIDENT. Two fincen.gov pages were refused (robots.txt unreachable), and NAC 671 was skipped as low relevance, though it is saved here.