Bitcoin exchanges, peer-to-peer venues and Bitcoin ATMs: KYC, licensing, enforcement

Researched and written 2026-10-09. Research only, not advice: nothing here says to use or avoid any venue, or when to buy or sell.

How to read this file

• Every claim has a source tag such as [G7]. The numbered list is in §6 Sources. A G tag is a government or court document. Most of these are saved in full in sources/exchanges/, listed in sources/exchanges/INDEX.md.
• (unverified) marks something I could not confirm against a primary source on 2026-10-09. (headline only) means I saw only a search-result title, not the article. (single source) means only one secondary outlet reported it.
• "Checked 2026-10-09" means I read the licence or availability statement on that date.
• Licensing terms:
• FinCEN MSB: federal registration as a money services business. FinCEN itself says registration "is not a recommendation, certification of legitimacy, or endorsement" and that FinCEN "does not license MSBs" [G18 n.22].
• MTL: a state money transmitter licence.
• BitLicense: New York's virtual currency licence, 23 NYCRR Part 200.
• NY trust: a New York limited-purpose trust charter.

0. At a glance

0.1 Centralized exchanges

0.2 Peer-to-peer and no-KYC venues

0.3 Bitcoin ATM operators

1. The rules that decide who must do KYC

1. Federal, FinCEN. A business that exchanges bitcoin for money for other people is a money transmitter, and therefore an MSB. It must: - register with FinCEN; - run an AML program with "policies, procedures, and internal controls for verifying customer identification"; - file suspicious activity reports (SARs); - file currency transaction reports (CTRs) above $10,000 in cash; - keep records.

Sources: [G1 §AML program, citing 31 CFR 1022.210(d)(1)(i)(A)]; [R6a FIN-2019-G001 §4.1]. The detailed thresholds (CTR >$10,000; funds-transfer recordkeeping at $3,000) are in the eCFR copies another researcher saved under sources/kyc-aml/. 2. Individuals. A natural person who trades bitcoin "as a business" (a P2P exchanger) is also a money transmitter. This applies "regardless of the regularity or formality of such transactions". Someone trading "on an infrequent basis and not for profit or gain" is exempt [R6a §4.1]. - FinCEN's first penalty against a P2P exchanger was Eric Powers in 2019: a $35,000 fine and an industry bar, partly for never filing a CTR on 150 cash buys of more than $10,000 [R6c]. 3. Platforms that only match buyers and sellers are not money transmitters. This applies when the platform "only provides a forum where buyers and sellers … post their bids and offers" and "the parties themselves settle any matched transactions through an outside venue (either through individual wallets or other wallets not hosted by the trading platform)" [R6a §5.1]. - Likewise, a multisig provider that holds one key, but lacks "total independent control over the value", is not a money transmitter [R6a §4.2.2]. - This is the main US federal basis on which non-custodial P2P software (Bisq, Hodl Hodl, RoboSats, Mostro, Peach) argues it is outside MSB rules. - State law and the facts of each venue can differ. Whether a given venue meets the test is contested and untested in court as far as I found. 4. States. Each state licenses money transmitters, and most require an MTL to sell bitcoin to residents. - New York requires a BitLicense or a trust charter. The NYDFS list read on 2026-10-09 includes Coinbase, Gemini, Bitstamp USA, Robinhood Crypto, Block (Cash App), PayPal, eToro, Bullish, MoonPay, zerohash, LibertyX, Coin Cafe and Cottonwood Vending. - It does not include Kraken, Binance.US, Crypto.com, OKX, Bitcoin Depot, CoinFlip or Athena [R1]. 5. DOJ priorities since 2025-04-07. The Deputy Attorney General's memo "Ending Regulation by Prosecution" says DOJ "will no longer target virtual currency exchanges, mixing and tumbling services, and offline wallets for the acts of their end users or unwitting violations of regulations". - It also says prosecutors "should not charge" unlicensed money transmitting under 18 U.S.C. § 1960(b)(1)(A)–(B), or BSA violations, "unless there is evidence that the defendant knew of the licensing or registration requirement … and violated such a requirement willfully". - § 1960(b)(1)(C) (knowingly moving criminal proceeds) is "outside the scope of this policy" [R6b]. - The Paxful plea (2025-12) came after this memo and used both § 1960 and the Travel Act [G14].

2. Centralized exchanges: detail

Coinbase (Coinbase, Inc.; parent Coinbase Global, NASDAQ: COIN)

• Licensing. NYDFS lists Coinbase, Inc. as holding Virtual Currency and Money Transmitter Licenses, granted 2017-01, and Coinbase Custody Trust Company as a Limited Purpose Trust Charter, granted 2018-10 [R1].
• Coinbase's own licence page (coinbase.com/legal/licenses) returned HTTP 403 on 2026-10-09.
• FinCEN MSB and other state MTLs: (unverified).
• KYC. Required at onboarding. In 2023, NYDFS found the KYC/CDD program "immature and inadequate". It said Coinbase "treated customer onboarding requirements as a simple check-the-box exercise" [G7].
• Enforcement and litigation:
• NYDFS, 2023-01-04. $50M penalty and $50M compliance investment. Findings: a backlog of "over 100,000 unreviewed transaction monitoring alerts" by late 2021, late SARs, and an independent monitor installed in 2022 and extended [G7][R2].
• SEC. Suit filed 2023-06-06. The SEC announced dismissal on 2025-02-27 and said this "does not reflect the Commission's position on any other case" [R4]. The complaint and dismissal stipulation are saved in sources/wallets/.
• Oregon AG, 2025-04-18. Lawsuit in Multnomah County Circuit Court under the Oregon Securities Law, alleging Coinbase promoted and sold unregistered securities to Oregonians [G34].
  • Coinbase then sued Oregon in July 2025 (headline only) [N39].
  • A federal docket, State of Oregon v. Coinbase, No. 3:25-cv-00952 (D. Or.), suggests the case was removed. Current posture (unverified).
• UK FCA, 2024-07. £3.5M against Coinbase's UK unit for onboarding high-risk customers [N10].
• Data breach disclosed 2025-05. Overseas support agents were bribed. Coinbase estimated up to $400M in reimbursement costs [N10]. Another researcher saved the MDL transfer order in sources/hacks/.
• Proof of reserves. No Merkle-tree PoR found (unverified). As a listed company it files audited financial statements with the SEC.

Kraken (Payward, Inc.; US operator Payward Interactive, Inc.)

• Licensing, checked 2026-10-09.
• Payward Interactive is a FinCEN MSB, registration no. 31000270997766, NMLS 1843762, and lists its state licences on its disclosures page [C1].
• Payward Financial, Inc. is a Wyoming Special Purpose Depository Institution (state bank charter) [C1].
• The EU arm is regulated by the Central Bank of Ireland under MiCA [C1].
• Kraken is not on the NYDFS list [R1]. Kraken left New York in 2015, citing the BitLicense [N9].
• US availability. "Kraken … does not offer services to residents of: Maine [and] New York." The page was last updated 2026-09-30 [C2].
• KYC. For a verified individual account, "a valid government issued ID is required, as well as a proof of address statement". Higher limits (over $100,000/month) need further verification [C3].
• Enforcement:
• OFAC, 2022-11-28. $362,158.70 plus $100,000 of extra sanctions-compliance spending, for services to users who appeared to be in Iran. The violations were voluntarily self-disclosed and "non-egregious" [G6].
• SEC, 2023-02-09. $30M staking settlement; Kraken stopped US staking [N9]. The complaint is in sources/wallets/.
• SEC, 2023-11-20. Unregistered-exchange suit, N.D. Cal. No. 23-06003. Dismissed by agreement 2025-03 [N9][N40].
• Proof of reserves. An independent accountant builds a Merkle tree of client balances and checks signatures for Kraken's on-chain addresses. Latest attestation 2026-06-30: BTC reserve ratio 102.9% [C4].
• Other. IPO preparation was reported in 2025. A 2026 headline says the IPO is on hold until mid-2027 (headline only).

Gemini (Gemini Trust Company, LLC; Nasdaq: GEMI since 2025-09-12)

• Licensing. New York Limited Purpose Trust Charter, 2015-10 [R1].
• CFTC designated contract market (DCM) licence, 2025-12 (headline only) [N42].
• Gemini Olympus received a DCO licence in 2026-05 [N12].
• Other state MTLs: (unverified); Gemini's licence page did not render.
• KYC. Required (unverified on Gemini's site).
• Enforcement:
• Gemini Earn / Genesis. NYDFS settlement of about $37M, plus at least $1.1B returned to Earn customers, in early 2024 [N11]. The exact NYDFS order date was not checked.
• SEC Earn suit [N11] (filing year 2023, unverified). Resolution reported in progress in 2025 (US News, 2025-04-01, headline only); final status (unverified). A separate SEC investigation was reported closed in 2025-02 (headline only) [N23].
• CFTC. $5M settlement in 2025-01 over statements about bitcoin-futures manipulation risk. On 2026-05-27 the CFTC and Gemini jointly moved to vacate it, the CFTC saying the complaint "should not have been filed" [N12]. Contested: a former CFTC chair called the reversal "extraordinarily unusual" (Cointelegraph, headline only).
• Proof of reserves. None found (unverified).

Bitstamp (Bitstamp USA, Inc.; owned by Robinhood since 2025-06)

• Licensing. NY Virtual Currency License, 2019-04 [R1].
• Luxembourg payment-institution licence, 2016 [N14].
• Robinhood says Bitstamp holds licences in Singapore, Luxembourg, the UK, Slovenia and the US [N13].
• KYC. Since 2013-09, passport copies and proof of address [N14].
• Ownership. Robinhood completed the purchase in June 2025 for $200M [N13].
• Enforcement. None found. Note the 2015 hack of fewer than 19,000 BTC [N14].

Binance (Binance Holdings Ltd., binance.com) and Binance.US (BAM Trading Services Inc.)

• US availability. Binance.com is barred from US persons. FinCEN's order requires "Binance's complete exit from the United States" [G2][G3].
• KYC history, from FinCEN's findings [G1]:
• From July 2017 through at least August 2021, "Tier One" ("no-KYC") customers could open accounts and trade crypto-to-crypto "with only an email address".
• They could "conduct daily withdrawals of CVC under two bitcoin", at times over $130,000 a day.
• By Binance's own count, it had four times as many no-KYC US users (by IP address) as KYC'd US users.
• New no-KYC accounts were prohibited from August 2021.
• 2023 global resolution (2023-11-21):
• FinCEN civil penalty $3.4B, a five-year monitorship, and a $150M suspended penalty [G2][G3].
• OFAC $968M for 1.67 million trades between US persons and users in sanctioned jurisdictions, 2017-08 to 2022-10. Treasury says Binance "suggest[ed] that users utilize virtual private networks" to get around its own geofencing [G3][G4].
• DOJ guilty plea, W.D. Wash. No. 2:23-cr-00178 [G5]; headline total $4.3B [N6][N8]. The DOJ press release could not be fetched (bot check).
• CFTC resolution in parallel [G3]. The amount is not verified here because cftc.gov was not fetched.
• Founder. Changpeng Zhao pleaded guilty in 2023, was sentenced to four months in 2024-04, was released 2024-09, and was pardoned on 2025-10-23 [N6].
• SEC. The suit against Binance, BAM and Zhao was dropped on 2025-05-29 (CNBC, headline only) [N22].
• Monitorship (contested):
• 2025-09 headlines said Binance was near a deal with DOJ to remove the outside compliance monitor [N41].
• A 2026-09-24 report says Binance "remains under court-ordered independent monitoring", with the term ending around 2027-05 [N7].
• 2026 (single source) [N7]. Reports on 2026-09-21/22 say SDNY prosecutors are investigating whether Binance let Iran-linked funds through.
• A $61M forfeiture complaint was filed on 2026-09-14 against wallets allegedly used by two Chinese firms.
• Binance says it removed one of them in 2026-01 and has "zero-tolerance" for sanctions violations.
• Non-US licences. Wikipedia lists licences in France, Italy, Spain and Sweden. It says Binance is "banned or restricted" in the UK, Australia, Canada and, since 2026-05, the EU under MiCA. The EU part is (unverified) [N8].
• Binance.US licensing, page dated 2026-06-04. BAM Trading Services is a FinCEN MSB with NMLS 1906829 and lists state MTLs [C5]. It is not on the NYDFS list [R1]. In 2026 it is reported to be preparing a CFTC application for prediction markets (headline only).
• Proof of reserves (Binance.com). Merkle tree plus zk-SNARK proofs. Users can check their own leaf. Snapshot dates and ratios are behind log-in [C6].

OKX (Aux Cayes FinTech Co. Ltd. and affiliates; OKX US)

• 2025-02-24 guilty plea (SDNY):
• Charge: operating an unlicensed money transmitting business.
• Penalties: $84.4M fine + $420.3M forfeiture = $504.7M [N2]. The forfeiture money judgment of $420,353,574 appears in the plea papers [G12].
• Findings: over $1 trillion of US-customer transactions from 2018 to early 2024, despite a 2017 "ban"; no AML transaction-monitoring software until 2023-05; never registered with FinCEN.
• An external compliance consultant is required through 2027-02 [N2].
• US re-entry. OKX US (San Jose; CEO Roshan Robert) launched in "the majority of U.S. states" in 2025, with nationwide rollout targeted for late 2025 [N20]. Its state licences were not verified.
• Proof of reserves. Monthly. zk-STARK proofs since 2023-03 (Merkle tree before). The 47th report (2026-09) shows BTC 109%: 139,865 BTC owed against 153,151 BTC held. No third-party auditor is named [C7].

Bybit

• Headquarters and licences [N17]:
• Dubai.
• Austria: crypto-asset service provider 2025-05; e-money institution 2026-08.
• UAE: full VARA licence 2025-10.
• India: fined, then registered with FIU-IND 2025-01.
• Canada: settled with the OSC 2022, exited 2023.
• US availability. Not offered to US users (unverified).
• 2025-02-21 theft. About $1.5B in ether. The FBI attributed it to North Korea ("TraderTraitor") on 2025-02-26 [G35]. Bybit restored reserves within 72 hours with emergency funding [N17].
• Proof of reserves. A page exists at bybit.com/en/proof-of-reserve. It timed out on 2026-10-09, not read.

Bitfinex (iFinex Inc., British Virgin Islands)

• Licensing. Regulated in El Salvador. Full Digital Asset Service Provider licence in 2026-05 [N16].
• US availability. Not for US persons (unverified); the terms page did not render.
• Enforcement [N16]:
• CFTC 2016-06: $75,000, illegal off-exchange commodity transactions.
• NYAG 2021-02: Bitfinex and iFinex paid $18.5M over statements about Tether's backing.
• CFTC 2021-10: $1.5M.
• 2016 hack. 119,756 BTC stolen. Ilya Lichtenstein pleaded guilty in 2023-08 and was sentenced to 5 years in 2024-11; Heather Morgan got 18 months [N16].
• The statement of offense and a 2025-04-04 restitution opinion are saved by another researcher in sources/hacks/. The opinion is scanned and was not read; how much BTC goes back to Bitfinex is (unverified).

KuCoin (Peken Global Ltd.; earlier Mek Global Ltd. and Phoenixfin Pte Ltd.)

• NYAG, 2023-12. Stipulation in Index 450703/2023 [G10]:
• KuCoin refunds about $16.77M to New York customers and pays $5.3M to the State.
• The underlying claim: KuCoin offered unregistered securities and commodities and called itself an "exchange" while unregistered.
• DOJ, 2025-01-27 [N1][G11]:
• Guilty plea to operating an unlicensed money transmitting business.
• Forfeiture $184.5M plus fine of about $112.9M, total $297.4M [N1].
• KuCoin must completely exit the US "for a period of at least two years after entry of the judgment" and hire an external compliance consultant [G11, Att. C].
• The plea papers say KuCoin earned at least $184.5M in fees from about 1,540,000 US registered users [G11].
• Founders Chun Gan and Ke Tang received two-year deferred prosecution agreements and each forfeits about $2.7M [N1].
• KYC. No identification required "until July 2023". Mandatory KYC from August 2023 for new and active users [N1].
• Other [N18]:
• CFTC settlement 2026-03 (unverified).
• Austria MiCA authorisation 2025-11 (trading reportedly suspended by 2026).
• AUSTRAC registration 2025-11.
• Proof of reserves. Merkle tree, "verified by an independent third party" (not named). Snapshot 2026-09-30: BTC 109% [C8].

BitMEX (HDR Global Trading Ltd. and affiliates)

• KYC. Before August 2020, customers "could register to trade on the platform anonymously". BitMEX advertised that "[n]o real-name or other advanced verification is required" [N4].
• Enforcement:
• FinCEN, 2021-08-10. Assessment No. 2021-02: $100M civil money penalty, with $50M credited for the payment to the CFTC [G13].
• Founders. Arthur Hayes, Ben Delo and Samuel Reed pleaded guilty in 2022 ($10M fines each); Gregory Dwyer later [N5].
• Company. Guilty plea 2024-07; $100M criminal fine 2025-01-15 [N4][N5].
• Pardons, 2025-03. The President pardoned the four individuals and the company, "the first time a pardon was granted to a corporation" [N5].
• Closure. Announced 2026-07-23. Position-opening limits from 2026-08-26; operations ended 2026-09-23 04:00 UTC [N3].

Crypto.com (Foris DAX)

• Licensing [N15]:
• Not on the NYDFS list [R1].
• OCC conditional approval for a national trust bank charter, 2026-02.
• CFTC approval for margined derivatives (amended DCO licence), 2025-09.
• MiCA licence, 2025-01.
• FinCEN MSB and state MTLs: (unverified).
• KYC. Required (unverified).
• SEC. Wells notice in 2024 and closure in 2025 are widely reported, but I did not find a source on 2026-10-09 (unverified).
• Proof of reserves. The page still shows a Mazars agreed-upon-procedures check as of 2022-12-07, with nothing newer [C9].
• Political ties. Wikipedia reports a Trump Media partnership (2025-08) and $38.6M in 2026 Republican campaign donations [N15]. Context only.

Robinhood Crypto, LLC

• Licensing. NY Virtual Currency and Money Transmitter Licenses, 2019-01 [R1].
• Enforcement:
• NYDFS, 2022-08-02. $30M for BSA/AML failures (understaffed, manual transaction monitoring) and cybersecurity failures; an independent consultant was required [R3][G8].
• California DFPI, 2024-09. $3.9M over customers' inability to withdraw crypto to outside wallets, 2018–2022 [N13].
• SEC. Crypto investigation closed without action, 2025-02-24 (TechCrunch, headline only) [N21].
• Bitstamp. Robinhood acquired it in 2025-06 [N13].

Cash App (Block, Inc. d/b/a Block of Delaware in NY)

• Licensing. NY Virtual Currency and Money Transmitter Licenses, 2018-06 [R1]. Cash App's bitcoin page: "Block, Inc. operates in New York as Block of Delaware and is licensed to engage in virtual currency business activity by [NYDFS]" [C10].
• KYC. "You may need to verify your identity before you buy bitcoin for the first time" [C10].
• Enforcement:
• NYDFS, 2025-04-10. $40M penalty. Findings: "insufficient Know-Your-Customer ('KYC') and transaction monitoring processes"; a SAR backlog in 2018–2021; an AML program covering "both fiat and Bitcoin transactions" that did not keep pace with growth. A 12-month independent monitor is required [G9].
• CFPB, 2025-01-16. Order for Cash App fraud and customer-service failures: $55M penalty and $75–120M redress. This is not bitcoin-specific [R5].
• 46 state AGs, 2026-07-08. $45M settlement on Cash App fraud. No bitcoin aspect reported [N38].

3. No-KYC and peer-to-peer venues

These venues share one feature: the operator does not take custody of both sides' money in the way an exchange does. Most rely on FinCEN's line between hosting value and only matching counterparties (§1, item 3). Below is how each works in principle, from its own documentation. There are no access instructions and no Tor addresses.

• Bisq.
• "Bisq is code, not a company, governed by its DAO"; open source (AGPLv3).
• Trade funds sit in a 2-of-2 multisig held by the two traders, who both post security deposits.
• Disputes go chat → mediation → arbitration, and "mediators and arbitrators do not hold a key".
• "Bisq requires no registration or KYC". New payment accounts get trade limits that rise with account age and signing.
• Network traffic goes over Tor.
• Bisq 2 adds "Bisq Easy", which is reputation-based with no security deposits [C11].
• Hodl Hodl (Hodlex Ltd).
• Says it "does not hold any money (neither Bitcoin, nor fiat)".
• Each trade uses a 2-of-3 multisig escrow; Hodl Hodl holds one key, the two traders the others.
• "Global P2P trades without KYC/AML"; sign-up needs only e-mail and password.
• Fee: max 1.5% per trade; a support manager decides disputes [C12].
• No country restrictions are listed in the FAQ.
• RoboSats.
• Lightning-based. "LN Hodl invoices serve as bonds & escrows".
• No accounts or KYC; each user gets a single-use "Robot" identity.
• Run by a federation of coordinators; open source.
• Designed to be used over Tor only [C13]. I did not record any Tor address.
• Peach Bitcoin.
• Swiss company (2022). Describes itself as a "licensed Financial Service Provider" and "SRO member … of Polyreg" under Swiss AML law.
• 2-of-2 multisig escrow; in-app dispute help.
• "No Registration", "No verification!". Users "are responsible for complying with all applicable regulations in their jurisdiction, including any KYC/AML requirements".
• Does "not solicit, advertise, market, or target users in the EU/EEA", and warns use "may be restricted or non-compliant … including the EU/EEA after July 1, 2026" (the end of MiCA transition) [C14].
• Mostro.
• A protocol, not an app: coordination runs over Nostr, and Lightning hold invoices keep the seller's sats locked until fiat is confirmed.
• "There is no central or official node"; anyone can run one and set fees.
• No identity checks. Mediators handle disputes from an unalterable chat record.
• In beta [C15].

Legal status and enforcement (US):

• Software projects. I found no US enforcement action against Bisq, Hodl Hodl, RoboSats, Peach or Mostro in searches on 2026-10-09 (absence is unverified).
• Federal guidance leaves the platforms outside MSB rules if they never host the value [R6a]. The DOJ's 2025 memo deprioritises "unwitting" regulatory charges [R6b].
• Contested: in 2024–2025 prosecutors used § 1960 against other non-custodial privacy software. That is not sourced in this file and is outside its scope; see other researchers' notes on wallets and mixers.
• Individual traders. People who trade as a business on these venues are money transmitters under FinCEN guidance, whatever the venue's own status [R6a §4.1].
• FinCEN has penalised individual P2P exchangers [R6c]. DOJ has prosecuted unlicensed individual exchangers. One example: Kais Mohammad ("Superman29") got 24 months for an unregistered cash-and-kiosk exchange business of up to $25M [G18].
• Outside the US. Peach's own warning shows EU/EEA rules (MiCA) as the next constraint [C14].

Closed venues

• LocalBitcoins (Finland, 2012–2023) [N24]:
• Enhanced KYC from 2019-03 under new Finnish law; registered with the Finnish FSA as a virtual currency provider in 2019-11.
• Announced closure on 2023-02-09; peaked at about 1 million active users (Q4 2020).
• In 2025-06 the Finnish FSA imposed a €500,000 penalty for customer-due-diligence failures in its final years.
• US users were arrested in 2014, 2016 and 2018 in money-laundering cases. Neither Wikipedia nor my searches show any US prosecution of the company itself.
• Paxful (US, 2015–2025):
• KYC history [G17]:
  • Paxful conducted more than $3.5B of trades "prior to its implementation of any KYC policies".
  • Mandatory KYC was announced on 2019-02-15, "applying only to users with activity that exceeded $1,500".
  • Paxful registered with FinCEN in 2015 but lapsed until 2019-09-03.
• 2023-04-04. Co-founder and CEO Ray Youssef announced a shutdown amid litigation with co-founder Artur Schaback [N25]. The platform later continued operating (unverified), and "shut down in 2025" [N26].
• Schaback. Pleaded guilty on 2024-07-08 to conspiracy to fail to maintain an AML program [G14].
• Paxful Holdings, Inc. pleaded guilty in 2025-12 (E.D. Cal. No. 2:25-cr-00235) to [G14][G16]:
  • conspiracy to violate the Travel Act (promoting prostitution, including via Backpage);
  • conspiracy to operate an unlicensed money transmitting business;
  • conspiracy to violate the BSA AML-program requirement.
• What DOJ said. Paxful marketed itself as needing no KYC, "presented to third parties fake AML policies", and from 2017-01 to 2019-09 facilitated 26.7M trades worth about $3B [G14].
• Penalty. The agreed guideline penalty was $112.5M, but DOJ found Paxful could pay no more than $4M. Sentenced 2026-02-10 to pay $4M [G15].
• FinCEN, 2025-12. Civil money penalty $3.5M, of which $1.75M is credited to the DOJ payment [G17].
• Founder. Ray Youssef was indicted in E.D. Cal. a few days after the company's plea [N26].

4. Bitcoin ATMs (kiosks)

How they are regulated (federal) [G18]:

• Kiosk operators are money transmitters. They must register with FinCEN within 180 days and run the full BSA program, including customer identification, SARs and CTRs.
• Customer identification at a kiosk "can range from a phone number to a scan of a government-issued ID".
• Some operators require users to certify that the destination wallet is their own.

Scale and fraud data:

• Coin ATM Radar counted 37,342 US kiosks on 2025-01-01, up from 4,128 on 2019-01-01 [G18 n.19]. Wikipedia gives about 28,000 in 2025-11 [N36].
• FBI IC3 complaints involving kiosks:
• 2024: 10,956 complaints, about $246.7M lost [G18].
• 2025: 13,460 complaints, $389M lost; complaints up 23% and losses up 58% on 2024 [R6d].

KYC thresholds in practice. They vary by operator and by state. An industry reference tier for one operator:

Source: [N35] (industry site, not authoritative).

Operators

• Bitcoin Depot (Nasdaq: BTM):
• ID tiers. In early 2025 the kiosk menu offered $20–$250, $251–$2,999 and $3,000–$15,000 [G20]:
  • under $250 required "a name, phone number, and email address";
  • from $251 required an ID scan.
• In 2026-02 it began requiring identity verification for all transactions [N27].
• Fees. Iowa alleged Bitcoin Depot kept a 23% cut of money Iowans sent through its machines [G19].
• Enforcement [N27][N28]:
  • Iowa AG suit, 2025-02-26 [G19][G20].
  • Massachusetts AG suit, 2026-02 [N43]. Mass.gov returned 403, so the complaint was not saved.
  • Settlements in Nevada and Maine.
  • Connecticut licence suspended, 2026-03.
• Bankruptcy. Filed Chapter 11 in the Southern District of Texas around 2026-05-18 for an orderly wind-down and asset sale; over 9,000 kiosks shut down [N28][N27].
  • The CEO blamed "increasingly stringent compliance obligations, including new transaction limits" and "outright restrictions or bans" [N27].
  • Revenue fell 49.2% year on year in Q1 2026.
  • A cyber breach in 2026-04 took $3.7M from its wallets [N28].
• Not on the NYDFS list [R1].
• Athena Bitcoin (Athena Bitcoin Global, OTC: ABIT):
• Registration. FinCEN BSA ID 31000288780907; NMLS 1679249 [C17].
• ID. "Required for larger transactions"; no threshold published [C17].
• D.C. AG suit, 2025-09-08 [G23][G24], under D.C.'s consumer-protection and elder-exploitation laws. From Athena's own data for its first five months in D.C.:
  • 93% of deposits were from scams;
  • victims' median age was 71;
  • fees were up to 26% and not clearly disclosed;
  • Athena had a "no refunds" policy.
• CoinFlip (GPD Holdings LLC):
• Registration. FinCEN MSB 31000291840717; NMLS 1975146 [C16].
• Iowa AG suit, 2025-02-26. Alleged a 21% cut [G19][G21].
• Missouri AG suit, 2026-05-20 (Jasper County) [G25][G26]:
  • claims under the Missouri Merchandising Practices Act;
  • seeks an injunction against operating in Missouri and up to $1,826,000 in penalties.
  • CoinFlip called the suit "meritless" and said it backed Missouri's 2025 kiosk law [N37].
• Washington DFI, 2026-09-03 [G27][G28]:
  • Statement of Charges seeking revocation of its licence, an industry ban for the company and its responsible individual, refunds, and a $1,029,600 fine.
  • Alleged failures: let customers complete transactions "without providing a phone number, address, date of birth"; "ineffective or unenforced tier limits"; late CTRs; a 6–9-month alert backlog.
  • The charges are contestable at a hearing.

State laws (selected; checked 2026-10-09)

Also:

• Fee caps. Crypto.news (2026-08-02) also lists fee caps in Colorado, Maryland, Connecticut and Louisiana [N29]. Not verified individually.
• Cities. San Antonio requires bilingual warning signs (2026-07-01) [N29]. Spokane, WA reportedly banned kiosks in 2025-06 (low-quality source; unverified).
• Federal bill. The Crypto ATM Fraud Prevention Act (S. 710, 2025) was not enacted as of 2026-08 [N29].
• Market exits. Valuto/CoinMover filed Chapter 7 in 2025-12, and Coinsource's operator filed Chapter 7 in 2026-04 [N36].

5. Contested or open points

1. Binance monitorship and Iran probe. 2025 reports said the DOJ monitor was going; a 2026-09 report says it remains, with a new SDNY investigation and a $61M forfeiture case. Single source [N41][N7].
2. CFTC v. Gemini. The agency asked to vacate its own 2025 judgment in 2026-05, calling the case improper. Critics call this unusual and politically influenced. It is unresolved here [N12].
3. Pardons. BitMEX (company and founders, 2025-03) and Changpeng Zhao (2025-10-23) were pardoned [N5][N6]. Their corporate pleas and penalties remain on the record.
4. Whether non-custodial P2P software needs a licence. FinCEN's 2019 guidance says matching-only and key-holding-without-control services are not money transmitters [R6a]. Prosecutors have contested this for some non-custodial tools. DOJ's 2025 memo narrows charging but "casts no doubt on existing case law" [R6b].
5. Kiosk bans vs regulation. Operators argue that bans remove the only cash-to-bitcoin route and that "scammers are the problem" (CoinFlip testimony) [N30]. States cite FBI loss data [R6d] and operator data such as D.C.'s 93%-scam finding [G23].

6. Sources

G: government and court documents. Full copies are in sources/exchanges/; see INDEX.md for files and URLs. All were downloaded 2026-10-09.

• [G1] FinCEN Consent Order 2023-04, Binance (2023-11-21)
• [G2] FinCEN press release, Binance (2023-11-21)
• [G3] U.S. Treasury press release jy1925 (2023-11-21)
• [G4] OFAC settlement agreement, Binance (2023-11-21)
• [G5] U.S. v. Binance Holdings, W.D. Wash. 2:23-cr-00178, Doc. 23 (scanned)
• [G6] OFAC web notice, Payward/Kraken (2022-11-28)
• [G7] NYDFS Consent Order, Coinbase (2023-01-04)
• [G8] NYDFS Consent Order, Robinhood Crypto (2022-08)
• [G9] NYDFS Consent Order, Block/Cash App (2025-04-10)
• [G10] NYAG Stipulation and Consent, KuCoin (2023-12)
• [G11] U.S. v. Peken Global (KuCoin), plea attachments (2025-01-27)
• [G12] U.S. v. Aux Cayes FinTech (OKX), plea papers (2025-02-24)
• [G13] FinCEN Assessment 2021-02, BitMEX (2021-08-10)
• [G14] DOJ press release, Paxful pleads guilty (2025-12-10)
• [G15] DOJ press release, Paxful sentenced (2026-02-11)
• [G16] U.S. v. Paxful Holdings, E.D. Cal. 2:25-cr-00235, plea agreement (2025-12-08)
• [G17] FinCEN Consent Order 2025-02, Paxful (2025-12)
• [G18] FinCEN FIN-2025-NTC1, CVC kiosk notice (2025-08-04)
• [G19] Iowa AG press release (2025-02-26)
• [G20] Iowa v. Bitcoin Depot petition
• [G21] Iowa v. CoinFlip petition
• [G22] Iowa AG fact sheet
• [G23] D.C. OAG press release, Athena (2025-09-08)
• [G24] D.C. v. Athena Bitcoin complaint
• [G25] Missouri AG press release, CoinFlip (2026-05-20)
• [G26] Missouri v. GPD Holdings petition
• [G27] Washington DFI press release, CoinFlip (2026-09-03)
• [G28] Washington DFI Statement of Charges C-26-4341-26-SC01
• [G29] Tennessee Public Chapter 766 (2026)
• [G30] Tennessee TDFI Bulletin C-26-1 (2026-06-04)
• [G31] Kansas OSBC, HB 2591 notice (2026-07-06)
• [G32] Nebraska NDBF crypto ATMs page
• [G33] Nebraska NDBF LB 609 FAQ
• [G34] Oregon DOJ press release, Coinbase (2025-04-18)
• [G35] FBI IC3 PSA250226, Bybit (2025-02-26)

R: government pages read 2026-10-09 but not saved here, or saved by other researchers.

• [R1] NYDFS, "Virtual Currency Businesses" regulated-entities table. https://www.dfs.ny.gov/virtual_currency_businesses (read via WebFetch 2026-10-09; table includes entries up to 2026-07)
• [R2] NYDFS press release, Coinbase (2023-01-04). https://www.dfs.ny.gov/reports_and_publications/press_releases/pr202301041
• [R3] NYDFS press release, Robinhood Crypto (2022-08-02). https://www.dfs.ny.gov/reports_and_publications/press_releases/pr202208021
• [R4] SEC press release 2025-47, "SEC Announces Dismissal of Civil Enforcement Action Against Coinbase" (2025-02-27). https://www.sec.gov/newsroom/press-releases/2025-47
• [R5] CFPB enforcement action, Block, Inc. (2025-01-16; page modified 2025-01-24). https://www.consumerfinance.gov/enforcement/actions/block-inc/
• [R6a] FinCEN FIN-2019-G001 (2019-05-09): sources/kyc-aml/2019-05-09-FinCEN-FIN-2019-G001-CVC-guidance.pdf
• [R6b] DOJ DAG memo "Ending Regulation by Prosecution" (2025-04-07): sources/kyc-aml/2025-04-07-DOJ-DAG-memo-Ending-Regulation-by-Prosecution.pdf
• [R6c] FinCEN, Eric Powers P2P exchanger penalty (2019-04-18): sources/kyc-aml/2019-04-18-FinCEN-news-Eric-Powers-P2P-exchanger-penalty.html
• [R6d] FBI IC3 2025 Internet Crime Report (2026-04): sources/hacks/2026-04-fbi-ic3-2025-internet-crime-report.pdf
• [R6e] Minnesota Laws 2026 ch. 65 (SF 3868): sources/kyc-aml/2026-05-05-Minnesota-Laws-2026-ch65-SF3868-kiosk-ban.html
• Not fetched; cited by URL only:
• DOJ releases (bot check): Binance https://www.justice.gov/archives/opa/pr/binance-and-ceo-plead-guilty-federal-charges-4b-resolution; KuCoin https://www.justice.gov/usao-sdny/pr/kucoin-pleads-guilty-unlicensed-money-transmission-charge-and-agrees-pay-penalties; OKX https://www.justice.gov/usao-sdny/pr/okx-pleads-guilty-violating-us-anti-money-laundering-laws-and-agrees-pay-penalties; BitMEX https://www.justice.gov/usao-sdny/pr/global-cryptocurrency-exchange-bitmex-pleads-guilty-bank-secrecy-act-offense and https://www.justice.gov/usao-sdny/pr/global-cryptocurrency-exchange-bitmex-fined-100-million-violating-bank-secrecy-act.
• CFTC (robots.txt bars AI agents): Binance https://www.cftc.gov/PressRoom/PressReleases/8825-23; Gemini https://www.cftc.gov/PressRoom/PressReleases/9031-25 and https://www.cftc.gov/PressRoom/PressReleases/9236-26.

C: company pages. Read 2026-10-09; summary only.

• [C1] Kraken legal disclosures. https://www.kraken.com/legal/disclosures
• [C2] Kraken "Geographic restrictions" (updated 2026-09-30). https://support.kraken.com/hc/en-us/articles/360001368823-Geographic-restrictions
• [C3] Kraken account/verification article (updated 2026-10-06). https://support.kraken.com/articles/360001395743
• [C4] Kraken proof of reserves. https://www.kraken.com/proof-of-reserves
• [C5] Binance.US "Licenses" (dated 2026-06-04). https://support.binance.us/en/articles/10471695-licenses
• [C6] Binance proof of reserves. https://www.binance.com/en/proof-of-reserves
• [C7] OKX proof of reserves. https://www.okx.com/proof-of-reserves
• [C8] KuCoin proof of reserves. https://www.kucoin.com/proof-of-reserves
• [C9] Crypto.com proof of reserves. https://crypto.com/proof-of-reserves
• [C10] Cash App bitcoin page. https://cash.app/bitcoin
• [C11] Bisq wiki FAQ (redirected from https://bisq.network/faq/). https://bisq.wiki/Frequently_asked_questions
• [C12] Hodl Hodl FAQ. https://hodlhodl.com/pages/faq
• [C13] RoboSats learn site (learn.robosats.com redirects here). https://learn.robosats.org/
• [C14] Peach Bitcoin home page. https://peachbitcoin.com/
• [C15] Mostro home page. https://mostro.network/
• [C16] CoinFlip FAQ footer. https://coinflip.tech/faq
• [C17] Athena Bitcoin FAQ footer. https://athenabitcoin.com/faq/

N: news, law-firm and reference sources. Summary only.

• [N1] NYU Program on Corporate Compliance & Enforcement blog, KuCoin plea (2025-03-07). https://wp.nyu.edu/compliance_enforcement/2025/03/07/cryptocurrency-exchange-kucoin-pleads-guilty-to-unlicensed-money-transmission-agrees-to-pay-more-than-297-4-million-in-criminal-forfeiture-fine/
• [N2] Jumpstart Magazine, OKX plea. https://www.jumpstartmag.com/okx-pleads-guilty-why-the-crypto-exchange-pays-us500-million-compliance-fines/
• [N3] CoinDesk, "BitMEX… comes to an end" (2026-07-23). https://www.coindesk.com/markets/2026/07/23/bitmex-s-11-year-run-comes-to-an-end-notifies-users-it-is-ending-operations-in-by-sept-23
• [N4] McDermott Will & Emery, BitMEX $100M penalty. https://www.mcdermottlaw.com/insights/the-high-cost-of-noncompliance-making-sense-of-bitmexs-100-million-aml-penalty
• [N5] Wikipedia, "BitMEX". https://en.wikipedia.org/wiki/BitMEX
• [N6] The Hill via Yahoo, "Trump pardons Binance founder Changpeng Zhao" (2025-10-23). https://finance.yahoo.com/news/trump-pardons-binance-founder-changpeng-155217554.html
• [N7] 24/7 Wall St., Binance Iran investigation (2026-09-24). https://247wallst.com/investing/cryptocurrency/2026/09/24/binance-is-under-federal-investigation-over-iran-sanctions-again-what-does-it-mean-for-bnb
• See also Bloomberg (2026-09-22, headline only). https://www.bloomberg.com/news/articles/2026-09-22/doj-probing-binance-over-potential-iran-sanctions-violations
• [N8] Wikipedia, "Binance". https://en.wikipedia.org/wiki/Binance
• [N9] Wikipedia, "Kraken (cryptocurrency exchange)". https://en.wikipedia.org/wiki/Kraken_(cryptocurrency_exchange)
• [N10] Wikipedia, "Coinbase". https://en.wikipedia.org/wiki/Coinbase
• [N11] Wikipedia, "Gemini (cryptocurrency exchange)". https://en.wikipedia.org/wiki/Gemini_(cryptocurrency_exchange)
• [N12] Decrypt, CFTC and Gemini joint motion (2026-05). https://decrypt.co/369252/cftc-gemini-file-joint-motion-to-reverse-5m-settlement
• [N13] Wikipedia, "Robinhood Markets". https://en.wikipedia.org/wiki/Robinhood_Markets
• [N14] Wikipedia, "Bitstamp" (updated 2026-09-30). https://en.wikipedia.org/wiki/Bitstamp
• [N15] Wikipedia, "Crypto.com" (updated 2026-08-28). https://en.wikipedia.org/wiki/Crypto.com
• [N16] Wikipedia, "Bitfinex". https://en.wikipedia.org/wiki/Bitfinex
• [N17] Wikipedia, "Bybit". https://en.wikipedia.org/wiki/Bybit
• [N18] Wikipedia, "KuCoin". https://en.wikipedia.org/wiki/KuCoin
• [N19] Wikipedia, "OKX". https://en.wikipedia.org/wiki/OKX
• [N20] Yahoo Finance, "OKX launches U.S. exchange, a self-custody wallet and names new CEO" (2025). https://finance.yahoo.com/news/okx-launches-u-exchange-self-193049556.html
• [N21] TechCrunch, "The SEC will not sue Robinhood over crypto" (2025-02-24; headline only). https://techcrunch.com/2025/02/24/the-sec-will-not-sue-robinhood-over-crypto
• [N22] CNBC, "SEC drops Binance lawsuit…" (2025-05-29; headline only, 403). https://www.cnbc.com/2025/05/29/sec-drops-binance-lawsuit-ending-one-of-last-remaining-crypto-actions.html
• [N23] Benzinga, "SEC Closes Investigation Against Crypto Exchange Gemini…" (2025-02; headline only). https://www.benzinga.com/markets/cryptocurrency/25/02/43996312/sec-closes-investigation-against-crypto-exchange-gemini-says-cameron-winklevoss-another-milestone-to-the-end-of-the-war-on-crypto
• [N24] Wikipedia, "LocalBitcoins". https://en.wikipedia.org/wiki/LocalBitcoins
• [N25] Yahoo Finance, "Bitcoin Marketplace Paxful to Shut Down…" (2023-04-04). https://finance.yahoo.com/news/bitcoin-marketplace-paxful-shut-down-192816934.html
• [N26] BeInCrypto via Yahoo, "DOJ Indicts Paxful Founder…" (updated 2026-03-02). https://www.yahoo.com/news/articles/doj-indicts-paxful-founder-days-184324987.html
• [N27] ICIJ, "Crypto ATM operator Bitcoin Depot files for bankruptcy" (2026-05-19). https://www.icij.org/investigations/coin-laundry/crypto-atm-operator-bitcoin-depot-files-for-bankruptcy
• [N28] Decrypt via Yahoo, Bitcoin Depot Chapter 11 (2026-05-18). https://finance.yahoo.com/markets/crypto/articles/crypto-atm-operator-bitcoin-depot-093609055.html
• [N29] crypto.news, "Crypto kiosk rules by state" (updated 2026-08-02). https://crypto.news/us/kiosks
• [N30] MinnPost, Minnesota kiosk ban (2026-04-30). https://www.minnpost.com/state-government/2026/04/crypto-kiosks-minnesota-ban-what-are-they
• [N31] Wealth of Geeks via Yahoo, "Minnesota Is Banning Crypto ATMs…" (2026-06-21). https://www.yahoo.com/news/us/articles/minnesota-banning-crypto-atms-scammers-155708795.html
• [N32] Yahoo News, "Tennessee just became the second state to ban 'crypto ATMs'" (2026-04). https://www.yahoo.com/news/articles/tennessee-just-became-second-state-120036508.html
• [N33] Orrick InfoBytes, "Indiana governor signs law prohibiting operation of virtual currency kiosks" (2026-03-20). https://infobytes.orrick.com/2026-03-20/indiana-governor-signs-law-prohibiting-operation-of-virtual-currency-kiosks/
• Bill page: https://iga.in.gov/legislative/2026/bills/house/1116/details
• [N34] Bitcoin ATM News, California regulations (reviewed 2026-09-05). https://bitcoinatm.news/regulations/california
• Official DFPI page: https://dfpi.ca.gov/regulated-industries/digital-financial-assets/digital-financial-assets-law-information-for-kiosk-operators/
• [N35] CoinTime ATM, "Bitcoin ATM KYC" (2026). https://cointimeatm.com/bitcoin-atms-kyc
• [N36] Wikipedia, "Cryptocurrency ATM". https://en.wikipedia.org/wiki/Cryptocurrency_ATM
• [N37] BeInCrypto via Yahoo, "Missouri Sues CoinFlip…" (2026-05-21). https://finance.yahoo.com/markets/crypto/articles/missouri-sues-coinflip-crypto-atm-072321438.html
• [N38] TechCrunch via Yahoo, Block $45M 46-state settlement (2026-07-09). https://finance.yahoo.com/technology/articles/block-reaches-45m-settlement-46-151634642.html
• [N39] State Affairs (Oregon), "Coinbase sues Oregon after 'flip flop'…" (2025-07-15; headline only). https://pro.stateaffairs.com/or/finance/coinbase-oregon-lawsuit
• [N40] Wikipedia, "Cryptocurrency in the second Trump presidency". https://en.wikipedia.org/wiki/Cryptocurrency_in_the_second_Trump_presidency
• [N41] Techmeme, "Binance nears a deal with the US DOJ to remove the outside compliance monitor" (2025-09-16; headline only). https://www.techmeme.com/250916/p40
• [N42] Techmeme, "The US CFTC grants crypto exchange Gemini a DCM license" (2025-12-10; headline only). https://www.techmeme.com/251210/p63
• [N43] Massachusetts AG, Bitcoin Depot suit. https://www.mass.gov/news/ag-campbell-sues-bitcoin-kiosk-operator-for-facilitating-crypto-scams-against-massachusetts-consumers (403 on 2026-10-09). Date from Western Mass News (2026-02-03, headline only): https://www.westernmassnews.com/2026/02/03/massachusetts-attorney-general-files-lawsuit-against-bitcoin-kiosk-operator

7. Clearnet domains documented in this file (for the link map)

• Exchanges and brokers: coinbase.com, kraken.com, gemini.com, bitstamp.net, binance.com, binance.us, okx.com, bybit.com, bitfinex.com, kucoin.com, bitmex.com, crypto.com, robinhood.com, cash.app
• P2P (live): bisq.network, bisq.wiki, hodlhodl.com, robosats.org, robosats.com (redirects to robosats.org), peachbitcoin.com, mostro.network
• P2P (closed): localbitcoins.com, paxful.com
• Bitcoin ATM operators: bitcoindepot.com (not visited), athenabitcoin.com, coinflip.tech
• Government: justice.gov, fincen.gov, home.treasury.gov, ofac.treasury.gov, dfs.ny.gov, sec.gov, cftc.gov, consumerfinance.gov, ic3.gov, ag.ny.gov, iowaattorneygeneral.gov, oag.dc.gov, ago.mo.gov, mass.gov, dfi.wa.gov, tn.gov, publications.tnsosfiles.com, osbckansas.gov, ndbf.nebraska.gov, iga.in.gov, dfpi.ca.gov, doj.state.or.us
• Document mirrors: business.cch.com, skadden.com, fireblocks.com, gibsondunn.com
• Secondary: wp.nyu.edu, jumpstartmag.com, coindesk.com, mcdermottlaw.com, en.wikipedia.org, finance.yahoo.com, yahoo.com, 247wallst.com, bloomberg.com, decrypt.co, techcrunch.com, cnbc.com, benzinga.com, icij.org, crypto.news, minnpost.com, infobytes.orrick.com, bitcoinatm.news, cointimeatm.com, pro.stateaffairs.com, techmeme.com, westernmassnews.com