SB189 creates a new licensing and regulatory framework for virtual currency kiosks, commonly known as crypto ATMs, in Kentucky. It prohibits anyone from owning, operating, advertising, soliciting, marketing, or facilitating a kiosk in the state unless licensed by the commissioner of the Department of Financial Institutions. The bill defines key terms, sets out an application and renewal process, and requires extensive disclosures about ownership, business history, financial condition, criminal and regulatory background, insurance, and compliance systems.
The bill also imposes ongoing operational requirements on licensees. These include maintaining a surety bond and minimum tangible net worth, reporting quarterly and annually, keeping detailed transaction and customer records, using blockchain analytics software, and adopting written anti-fraud, cybersecurity, AML, and enhanced due diligence policies. It limits daily customer transactions to $3,000, requires a 72-hour waiting period or cancellation/refund option, mandates prominent scam-warning signage, and requires receipts and disclosures explaining fees, risks, and the irreversibility of virtual currency transactions.
SB189 gives the commissioner broad supervisory and enforcement authority, including examinations, subpoenas, emergency orders, cease-and-desist orders, license denial, suspension, revocation, civil penalties, and orders for refunds or other remedies. It also creates confidentiality protections for regulatory materials, allows information-sharing with other regulators and law enforcement, and requires an annual report to the legislature on licensing activity and fees. The act takes effect March 31, 2027, and directs the commissioner to promulgate implementing regulations by January 1, 2027.
The bill’s impact on state law is substantial because it adds a new subtitle to KRS Chapter 286 and establishes a comprehensive state regime for digital asset kiosk businesses. It affects kiosk operators, applicants, owners, managers, and controlling persons by imposing licensing, financial, reporting, and consumer-protection obligations, while also giving the state a structured enforcement and examination process. It also interacts with existing money transmission and financial-services regulation by requiring disclosures, background checks, and compliance measures similar to those used in other regulated financial industries.
The overall sentiment reflected in the voting history appears strongly favorable and bipartisan, with overwhelming support in both chambers and no recorded committee opposition in the provided materials. The bill’s consumer-protection focus suggests broad agreement on the need to address fraud, scams, and money-laundering risks associated with crypto ATMs. The main points of potential contention are the breadth of regulatory control, the cost and burden of licensing and bonding requirements, the $3,000 daily transaction cap, the 72-hour delay/refund rule, and the commissioner’s authority to require additional conditions or emergency action.
SB189 amends Kentucky law by creating a new regulatory subtitle in KRS Chapter 286 governing virtual currency kiosks. It establishes a licensing system administered by the commissioner of the Department of Financial Institutions, requires detailed applications and renewals, mandates surety bonds and minimum tangible net worth, and authorizes examinations, reporting, enforcement actions, and penalties. The bill also imposes consumer-protection rules, transaction limits, disclosure requirements, recordkeeping duties, and anti-fraud and cybersecurity compliance obligations on kiosk operators and related persons.
The likely areas of contention are the scope and cost of regulation rather than the need for regulation itself. Operators may object to the licensing burden, extensive disclosure and reporting requirements, mandatory blockchain analytics, surety bond and net worth thresholds, and the $3,000 daily transaction cap paired with a 72-hour delay or refund requirement. The commissioner’s broad discretion to impose additional conditions, require more information, and use emergency enforcement tools could also be seen as a point of concern for industry stakeholders.