Adds to existing law to establish the Virtual Currency Kiosk Fraud Prevention Act.

LEGISLATURE OF THE STATE OF IDAHO Sixty-eighth Legislature Second Regular Session - 2026 IN THE SENATE SENATE BILL NO. 1333 BY STATE AFFAIRS COMMITTEE AN ACT1 RELATING TO THE VIRTUAL CURRENCY KIOSK FRAUD PREVENTION ACT; AMENDING TITLE2 28, IDAHO CODE, BY THE ADDITION OF A NEW CHAPTER 54, TITLE 28, IDAHO3 CODE, TO PROVIDE A SHORT TITLE, TO DEFINE TERMS, TO ESTABLISH A LICENS-4 ING REQUIREMENT, TO ESTABLISH REPORTING REQUIREMENTS, TO PROVIDE FOR5 MANDATORY DISCLOSURES, TO ESTABLISH CUSTOMER SERVICE REQUIREMENTS,6 TO PROVIDE FOR TRANSACTION RECEIPTS, TO PROVIDE FOR THE PREVENTION OF7 FRAUDULENT ACTIVITY AND MONEY LAUNDERING, TO PROVIDE FOR REFUNDS, TO8 PROVIDE FOR PENALTIES, AND TO PROVIDE FOR INFORMATION-SHARING RELATED9 TO VIRTUAL CURRENCY KIOSK FRAUD; AND DECLARING AN EMERGENCY AND PROVID-10 ING AN EFFECTIVE DATE.11

Be It Enacted by the Legislature of the State of Idaho:12

SECTION 1. That Title 28, Idaho Code, be, and the same is hereby amended13 by the addition thereto of a NEW CHAPTER, to be known and designated as Chap-14 ter 54, Title 28, Idaho Code, and to read as follows:15 CHAPTER 5416 VIRTUAL CURRENCY KIOSK FRAUD PREVENTION ACT17 28-5401. SHORT TITLE. This act shall be known and may be cited as the18 "Virtual Currency Kiosk Fraud Prevention Act."19 28-5402. DEFINITIONS. For the purposes of this chapter:20 (1) "Blockchain analytics" means the analysis of data from blockchains21 or public distributed ledgers, including associated transaction informa-22 tion.23 (2) "Blockchain analytics and tracing software" means a software ser-24 vice that uses blockchain analytics data to provide risk-specific informa-25 tion and tracing of virtual currency wallet addresses.26 (3) "Department" means the Idaho department of finance.27 (4) "Fraud" or "fraudulent" means an intentional deception or misrep-28 resentation made by a person with the knowledge that the deception could re-29 sult in some unauthorized benefit to himself or some other person.30 (5) "New customer" means a user who is transacting with an operator:31 (a) For the first time; or32 (b) Within seventy-two (72) hours after such user's first transaction33 with the operator.34 (6) "Operator" means a person who owns, operates, or manages a virtual35 currency kiosk located in the United States or in any United States terri-36 tory.37 (7) "Potentially vulnerable older adult" means a person sixty-five38 (65) years of age or older who is unable to protect himself from maltreatment39 because of:40

2 (a) A mental, physical, or developmental disability;1 (b) A degenerative brain disease;2 (c) An inability to communicate or implement decisions regarding his3 person; or4 (d) Other infirmities of aging in an older adult.5 (8) "Transaction fees" means fees or expenses paid by a user in order6 to conduct a virtual currency kiosk transaction. Transaction fees equal the7 difference between the market price of the virtual currency and the price of8 the virtual currency charged to the user.9 (9) "Transaction hash" means the unique alphanumeric identifier as-10 signed to a virtual currency kiosk transaction.11 (10) "User" means any individual or entity that initiates, authorizes,12 or completes a transaction involving virtual currency through a virtual cur-13 rency kiosk, whether for the purpose of purchasing, selling, transferring,14 or otherwise exchanging virtual currency.15 (11) "Virtual currency" means a type of digital asset, as defined in16 section 28-5303, Idaho Code, that confers economic, proprietary, or access17 rights or powers and is recorded using cryptographically secured dis-18 tributed ledger technology or any similar analogue.19 (12) "Virtual currency address" means an alphanumeric identifier asso-20 ciated with a virtual currency wallet identifying the location to which a21 virtual currency transaction can be sent.22 (13) "Virtual currency kiosk" means a stand-alone machine that is ca-23 pable of accepting or dispensing legal tender in exchange for virtual cur-24 rency.25 (14) "Virtual currency kiosk transaction" means a transaction con-26 ducted or performed, in whole or in part, by electronic means via a virtual27 currency kiosk. Virtual currency kiosk transaction also means a transaction28 made at a virtual currency kiosk to purchase virtual currency with or to sell29 virtual currency for United States dollars.30 (15) "Virtual currency wallet" means a software application or other31 mechanism providing a means to hold the keys necessary to access and transfer32 virtual currency.33 28-5403. OPERATOR LICENSING REQUIREMENT. In order for an operator to34 engage in or hold itself out as being able to engage in a virtual currency35 kiosk transaction, such operator must be a licensed money transmitter pur-36 suant to the provisions of chapter 29, title 26, Idaho Code.37 28-5404. OPERATOR REPORTING REQUIREMENTS. (1) An operator shall com-38 plete, collect, and maintain quarterly reports and any supporting records39 for each virtual currency kiosk that it operates in Idaho. Such reports and40 records shall be made available to the department, upon request, in a format41 specified by the department, within three (3) business days of such request.42 Reports pursuant to this subsection shall include, at a minimum, the follow-43 ing information:44 (a) The operator's legal name;45 (b) Any fictitious or trade name used by the operator, if applicable;46 (c) The operator's physical address;47

3 (d) The date the operator commenced operation of the virtual currency1 kiosk at the location;2 (e) The date the operator ceased operation of the virtual currency3 kiosk at the location, if applicable;4 (f) Each address used by the operator to provide customer service in5 Idaho; and6 (g) The number of transactions that the operator declined due to suspi-7 cion of fraud or other illegal activity.8 (2) An operator shall complete, collect, and maintain annual reports9 and any supporting records for each virtual currency kiosk it operates in10 Idaho, to be completed on or before March 31, relating to the operator's11 business conducted in the prior year. Such reports and records shall be made12 available to the department, upon request, in a format specified by the de-13 partment, within three (3) business days of such request. A report pursuant14 to this subsection shall be on a form prescribed by the department and shall15 include, at a minimum:16 (a) Gross revenue attributable to virtual currency transactions con-17 ducted via virtual currency kiosks in the state;18 (b) A copy of any complaint filed against the operator with the bet-19 ter business bureau, with any state agency other than the department, or20 with any federal agency, and a description of the resolution, if any, of21 each such complaint;22 (c) The total number and value of virtual currency transactions con-23 ducted via the operator's virtual currency kiosks in the state;24 (d) The total number of refunds requested by users, the number of refund25 requests granted and the number of refund requests denied by the opera-26 tor, and the total dollar amount of such refunds;27 (e) Contact details of the operator's compliance officer;28 (f) A dedicated United States phone number and email address for commu-29 nications with government fraud investigators and law enforcement; and30 (g) The total number of virtual currency corresponding locations.31 (3) The phone number and email address required pursuant to subsection32 (2)(f) of this section shall be frequently monitored. Upon request from law33 enforcement or the department, a virtual currency kiosk operator shall pro-34 vide trace findings and grant assistance with blockchain analytics for in-35 vestigative purposes.36 (4) Within ten (10) business days after receipt of a request from the37 department, the virtual currency kiosk operator shall provide any transac-38 tion and user information requested by the department, including with re-39 spect to any transactions attempted but denied.40 (5) Transaction data collected by the department pursuant to this sec-41 tion shall be confidential and may be released only in composite form, unless42 otherwise required by law.43 (6) Failure to complete, collect, or maintain a report or record as re-44 quired pursuant to this section, or to timely provide such reports or records45 to the department, shall constitute a violation of this chapter.46 28-5405. MANDATORY DISCLOSURES. (1) An operator shall disclose all47 relevant terms and conditions generally associated with the products, ser-48 vices, and activities of the operator and virtual currency, including but49

4 not limited to transaction fees collected and exchange rates used. Such dis-1 closures shall be made in a clear, conspicuous, and easily readable manner in2 the language chosen by the user.3 (2) A user who engages with a virtual currency kiosk shall receive ac-4 knowledgment of receipt of all disclosures required under this section via5 confirmation of consent at such virtual currency kiosk.6 (3) The disclosures required by this section shall address the follow-7 ing in substantially the following form:8 WARNING: this technology can be used to defraud you.9 If someone asked you to deposit money in this machine and/or is on the10 phone with you and claims to be a:11 Friend or family member,12 Government agent,13 Computer software representative,14 Bill collector,15 Law enforcement officer, or16 A person whom you do not know...17 STOP THIS TRANSACTION IMMEDIATELY, contact law enforcement, and notify18 the kiosk operator.19 This may be a scam. NEVER SEND MONEY TO SOMEONE YOU DO NOT KNOW.20 (4) The material risks associated with virtual currency and virtual21 currency transactions shall be disclosed to each user of a virtual currency22 kiosk in Idaho. Such disclosures shall be accompanied by information that23 may be used by a user to seek assistance, including:24 (a) The name, address, and telephone number of the operator;25 (b) The days and times the operator is available and the methods that a26 user may use to contact the operator for assistance; and27 (c) The contact information for state and local law enforcement, which28 shall be displayed on or at the location of the virtual currency kiosk or29 on the first screen of such kiosk.30 28-5406. CUSTOMER SERVICE REQUIREMENTS. (1) An operator shall provide31 live customer service at a toll-free number seven (7) days a week. Daily32 business hours shall be from, at a minimum, 8:00 a.m. to 8:00 p.m. local time33 for all Idaho locations where the operator's virtual currency kiosks are lo-34 cated.35 (2) Trained representatives of an operator shall be available to re-36 spond to customer telephone inquiries during the business hours required37 pursuant to this section.38 (3) Inquiries received after normal business hours shall be responded39 to by a trained representative on the next business day.40 28-5407. TRANSACTION RECEIPTS. (1) An operator shall provide each41 user with paper and electronic receipts at the conclusion of each virtual42 currency kiosk transaction.43

5 (2) A receipt required pursuant to this section shall include the fol-1 lowing information:2 (a) The operator's name and toll-free customer service phone number3 with operating hours;4 (b) Relevant contact information for the operator, state and local law5 enforcement, and the department;6 (c) Type, value, date, and precise time of the transaction and each ap-7 plicable virtual currency address and transaction hash;8 (d) All transaction fees;9 (e) The exchange rate of the virtual currency to U.S. dollars; and10 (f) The virtual currency kiosk operator's refund policy.11 28-5408. PREVENTION OF FRAUDULENT ACTIVITY AND MONEY LAUNDERING. (1)12 An operator shall take reasonable steps to detect and prevent fraud and money13 laundering. This shall include:14 (a) Establishing and maintaining a written anti-fraud policy;15 (b) Using blockchain analytics and tracing software to assist in the16 prevention of sending virtual currency to a virtual currency wallet17 known or likely to be affiliated with fraudulent activity at the time of18 a transaction and to detect transaction patterns indicative of fraud or19 other illicit activities;20 (c) Blocking transactions to virtual currency wallets associated21 with overseas exchanges non-accessible for users located in the United22 States;23 (d) Not accepting from or dispensing to a new customer an amount that24 is more than two thousand dollars ($2,000) in United States currency,25 or its equivalent in virtual currency, during any twenty-four (24) hour26 period;27 (e) Ensuring that during the thirty (30) calendar days following a new28 customer's first transaction, the cumulative total of all transactions29 with an operator shall not exceed ten thousand dollars ($10,000) in U.S.30 currency or its equivalent in virtual currency; and31 (f) Implementing the following protections for new customers:32 (i) Delaying settlement of a new customer's first virtual cur-33 rency kiosk transaction for seventy-two (72) hours; and34 (ii) Allowing, upon request, for the full refund of any fraudulent35 virtual currency kiosk transaction experienced by a new customer36 within seventy-two (72) hours after such transaction, if such37 user:38 1. Contacts the operator in writing to provide notice of the39 fraudulent nature of the virtual currency kiosk transac-40 tion; and41 2. Files a report with a government or law enforcement42 agency memorializing the fraudulent nature of the virtual43 currency kiosk transaction.44 (2) A refund pursuant to subsection (1)(f) this section shall include45 all transaction fees paid by a new customer at the time of the transaction46 and shall occur within twenty-one (21) days after such new customer provides47 notice of a fraudulent virtual currency transaction. A refund pursuant to48 this section shall be paid to a user in the user's originating currency.49

6 (3) The transaction limits and protections provided for in this sec-1 tion shall apply to all virtual currency transactions offered by an opera-2 tor through a virtual currency kiosk. Operators shall not use alternative3 methods, including but not limited to online portals, affiliated kiosks, or4 over-the-counter transactions, to evade or exceed the limits provided for in5 this section.6 (4) The department may request evidence from any virtual currency kiosk7 operator of its current use of blockchain analytics as part of the operator's8 registration and maintenance of a money transmitter license.9 (5) An operator shall provide notice to users regarding the delayed10 settlement or refund provisions of this section, including contact informa-11 tion to report a fraudulent transaction in writing.12 28-5409. TRANSACTION FEE REFUNDS. (1) Subject to the requirements of13 this section, an operator shall issue a refund of all transaction fees paid14 by a user at the time of a transaction if such user experiences fraud with re-15 spect to such transaction. Such refund shall be issued notwithstanding any16 acknowledgment that a user may have made prior to finalizing such transac-17 tion.18 (2) A user who seeks a refund pursuant to the provisions of this section19 shall:20 (a) Have engaged in a transaction or transactions involving the virtual21 currency kiosk that were affected by fraud, whether authorized or unau-22 thorized;23 (b) Contact the virtual currency kiosk operator to inform the opera-24 tor of the fraudulent nature of the transaction or transactions at issue25 within thirty (30) days after the last transaction to occur or becoming26 aware of the theft; and27 (c) Within thirty (30) days after contacting the virtual kiosk opera-28 tor, submit a police report, government agency report, or a sworn state-29 ment detailing the fraudulent nature of the transaction or transactions30 and provide a copy to the virtual currency kiosk operator.31 (3) If conditions for refund issuance pursuant to this section are met,32 an operator shall issue a full refund of transaction fees within seventy-two33 (72) hours after receiving notice from a user and receiving a copy of the po-34 lice report, government agency report, or sworn statement.35 (4) A refund pursuant to this section shall be paid to a user in the36 user's originating currency.37 (5) The refund available pursuant to this section is distinct from the38 refund available to protect new customers pursuant to section 28-5408, Idaho39 Code, and such refunds shall be exclusive of each other.40 28-5410. PENALTIES. (1) A violation of this chapter shall be deemed an41 unfair and deceptive practice in violation of the Idaho consumer protection42 act, chapter 6, title 48, Idaho Code.43 (2) The attorney general may undertake any and all actions authorized44 by the Idaho consumer protection act to investigate and enforce a violation45 of this chapter.46 (3) A person harmed by a violation of this chapter may initiate a civil47 action and may seek remedies pursuant to section 48-608, Idaho Code.48

7 (4) In addition to any other penalties:1 (a) An operator who violates this chapter shall be subject to revoca-2 tion of such operator's money transmitter licensure pursuant to the3 provisions of chapter 29, title 26, Idaho Code; and4 (b) An operator who willfully and knowingly violates this chapter shall5 be guilty of a misdemeanor and, upon conviction, may be sentenced to pay6 a fine not exceeding one thousand dollars ($1,000).7 28-5411. INFORMATION-SHARING RELATED TO VIRTUAL CURRENCY KIOSK8 FRAUD. (1) Notwithstanding any provision of law to the contrary, upon rea-9 sonable suspicion of fraud or financial exploitation involving a virtual10 currency kiosk transaction, the department, the attorney general, any state11 or local law enforcement agency, the Idaho commission on aging, or an adult12 protective services provider may share relevant information relating to13 such suspicion for the purposes of investigation, enforcement, or consumer14 protection.15 (2) If the department is conducting an investigation or becomes aware16 of an ongoing investigation involving suspected fraud or financial ex-17 ploitation related to a virtual currency kiosk transaction, the department18 shall share relevant information with the attorney general and any state or19 local law enforcement agency with jurisdiction and with the Idaho commission20 on aging or an adult protective services provider when the affected individ-21 ual is a potentially vulnerable older adult.22 (3) Information shared pursuant to this section that is confidential or23 exempt from disclosure under chapter 1, title 74, Idaho Code, shall retain24 its confidential status and shall not be subject to public disclosure except25 as otherwise authorized by law.26 (4) Any agency, political subdivision, or employee thereof who acts in27 good faith when sharing information pursuant to this section shall be immune28 from any civil or criminal liability arising from the sharing of such infor-29 mation.30

SECTION 2. An emergency existing therefor, which emergency is hereby31 declared to exist, this act shall be in full force and effect on and after32 July 1, 2026.33