Adds to existing law to establish the Virtual Currency Kiosk Fraud Prevention Act.

LEGISLATURE OF THE STATE OF IDAHO Sixty-eighth Legislature Second Regular Session - 2026 IN THE SENATE SENATE BILL NO. 1359 BY STATE AFFAIRS COMMITTEE AN ACT1 RELATING TO THE VIRTUAL CURRENCY KIOSK FRAUD PREVENTION ACT; AMENDING TITLE2 28, IDAHO CODE, BY THE ADDITION OF A NEW CHAPTER 54, TITLE 28, IDAHO3 CODE, TO PROVIDE A SHORT TITLE, TO DEFINE TERMS, TO ESTABLISH A LICENS-4 ING REQUIREMENT, TO ESTABLISH REPORTING REQUIREMENTS, TO PROVIDE FOR5 MANDATORY DISCLOSURES, TO ESTABLISH CUSTOMER SERVICE REQUIREMENTS,6 TO PROVIDE FOR TRANSACTION RECEIPTS, TO PROVIDE FOR THE PREVENTION OF7 FRAUDULENT ACTIVITY AND MONEY LAUNDERING, TO PROVIDE FOR REFUNDS, TO8 PROVIDE FOR PENALTIES, TO PROVIDE FOR INFORMATION-SHARING RELATED TO9 VIRTUAL CURRENCY KIOSK FRAUD, AND TO PROVIDE FOR CHAPTER APPLICABILITY;10 AND DECLARING AN EMERGENCY AND PROVIDING AN EFFECTIVE DATE.11

Be It Enacted by the Legislature of the State of Idaho:12

SECTION 1. That Title 28, Idaho Code, be, and the same is hereby amended13 by the addition thereto of a NEW CHAPTER, to be known and designated as Chap-14 ter 54, Title 28, Idaho Code, and to read as follows:15 CHAPTER 5416 VIRTUAL CURRENCY KIOSK FRAUD PREVENTION ACT17 28-5401. SHORT TITLE. This act shall be known and may be cited as the18 "Virtual Currency Kiosk Fraud Prevention Act."19 28-5402. DEFINITIONS. For the purposes of this chapter:20 (1) "Blockchain analytics" means the analysis of data from blockchains21 or public distributed ledgers, including associated transaction informa-22 tion.23 (2) "Blockchain analytics and tracing software" means a software ser-24 vice that uses blockchain analytics data to provide risk-specific informa-25 tion and tracing of virtual currency wallet addresses.26 (3) "Department" means the Idaho department of finance.27 (4) "Fraud" or "fraudulent" means an intentional deception or misrep-28 resentation made by a person with the knowledge that the deception could re-29 sult in some unauthorized benefit to himself or some other person.30 (5) "New customer" means a user who is transacting with an operator:31 (a) For the first time; or32 (b) Within seventy-two (72) hours after such user's first transaction33 with the operator.34 (6)(a) "Operator" means a person who owns, operates, or manages a vir-35 tual currency kiosk located in the United States or in any United States36 territory.37 (b) "Operator" does not include a bank or credit union that solely pro-38 vides services to supply a virtual currency kiosk with legal tender or39

2 that provides deposit services for legal tender deposited in a virtual1 currency kiosk.2 (7) "Potentially vulnerable older adult" means a person sixty-five3 (65) years of age or older who is unable to protect himself from maltreatment4 because of:5 (a) A mental, physical, or developmental disability;6 (b) A degenerative brain disease;7 (c) An inability to communicate or implement decisions regarding his8 person; or9 (d) Other infirmities of aging in an older adult.10 (8) "Transaction fees" means fees or expenses paid by a user in order11 to conduct a virtual currency kiosk transaction. Transaction fees equal the12 difference between the market price of the virtual currency and the price of13 the virtual currency charged to the user.14 (9) "Transaction hash" means the unique alphanumeric identifier as-15 signed to a virtual currency kiosk transaction.16 (10) "User" means any individual or entity that initiates, authorizes,17 or completes a transaction involving virtual currency through a virtual cur-18 rency kiosk, whether for the purpose of purchasing, selling, transferring,19 or otherwise exchanging virtual currency.20 (11) "Virtual currency" means a type of digital asset, as defined in21 section 28-5303, Idaho Code, that confers economic, proprietary, or access22 rights or powers and is recorded using cryptographically secured dis-23 tributed ledger technology or any similar analogue.24 (12) "Virtual currency address" means an alphanumeric identifier asso-25 ciated with a virtual currency wallet identifying the location to which a26 virtual currency transaction can be sent.27 (13) "Virtual currency kiosk" means a stand-alone machine that is ca-28 pable of accepting or dispensing legal tender in exchange for virtual cur-29 rency.30 (14) "Virtual currency kiosk transaction" means a transaction con-31 ducted or performed, in whole or in part, by electronic means via a virtual32 currency kiosk. Virtual currency kiosk transaction also means a transaction33 made at a virtual currency kiosk to purchase virtual currency with or to sell34 virtual currency for United States dollars.35 (15) "Virtual currency wallet" means a software application or other36 mechanism providing a means to hold the keys necessary to access and transfer37 virtual currency.38 28-5403. OPERATOR LICENSING REQUIREMENT. In order for an operator to39 engage in or hold itself out as being able to engage in a virtual currency40 kiosk transaction, such operator must be a licensed money transmitter pur-41 suant to the provisions of chapter 29, title 26, Idaho Code.42 28-5404. OPERATOR REPORTING REQUIREMENTS. (1) An operator shall com-43 plete, collect, and maintain quarterly reports and any supporting records44 for each virtual currency kiosk that it operates in Idaho. Such reports and45 records shall be made available to the department, upon request, in a format46 specified by the department, within three (3) business days of such request.47

3 Reports pursuant to this subsection shall include, at a minimum, the follow-1 ing information:2 (a) The operator's legal name;3 (b) Any fictitious or trade name used by the operator, if applicable;4 (c) The operator's physical address;5 (d) The date the operator commenced operation of the virtual currency6 kiosk at the location;7 (e) The date the operator ceased operation of the virtual currency8 kiosk at the location, if applicable;9 (f) Each address used by the operator to provide customer service in10 Idaho; and11 (g) The number of transactions that the operator declined due to suspi-12 cion of fraud or other illegal activity.13 (2) An operator shall complete, collect, and maintain annual reports14 and any supporting records for each virtual currency kiosk it operates in15 Idaho, to be completed on or before March 31, relating to the operator's16 business conducted in the prior year. Such reports and records shall be made17 available to the department, upon request, in a format specified by the de-18 partment, within three (3) business days of such request. A report pursuant19 to this subsection shall be on a form prescribed by the department and shall20 include, at a minimum:21 (a) Gross revenue attributable to virtual currency transactions con-22 ducted via virtual currency kiosks in the state;23 (b) A copy of any complaint filed against the operator with the bet-24 ter business bureau, with any state agency other than the department, or25 with any federal agency, and a description of the resolution, if any, of26 each such complaint;27 (c) The total number and value of virtual currency transactions con-28 ducted via the operator's virtual currency kiosks in the state;29 (d) The total number of refunds requested by users, the number of refund30 requests granted and the number of refund requests denied by the opera-31 tor, and the total dollar amount of such refunds;32 (e) Contact details of the operator's compliance officer;33 (f) A dedicated United States phone number and email address for commu-34 nications with government fraud investigators and law enforcement; and35 (g) The total number of virtual currency corresponding locations.36 (3) The phone number and email address required pursuant to subsection37 (2)(f) of this section shall be frequently monitored. Upon request from law38 enforcement or the department, a virtual currency kiosk operator shall pro-39 vide trace findings and grant assistance with blockchain analytics for in-40 vestigative purposes.41 (4) Within ten (10) business days after receipt of a request from the42 department, the virtual currency kiosk operator shall provide any transac-43 tion and user information requested by the department, including with re-44 spect to any transactions attempted but denied.45 (5) Transaction data collected by the department pursuant to this sec-46 tion shall be confidential and may be released only in composite form, unless47 otherwise required by law.48

4 (6) Failure to complete, collect, or maintain a report or record as re-1 quired pursuant to this section, or to timely provide such reports or records2 to the department, shall constitute a violation of this chapter.3 28-5405. MANDATORY DISCLOSURES. (1) An operator shall disclose all4 relevant terms and conditions generally associated with the products, ser-5 vices, and activities of the operator and virtual currency, including but6 not limited to transaction fees collected and exchange rates used. Such dis-7 closures shall be made in a clear, conspicuous, and easily readable manner in8 the language chosen by the user.9 (2) A user who engages with a virtual currency kiosk shall receive ac-10 knowledgment of receipt of all disclosures required under this section via11 confirmation of consent at such virtual currency kiosk.12 (3) The disclosures required by this section shall address the follow-13 ing in substantially the following form:14 WARNING: this technology can be used to defraud you.15 If someone asked you to deposit money in this machine and/or is on the16 phone with you and claims to be a:17 Friend or family member,18 Government agent,19 Computer software representative,20 Bill collector,21 Law enforcement officer, or22 A person whom you do not know...23 STOP THIS TRANSACTION IMMEDIATELY, contact law enforcement, and notify24 the kiosk operator.25 This may be a scam. NEVER SEND MONEY TO SOMEONE YOU DO NOT KNOW.26 (4) The material risks associated with virtual currency and virtual27 currency transactions shall be disclosed to each user of a virtual currency28 kiosk in Idaho. Such disclosures shall be accompanied by information that29 may be used by a user to seek assistance, including:30 (a) The name, address, and telephone number of the operator;31 (b) The days and times the operator is available and the methods that a32 user may use to contact the operator for assistance; and33 (c) The contact information for state and local law enforcement, which34 shall be displayed on or at the location of the virtual currency kiosk or35 on the first screen of such kiosk.36 28-5406. CUSTOMER SERVICE REQUIREMENTS. (1) An operator shall provide37 live customer service at a toll-free number seven (7) days a week. Daily38 business hours shall be from, at a minimum, 8:00 a.m. to 8:00 p.m. local time39 for all Idaho locations where the operator's virtual currency kiosks are lo-40 cated.41

5 (2) Trained representatives of an operator shall be available to re-1 spond to customer telephone inquiries during the business hours required2 pursuant to this section.3 (3) Inquiries received after normal business hours shall be responded4 to by a trained representative on the next business day.5 28-5407. TRANSACTION RECEIPTS. (1) An operator shall provide each6 user with paper or electronic receipts at the conclusion of each virtual7 currency kiosk transaction.8 (2) A receipt required pursuant to this section shall include the fol-9 lowing information:10 (a) The operator's name and toll-free customer service phone number11 with operating hours;12 (b) Relevant contact information for the operator, state and local law13 enforcement, and the department;14 (c) Type, value, date, and precise time of the transaction and each ap-15 plicable virtual currency address and transaction hash;16 (d) All transaction fees;17 (e) The exchange rate of the virtual currency to U.S. dollars; and18 (f) The virtual currency kiosk operator's refund policy.19 28-5408. PREVENTION OF FRAUDULENT ACTIVITY AND MONEY LAUNDERING. (1)20 An operator shall take reasonable steps to detect and prevent fraud and money21 laundering. This shall include:22 (a) Establishing and maintaining a written anti-fraud policy;23 (b) Using blockchain analytics and tracing software to assist in the24 prevention of sending virtual currency to a virtual currency wallet25 known or likely to be affiliated with fraudulent activity at the time of26 a transaction and to detect transaction patterns indicative of fraud or27 other illicit activities;28 (c) Blocking transactions to virtual currency wallets associated29 with overseas exchanges non-accessible for users located in the United30 States;31 (d) Not accepting from or dispensing to a new customer an amount that32 is more than two thousand dollars ($2,000) in United States currency,33 or its equivalent in virtual currency, during any twenty-four (24) hour34 period;35 (e) Ensuring that during the thirty (30) calendar days following a new36 customer's first transaction, the cumulative total of all transactions37 with an operator shall not exceed ten thousand dollars ($10,000) in U.S.38 currency or its equivalent in virtual currency; and39 (f) Implementing the following protections for new customers:40 (i) Delaying settlement of a new customer's first virtual cur-41 rency kiosk transaction for seventy-two (72) hours; and42 (ii) Allowing, upon request, for the full refund of any fraudulent43 virtual currency kiosk transaction experienced by a new customer44 within seventy-two (72) hours after such transaction, if such45 user:46

6 1. Contacts the operator in writing to provide notice of the1 fraudulent nature of the virtual currency kiosk transac-2 tion; and3 2. Files a report with a government or law enforcement4 agency memorializing the fraudulent nature of the virtual5 currency kiosk transaction.6 (2) A refund pursuant to subsection (1)(f) this section shall include7 all transaction fees paid by a new customer at the time of the transaction and8 shall occur within ten (10) business days after such new customer provides9 notice of a fraudulent virtual currency transaction. A refund pursuant to10 this section shall be paid to a user in the user's originating currency.11 (3) The transaction limits and protections provided for in this sec-12 tion shall apply to all virtual currency transactions offered by an operator13 through a virtual currency kiosk and any kiosks affiliated with such opera-14 tor. Operators shall not use alternative methods, including but not limited15 to online portals, affiliated kiosks, or over-the-counter transactions, to16 evade or exceed the limits provided for in this section.17 (4) The department may request evidence from any virtual currency kiosk18 operator of its current use of blockchain analytics as part of the operator's19 registration and maintenance of a money transmitter license.20 (5) An operator shall provide notice to users regarding the delayed21 settlement or refund provisions of this section, including contact informa-22 tion to report a fraudulent transaction in writing.23 28-5409. TRANSACTION FEE REFUNDS. (1) Subject to the requirements of24 this section, an operator shall issue a refund of all transaction fees paid25 by a user at the time of a transaction if such user experiences fraud with re-26 spect to such transaction. Such refund shall be issued notwithstanding any27 acknowledgment that a user may have made prior to finalizing such transac-28 tion.29 (2) A user who seeks a refund pursuant to the provisions of this section30 shall:31 (a) Have engaged in a transaction or transactions involving the virtual32 currency kiosk that were affected by fraud, whether authorized or unau-33 thorized;34 (b) Contact the virtual currency kiosk operator to inform the opera-35 tor of the fraudulent nature of the transaction or transactions at issue36 within thirty (30) days after the last transaction to occur or becoming37 aware of the theft; and38 (c) Within thirty (30) days after contacting the virtual kiosk opera-39 tor, submit a police report, government agency report, or a sworn state-40 ment detailing the fraudulent nature of the transaction or transactions41 and provide a copy to the virtual currency kiosk operator.42 (3) If conditions for refund issuance pursuant to this section are met,43 an operator shall issue a full refund of transaction fees within ten (10)44 business days after receiving notice from a user and receiving a copy of the45 police report, government agency report, or sworn statement.46 (4) A refund pursuant to this section shall be paid to a user in the47 user's originating currency.48

7 (5) The refund available pursuant to this section is distinct from the1 refund available to protect new customers pursuant to section 28-5408, Idaho2 Code, and such refunds shall be exclusive of each other.3 28-5410. PENALTIES. (1) A violation of this chapter shall be deemed an4 unfair and deceptive practice in violation of the Idaho consumer protection5 act, chapter 6, title 48, Idaho Code.6 (2) The attorney general may undertake any and all actions authorized7 by the Idaho consumer protection act to investigate and enforce a violation8 of this chapter.9 (3) A person harmed by a violation of this chapter may initiate a civil10 action and may seek remedies pursuant to section 48-608, Idaho Code.11 (4) In addition to any other penalties:12 (a) An operator who violates this chapter shall be subject to revoca-13 tion of such operator's money transmitter licensure pursuant to the14 provisions of chapter 29, title 26, Idaho Code; and15 (b) An operator who willfully and knowingly violates this chapter shall16 be guilty of a misdemeanor and, upon conviction, may be sentenced to pay17 a fine not exceeding one thousand dollars ($1,000).18 28-5411. INFORMATION-SHARING RELATED TO VIRTUAL CURRENCY KIOSK19 FRAUD. (1) Notwithstanding any provision of law to the contrary, upon rea-20 sonable suspicion of fraud or financial exploitation involving a virtual21 currency kiosk transaction, the department, the attorney general, any state22 or local law enforcement agency, the Idaho commission on aging, or an adult23 protective services provider may share relevant information relating to24 such suspicion for the purposes of investigation, enforcement, or consumer25 protection.26 (2) If the department is conducting an investigation or becomes aware27 of an ongoing investigation involving suspected fraud or financial ex-28 ploitation related to a virtual currency kiosk transaction, the department29 shall share relevant information with the attorney general and any state or30 local law enforcement agency with jurisdiction and with the Idaho commission31 on aging or an adult protective services provider when the affected individ-32 ual is a potentially vulnerable older adult.33 (3) Information shared pursuant to this section that is confidential or34 exempt from disclosure under chapter 1, title 74, Idaho Code, shall retain35 its confidential status and shall not be subject to public disclosure except36 as otherwise authorized by law.37 (4) Any agency, political subdivision, or employee thereof who acts in38 good faith when sharing information pursuant to this section shall be immune39 from any civil or criminal liability arising from the sharing of such infor-40 mation.41 28-5412. APPLICABILITY. (1) This chapter shall only be construed to42 regulate transactions conducted through a virtual currency kiosk.43 (2) Nothing in this chapter shall apply to online transactions or over-44 the-counter transactions conducted by a virtual currency kiosk owner.45 (3) Nothing in this chapter shall be construed to modify or limit the46 applicability of any other provision of Idaho law, including the Idaho money47

8 transmitters act, to online or over-the-counter transactions conducted by a1 virtual currency kiosk owner outside of a virtual currency kiosk.2

SECTION 2. An emergency existing therefor, which emergency is hereby3 declared to exist, this act shall be in full force and effect on and after4 July 1, 2026.5