Alabama Cryptocurrency Kiosk Fraud Prevention Act

The Act applies to cryptocurrency kiosks located in Alabama and to operators that conduct cryptocurrency business activity through those kiosks. It defines a cryptocurrency kiosk as a physical electronic terminal that enables an operator to facilitate the purchase, sale, or exchange of cryptocurrency for money, bank credit, or other cryptocurrency.

Operators must give clear and conspicuous disclosures before a transaction. Required disclosures include the U.S. dollar amount involved, fees in U.S. dollars, the total transaction amount in both cryptocurrency and U.S. dollars, and the exchange-rate difference between market price and the price charged to the consumer. The kiosk also must display fraud warnings at the beginning of a transaction, and both warnings must be accepted before the transaction may proceed.

At completion, the operator must provide a physical or digital receipt. The receipt must include operator contact information, transaction type, value, date and precise time, receiving cryptocurrency address, fees, exchange rate, and refund-policy information. If a digital receipt is selected, the operator must also provide the transaction hash and send the receipt to the Alabama Securities Commission.

The Act requires operators to use blockchain analytics and tracing software to prevent transactions involving cryptocurrency addresses identified as associated or affiliated with fraud or other criminal activity. If a consumer attempts to transact with a wallet detected as associated with fraud or criminal activity, the kiosk may not execute the transaction.

For new consumers, operators may not accept more than $1,000 in cash, or the equivalent amount of foreign currency or cryptocurrency, in one calendar day, or more than $10,000 in a calendar month. For existing consumers, the daily cap is $10,500. Operators must verify the identity of every consumer for each transaction in accordance with federal law.

Operators must provide enhanced due diligence protections for consumers who are 60 years of age or older, with implementing rules to be adopted by the Alabama Securities Commission. U.S.-headquartered operators must provide live, U.S.-based, toll-free consumer service at all times, display the service number on the kiosk or screen, and provide a frequently monitored U.S. phone number and email address for government-agency communications.

The refund provisions distinguish between new and existing consumers. If a new consumer is fraudulently induced into a kiosk transaction and completes the statutory reporting steps, the operator must issue a full refund plus fees. If an existing consumer completes the same steps, the operator must issue a refund for one-half of the transaction value, including fees. The consumer must contact the operator, law enforcement, and the Alabama Securities Commission within 60 calendar days and file a fraud report.

The Act is specific to Alabama, but it sits within the broader U.S. crypto-kiosk policy landscape. It requires kiosk operators to comply with federal reporting requirements under the Bank Secrecy Act, the USA PATRIOT Act, and reporting requirements imposed by FinCEN or OFAC. It also prohibits operators from permitting the buying, selling, or sending of privacy coins from cryptocurrency kiosks or online platforms.

As of June 4, 2026, HB303 should be treated as enacted but not yet effective. LegiScan lists the bill as enacted on April 8, 2026, while the enrolled Alabama text states that the Act becomes effective October 1, 2026.