Ala. Code § 8-7A-28 (2026) – Cryptocurrency Fraud Prevention Act.

(a) This section shall be known and may be cited as the Cryptocurrency Kiosk Fraud Prevention Act.
(b) For purposes of this section, the following terms have the following meanings:
1. (1) BLOCKCHAIN ANALYTICS. Analysis of data from blockchains or publicly distributed ledgers, including associated transaction information.
2. (2) BLOCKCHAIN ANALYTICS AND TRACING SOFTWARE. A software service that uses blockchain analytics data to provide risk-specific information and tracing of virtual currency wallet addresses, among other virtual items.
3. (3) CONSUMER. Any individual who uses a cryptocurrency kiosk.
4. (4) CRYPTOCURRENCY. A virtual representation of value or rights that can be transferred, stored, or traded electronically and used for payments or investment purposes.
5. (5) CRYPTOCURRENCY ADDRESS. An alphanumeric identifier that represents a potential destination for a cryptocurrency transfer. A cryptocurrency address is associated with a virtual wallet.
6. (6) CRYPTOCURRENCY KIOSK. A physical, electronic terminal that is a mechanical agent of the cryptocurrency kiosk operator and that enables a cryptocurrency kiosk operator to facilitate the purchase, sale, or exchange of cryptocurrency for money, bank credit, or other cryptocurrency.
7. (7) EXISTING CONSUMER. Any consumer who engages in a cryptocurrency kiosk transaction that is not the consumer’s initial transaction or within the 30-day period immediately following his or her initial transaction.
8. (8) FEE. A charge or expense paid by the consumer.
9. (9) FINANCIAL INSTITUTION. Any bank, savings and loan association, or credit union operating in Alabama which is chartered under federal or state statutes.
10. (10) NEW CONSUMER. A consumer who is engaging in a transaction at a cryptocurrency kiosk in this state for the first time or who is within the 30-day period immediately after engaging in his or her first cryptocurrency kiosk transaction.
11. (11) OPERATOR. Any person that engages in cryptocurrency business activity through a cryptocurrency kiosk located in Alabama or operates or manages a cryptocurrency kiosk.
12. (12) PRIVACY COIN. A cryptocurrency with privacy-enhancing features designed to increase anonymity and reduce or eliminate the ability for the cryptocurrency to be traced using blockchain analytics and tracing software.
13. (13) TRANSACTION. A transaction conducted or performed through a cryptocurrency kiosk to purchase or sell cryptocurrency.
14. (14) TRANSACTION HASH. A unique identifier consisting of a string of characters which acts as a record of and provides proof that the transaction was verified and added to the blockchain.
15. (15) VIRTUAL WALLET. A software application or other electronic mechanism that provides a means to hold, store, or transfer cryptocurrency or nonfungible tokens.
(c)
1. (1) A cryptocurrency kiosk operator shall disclose in a clear and conspicuous manner all relevant terms and conditions to use the products, services, kiosks, and other activities of the operator. The operator shall receive an acknowledgment of receipt of all disclosures required from a consumer through confirmation or consent. This disclosure shall include:
  1. a. The United States dollar amount of the cryptocurrency involved in the transaction;
  2. b. A listing, in United States dollars, of all fees to be collected by the cryptocurrency kiosk operator;
  3. c. The total amount, in both the cryptocurrency and United States dollars, used in the transaction; and
  4. d. The exchange rate clearly showing the difference between the market price of the cryptocurrency and the price of the cryptocurrency charged to the consumer.
2. (2)
  1. a. At the beginning of a transaction at a cryptocurrency kiosk, the operator shall ensure that the kiosk displays the following disclosures:
    1. 1. COMMUNICATION INITIATED BY SOMEONE STARTING A ROMANTIC RELATIONSHIP WHO BEGINS ASKING FOR FUNDS FOR REASONS SUCH AS AN EMERGENCY OR TO PAY TO VISIT YOU.
    2. 2. PROMPTS TO CLICK ON DESKTOP POP-UPS THAT INCLUDE VIRUS WARNINGS OR COMMUNICATIONS FROM ALLEGED FAMILIAR MERCHANTS.
    3. 3. COMMUNICATIONS FROM SOMEONE IMPERSONATING A REPRESENTATIVE OF YOUR BANK OR A LAW ENFORCEMENT OFFICER.
    4. 4. CLAIMS OF A FROZEN BANK ACCOUNT OR CREDIT CARD.
    5. 5. CLAIMS OF A FRAUDULENT BANK TRANSACTION.
    6. 6. CLAIMS OF IDENTITY THEFT OR AN OFFER OF EMPLOYMENT IN EXCHANGE FOR PAYMENT.
    7. 7. REQUESTS FOR A PAYMENT TO A GOVERNMENT AGENCY OR COMPANY.
    8. 8. REQUESTS FOR DISASTER RELIEF DONATIONS OR LOANS.
    9. 9. OFFERS TO PURCHASE LOTTERY TICKETS, SWEEPSTAKES, OR DRAWINGS FOR VEHICLES.
    10. 10. CLAIMS OF WINNING A LOTTERY BUT REQUIRES UP-FRONT FEES TO BE PAID BEFORE COLLECTING ANY WINNINGS.
    11. 11. COMMUNICATION FROM SOMEONE OFFERING TO TEACH YOU HOW TO TRADE CRYPTOCURRENCY.
      IF YOU BELIEVE THAT YOU ARE A VICTIM OF FRAUDULENT CONDUCT, STOP AND CALL YOUR LOCAL LAW ENFORCEMENT AGENCY AND THE CRYPTOCURRENCY KIOSK OPERATOR.”
      “WARNING: LOSSES DUE TO FRAUDULENT OR ACCIDENTAL TRANSACTIONS MAY NOT BE RECOVERABLE. TRANSACTIONS IN CRYPTOCURRENCY ARE IRREVERSIBLE. PEOPLE MAY USE CRYPTOCURRENCY TRANSACTIONS TO STEAL YOUR MONEY BY IMPERSONATING THE GOVERNMENT, ORGANIZATIONS, OR PEOPLE YOU KNOW. IMPERSONATORS MAY THREATEN JAIL TIME, CLAIM YOUR IDENTITY HAS BEEN STOLEN, ALLEGE THAT YOUR COMPUTER HAS BEEN HACKED, OR USE A NUMBER OF OTHER SCAMS. DO NOT DISCLOSE YOUR PRIVATE KEY THAT IS ASSOCIATED WITH YOUR VIRTUAL WALLET TO A THIRD PARTY. IF YOU BELIEVE THAT YOU ARE BEING SCAMMED, STOP AND CALL YOUR LOCAL LAW ENFORCEMENT AGENCY AND THE CRYPTOCURRENCY KIOSK OPERATOR.”
    “WARNING: CONSUMER FRAUD OFTEN STARTS WITH CONTACT FROM A STRANGER ONLINE, BY PHONE, OR BY TEXT WHO IS INITIATING A DISHONEST SCHEME OR CRIMINAL OR FRAUDULENT ACTIVITY THAT MAY APPEAR IN MANY FORMS, INCLUDING THE FOLLOWING:
  2. b. The kiosk shall display the disclosures in a conspicuous font and a color that contrasts with the background of the kiosk screen.
  3. c. Each disclosure shall appear separately on the kiosk, and both disclosures must be accepted by the consumer before the transaction may be executed.
(d) At the completion of each transaction, the operator shall provide the consumer who made the transaction a physical or digital receipt that contains all of the following information:
1. (1) The operator’s name and contact information, including a telephone number to answer questions and register complaints.
2. (2) The type, value, date, and precise time of a transaction, and each applicable receiving cryptocurrency address in its entirety. If a digital receipt is selected, the operator shall provide the entire transaction hash in addition to the aforementioned items.
3. (3) The name and contact information of the sender.
4. (4) The name and contact information of the designated recipient if known.
5. (5) Fees charged by the operator.
6. (6) The exchange rate of the applicable cryptocurrency to the United States dollar.
7. (7) A statement of the operator’s refund policy.
8. (8) A statement of the refund policy required by this section.
9. (9) Any additional information required by rule or order of the commission under this chapter.
(e) If a consumer opts for a digital receipt pursuant to subsection (d), the operator shall provide the receipt to the email address or phone number provided by the consumer and to the commission.
(f)
1. (1) A cryptocurrency kiosk operator shall use blockchain analytics and tracing software to prevent any transaction that involves a cryptocurrency address identified as being associated or affiliated with fraud or other criminal activity. If a consumer attempts to transact with a virtual wallet that is detected to be associated or affiliated with fraud or other criminal activity, the kiosk shall not execute the transaction.
2. (2)
  1. a. For a new consumer, an operator shall not accept transactions of more than one thousand United States dollars ($1,000) in cash, or the equivalent amount of foreign currency or cryptocurrency, in one calendar day, or ten thousand United States dollars ($10,000) in cash, or the equivalent amount of foreign currency or cryptocurrency in a calendar month, from the same consumer, regardless of whether the consumer uses one or multiple kiosks in the state.
  2. b. For an existing consumer, an operator shall not accept transactions of more than ten thousand five hundred United States dollars ($10,500) in cash, or the equivalent amount of foreign currency or cryptocurrency, in one calendar day.
  3. c. An operator shall use an identification verification process, operated in accordance with federal law, to verify the identity of every consumer for each transaction in order to comply with this subsection for all transactions.
(g) An operator shall provide enhanced due diligence protections for consumers who are 60 years of age or older. The commission shall adopt rules, pursuant to Section 8-7A-26, to implement this requirement.
(h) All operators headquartered in the United States shall provide live, United States-based, toll-free consumer service at all times. Operators shall prominently display the consumer service phone number on the cryptocurrency kiosk or on the kiosk screen during the transaction. The operator shall report all calls from consumers in Alabama regarding fraud to the commission upon request of the commission.
(i)
1. (1) Operators shall provide a United States phone number and email address to serve as a dedicated communication line between the operator and relevant government agencies. This dedicated line shall be frequently monitored and used to facilitate law enforcement and regulatory agency communications with the operator.
2. (2) At the request of the commission, an operator shall provide the requesting agency with data from the operator’s blockchain analytics and tracing software or any other information regarding that data.
(j)
1. (1)
  1. a. If a new consumer has been fraudulently induced to engage in a cryptocurrency kiosk transaction and has completed the requirements of subdivision (2), the operator shall issue a full refund for the fraudulently induced transaction, as well as all fees incurred through the transaction.
  2. b. If an existing consumer has been fraudulently induced to engage in a cryptocurrency kiosk transaction and has completed the requirements of subdivision (2), the operator shall issue a refund for one-half of the value of the transaction, including all fees incurred through the transaction.
2. (2) The consumer shall complete all of the following to receive the refund pursuant to subdivision (1):
  1. a. Contact the operator not more than 60 calendar days after the cryptocurrency kiosk transaction.
  2. b. Contact a law enforcement agency, as well as the commission, not more than 60 calendar days after the transaction.
  3. c. File a report with a law enforcement agency or the commission regarding the fraudulently induced transaction.
3. (3) A consumer who has been determined to be a victim of fraud is eligible to receive a refund regardless of whether an operator provided the disclosures prescribed in subsection (c) and the receipt required in subsection (d).
4. (4) An operator shall maintain a report of all refund requests made. The operator shall provide to the commission the name and contact information of the consumer who made the request, as well as the information on the receipt, upon request of the commission.
(k) An operator shall not share a kiosk with any financial institution and shall not use any signage that makes the cryptocurrency kiosk appear to be affiliated with or represented by any financial institution.
(l) An operator shall comply with all federal reporting requirements under the Bank Secrecy Act of 1970, Pub. L. No. 91-508, the USA PATRIOT Act, Pub. L. No. 107-56, and any other reporting requirement imposed from the Financial Crimes Enforcement Network or the Office of Foreign Assets Control.
(m) An operator shall not permit the buying, selling, or sending of privacy coins from cryptocurrency kiosks or online platforms in any capacity.
(n)
1. (1) The commission, pursuant to Section 8-7A-19, may assess a civil penalty against a person that violates this section or a rule adopted or an order issued under this section.
2. (2) Any proceeding under this section pursued by the commission shall not preempt any criminal action or civil liability that may arise under any other state law.

(Act 2026-369, §1.)