Illinois enacts two new consumer protection laws regulating digital assets
On August 18, Governor Pritzker of Illinois announced he had signed two comprehensive pieces of consumer protection legislation: The Digital Assets and Consumer Protection Act, which will regulate digital asset companies; and the Digital Asset Kiosks Act, which will regulate cryptoasset kiosk operators. In the press release, Governor Pritzker stated the laws “create first-of-their-kind safeguards in the Midwest for cryptocurrency and other digital assets,” and noted that according to the FBI, Illinois consumers lost $272 million in fraud cases involving cryptocurrency in 2024.
Digital Assets and Consumer Protection Act
The Digital Assets and Consumer Protection Act establishes a framework to regulate digital assets in the state. The statute designates the Illinois Department of Financial and Professional Regulation (DFPR) as the primary regulator, granting it oversight authority of entities engaging in “digital asset business transactions,” which are defined to include exchanging, transferring, or storing a digital asset on behalf of a consumer or engaging in digital asset administration, with Illinois residents. The definition excludes:
- peer-to-peer exchanges or transfers of digital assets;
- decentralized exchanges facilitating peer-to-peer exchanges or transfers solely through the use of a computer program or transaction protocol that is intended to automatically execute, control or document events and actions;
- the development, publication or dissemination of software;
- the issuance of a non-fungible token; or
- validating a digital asset transaction or operating a node in a blockchain system.
The Act further excludes “the exchange, transfer, or storage of a digital asset or to digital asset administration” to the extent that: (A) the Securities Exchange Act of 1934 or the Illinois Securities Law govern the activity as a security transaction and the activity is regulated by the SEC or the Illinois Secretary of State; or (B) the Commodity Exchange Act governs the activity, the activity is in connection with trading of a contract of sale of a commodity for future delivery, an option on such a contract or a swap, and the activity is regulated by the CFTC. There are additional exclusions, including federally insured depository institutions.
Among other requirements, the new law requires covered persons to register with the DFPR, and provide detailed customer disclosures, including fee schedules, information regarding insurance coverage, and descriptions of customers’ error resolution and transfer revocation rights. The DFPR may examine covered businesses at any time, whether they are primarily located inside or outside Illinois, to assess financial condition, management policies, and legal compliance.
Existing digital asset businesses in which covered persons are operating without registration will not be considered in violation of registration requirements until July 1, 2027. The law permits the Department to offer conditional registrations to applicants who hold either a virtual currency business activity registration or a virtual currency business charter in New York State. Provisions related to customer disclosures, asset custody, and customer service take effect January 1, 2027, while covered exchanges have until January 1, 2027, to comply with new listing and certification requirements.
Digital Asset Kiosks Act
The Digital Asset Kiosks Act establishes new regulatory requirements for digital asset kiosk operators to address fraud and scams at kiosks and ATMs. The Act defines a “digital asset kiosk operator” as a person who owns, operates or manages “an automated teller machine that facilitates the buying, selling, or exchanging of digital assets for fiat currency or other digital assets.” Operators with such kiosks within Illinois are required to register with the DFPR. The Act authorizes the DFPR to investigate complaints, conduct examinations, and enforce compliance through written orders and hearings. Upon written notice, the Secretary may suspend or revoke registrations if violations are found and may issue cease and desist orders against unregistered operators.
Under the new law, operators are prohibited from accepting or dispensing more than $2,500 per day to new customers or more than $10,500 per day to existing customers. Charges per transactions are capped at either $5 or 18 percent — whichever is greater. The statute also mandates operators must provide full refunds for up to three fraudulent transactions to new customers within a period no more than seven days after the customer opens an account with the operator. Existing customers may also request refunds of all charges for fraudulent transactions under similar conditions. Operators already in operation as of the effective date are not required to register until July 1, 2027.