On April 13, Kentucky enacted SB 189, establishing a comprehensive regulatory framework governing virtual currency kiosk operators. The law requires operators to obtain a license from the state’s Department of Financial Institutions (DFI) before conducting business in the state, though state- and federally-chartered banks, credit unions, and their subsidiaries and affiliates are exempt. It imposes transaction limits of $2,000 per day per user, with a separate $10,500 limit for new users during their first 30 days, and caps kiosk charges at the greater of $5 or 18 percent of the transaction’s value. Applicants must submit detailed financial, background and operational disclosures, and each operator must maintain a surety bond, and evidence of a minimum net worth, of at least $500,000.

Operators must verify user identity with a government-issued ID before accepting payment and are required to implement strict anti-fraud and anti-money laundering protocols in compliance with the BSA/AML, including the use of blockchain analytics and tracing software, identity verification procedures, and customer disclosures regarding risks, refund policies, and transaction limits. Under the law, operators must provide refunds for fraudulent transactions if users submit proof, such as a police report or sworn statement, within 90 days, and a victim’s refund eligibility cannot be waived by any required disclosure. DFI may levy civil penalties of $1,000 to $5,000 per violation and may enforce compliance through civil actions, administrative hearings, and emergency orders. The law deems violations by kiosk operators and agents as unfair trade practices under KRS 367.170, subjecting violators to the attorney general’s enforcement authority and remedies under the Consumer Protection Act. The law takes effect April 30, 2027.