On April 9, Kansas enacted HB 2591, an omnibus bill that, among other things, establishes virtual currency kiosk regulations and consumer protections, enables financial institutions under certain circumstances to report suspected financial exploitation, and subjects “earned wage access service registrants” to the Kansas Financial Institutions Information Security Act (previously covered by InfoBytes here).

Effective July 1, the law amends Kansas’ Money Transmission Act to expand the definition of money transmission to include virtual currency kiosk transactions and three-party exchanges involving virtual currency. Among other things, the law requires kiosk operators to disclose “material risks” — including that virtual currency is not legal tender, that transactions may be irreversible, and that the value of virtual currency may be subject to permanent and total loss — prior to initial transactions, display a consumer fraud warning that must be acknowledged before each transaction, and use blockchain analytics software to prevent transfers to digital wallets affiliated with fraudulent activity. Operators must also, among other things, verify user identity via government-issued identification, maintain written anti-fraud and board-approved enhanced due diligence policies, designate a full-time consumer protection officer, and obtain a money transmitter license, with unlicensed operators required to apply within 60 days after July 1.

The law caps charges at the greater of $5 or 18 percent of the transmission amount and sets transaction limits at $1,000 for an initial transaction, up to $1,000 per day and $10,000 total within 14 days of the initial transaction, and up to $10,500 per day thereafter. The law requires a 72-hour holding period for transactions conducted within 14 days of a customer’s initial transaction, during which new customers may request a full refund for any reason, and provides refund rights for existing customers who report fraudulent transmissions within 30 calendar days.

Among other things, the law also: (i) authorizes financial institutions to report suspected financial exploitation of adult account holders to a designated agency, notify a trusted contact and place a temporary hold on a suspected transaction for up to 10 business days, extendable for up to 30 additional business days at the request of an investigating agency, with civil and criminal liability protections; and (ii) amends the Kansas Financial Institutions Information Security Act to add earned wage access service registrants as covered entities.