Adds to existing law to establish the Virtual Currency Kiosk Fraud Prevention Act.

LEGISLATURE OF THE STATE OF IDAHO
Sixty-eighth Legislature Second Regular Session - 2026
IN THE SENATE
SENATE BILL NO. 1359
BY STATE AFFAIRS COMMITTEE
AN ACT	1
RELATING TO THE VIRTUAL CURRENCY KIOSK FRAUD PREVENTION ACT; AMENDING TITLE	2
28, IDAHO CODE, BY THE ADDITION OF A NEW CHAPTER 54, TITLE 28, IDAHO	3
CODE, TO PROVIDE A SHORT TITLE, TO DEFINE TERMS, TO ESTABLISH A LICENS-	4
ING REQUIREMENT, TO ESTABLISH REPORTING REQUIREMENTS, TO PROVIDE FOR	5
MANDATORY DISCLOSURES, TO ESTABLISH CUSTOMER SERVICE REQUIREMENTS,	6
TO PROVIDE FOR TRANSACTION RECEIPTS, TO PROVIDE FOR THE PREVENTION OF	7
FRAUDULENT ACTIVITY AND MONEY LAUNDERING, TO PROVIDE FOR REFUNDS, TO	8
PROVIDE FOR PENALTIES, TO PROVIDE FOR INFORMATION-SHARING RELATED TO	9
VIRTUAL CURRENCY KIOSK FRAUD, AND TO PROVIDE FOR CHAPTER APPLICABILITY;	10
AND DECLARING AN EMERGENCY AND PROVIDING AN EFFECTIVE DATE.	11
Be It Enacted by the Legislature of the State of Idaho:	12
SECTION 1. That Title 28, Idaho Code, be, and the same is hereby amended	13
by the addition thereto of a NEW CHAPTER, to be known and designated as Chap-	14
ter 54, Title 28, Idaho Code, and to read as follows:	15
CHAPTER 54	16
VIRTUAL CURRENCY KIOSK FRAUD PREVENTION ACT	17
28-5401. SHORT TITLE. This act shall be known and may be cited as the	18
"Virtual Currency Kiosk Fraud Prevention Act."	19
28-5402. DEFINITIONS. For the purposes of this chapter:	20
(1) "Blockchain analytics" means the analysis of data from blockchains	21
or public distributed ledgers, including associated transaction informa-	22
tion.	23
(2) "Blockchain analytics and tracing software" means a software ser-	24
vice that uses blockchain analytics data to provide risk-specific informa-	25
tion and tracing of virtual currency wallet addresses.	26
(3) "Department" means the Idaho department of finance.	27
(4) "Fraud" or "fraudulent" means an intentional deception or misrep-	28
resentation made by a person with the knowledge that the deception could re-	29
sult in some unauthorized benefit to himself or some other person.	30
(5) "New customer" means a user who is transacting with an operator:	31
(a) For the first time; or	32
(b) Within seventy-two (72) hours after such user's first transaction	33
with the operator.	34
(6)(a) "Operator" means a person who owns, operates, or manages a vir-	35
tual currency kiosk located in the United States or in any United States	36
territory.	37
(b) "Operator" does not include a bank or credit union that solely pro-	38
vides services to supply a virtual currency kiosk with legal tender or	39

-- 1 of 8 --

2
that provides deposit services for legal tender deposited in a virtual	1
currency kiosk.	2
(7) "Potentially vulnerable older adult" means a person sixty-five	3
(65) years of age or older who is unable to protect himself from maltreatment	4
because of:	5
(a) A mental, physical, or developmental disability;	6
(b) A degenerative brain disease;	7
(c) An inability to communicate or implement decisions regarding his	8
person; or	9
(d) Other infirmities of aging in an older adult.	10
(8) "Transaction fees" means fees or expenses paid by a user in order	11
to conduct a virtual currency kiosk transaction. Transaction fees equal the	12
difference between the market price of the virtual currency and the price of	13
the virtual currency charged to the user.	14
(9) "Transaction hash" means the unique alphanumeric identifier as-	15
signed to a virtual currency kiosk transaction.	16
(10) "User" means any individual or entity that initiates, authorizes,	17
or completes a transaction involving virtual currency through a virtual cur-	18
rency kiosk, whether for the purpose of purchasing, selling, transferring,	19
or otherwise exchanging virtual currency.	20
(11) "Virtual currency" means a type of digital asset, as defined in	21
section 28-5303, Idaho Code, that confers economic, proprietary, or access	22
rights or powers and is recorded using cryptographically secured dis-	23
tributed ledger technology or any similar analogue.	24
(12) "Virtual currency address" means an alphanumeric identifier asso-	25
ciated with a virtual currency wallet identifying the location to which a	26
virtual currency transaction can be sent.	27
(13) "Virtual currency kiosk" means a stand-alone machine that is ca-	28
pable of accepting or dispensing legal tender in exchange for virtual cur-	29
rency.	30
(14) "Virtual currency kiosk transaction" means a transaction con-	31
ducted or performed, in whole or in part, by electronic means via a virtual	32
currency kiosk. Virtual currency kiosk transaction also means a transaction	33
made at a virtual currency kiosk to purchase virtual currency with or to sell	34
virtual currency for United States dollars.	35
(15) "Virtual currency wallet" means a software application or other	36
mechanism providing a means to hold the keys necessary to access and transfer	37
virtual currency.	38
28-5403. OPERATOR LICENSING REQUIREMENT. In order for an operator to	39
engage in or hold itself out as being able to engage in a virtual currency	40
kiosk transaction, such operator must be a licensed money transmitter pur-	41
suant to the provisions of chapter 29, title 26, Idaho Code.	42
28-5404. OPERATOR REPORTING REQUIREMENTS. (1) An operator shall com-	43
plete, collect, and maintain quarterly reports and any supporting records	44
for each virtual currency kiosk that it operates in Idaho. Such reports and	45
records shall be made available to the department, upon request, in a format	46
specified by the department, within three (3) business days of such request.	47

-- 2 of 8 --

3
Reports pursuant to this subsection shall include, at a minimum, the follow-	1
ing information:	2
(a) The operator's legal name;	3
(b) Any fictitious or trade name used by the operator, if applicable;	4
(c) The operator's physical address;	5
(d) The date the operator commenced operation of the virtual currency	6
kiosk at the location;	7
(e) The date the operator ceased operation of the virtual currency	8
kiosk at the location, if applicable;	9
(f) Each address used by the operator to provide customer service in	10
Idaho; and	11
(g) The number of transactions that the operator declined due to suspi-	12
cion of fraud or other illegal activity.	13
(2) An operator shall complete, collect, and maintain annual reports	14
and any supporting records for each virtual currency kiosk it operates in	15
Idaho, to be completed on or before March 31, relating to the operator's	16
business conducted in the prior year. Such reports and records shall be made	17
available to the department, upon request, in a format specified by the de-	18
partment, within three (3) business days of such request. A report pursuant	19
to this subsection shall be on a form prescribed by the department and shall	20
include, at a minimum:	21
(a) Gross revenue attributable to virtual currency transactions con-	22
ducted via virtual currency kiosks in the state;	23
(b) A copy of any complaint filed against the operator with the bet-	24
ter business bureau, with any state agency other than the department, or	25
with any federal agency, and a description of the resolution, if any, of	26
each such complaint;	27
(c) The total number and value of virtual currency transactions con-	28
ducted via the operator's virtual currency kiosks in the state;	29
(d) The total number of refunds requested by users, the number of refund	30
requests granted and the number of refund requests denied by the opera-	31
tor, and the total dollar amount of such refunds;	32
(e) Contact details of the operator's compliance officer;	33
(f) A dedicated United States phone number and email address for commu-	34
nications with government fraud investigators and law enforcement; and	35
(g) The total number of virtual currency corresponding locations.	36
(3) The phone number and email address required pursuant to subsection	37
(2)(f) of this section shall be frequently monitored. Upon request from law	38
enforcement or the department, a virtual currency kiosk operator shall pro-	39
vide trace findings and grant assistance with blockchain analytics for in-	40
vestigative purposes.	41
(4) Within ten (10) business days after receipt of a request from the	42
department, the virtual currency kiosk operator shall provide any transac-	43
tion and user information requested by the department, including with re-	44
spect to any transactions attempted but denied.	45
(5) Transaction data collected by the department pursuant to this sec-	46
tion shall be confidential and may be released only in composite form, unless	47
otherwise required by law.	48

-- 3 of 8 --

4
(6) Failure to complete, collect, or maintain a report or record as re-	1
quired pursuant to this section, or to timely provide such reports or records	2
to the department, shall constitute a violation of this chapter.	3
28-5405. MANDATORY DISCLOSURES. (1) An operator shall disclose all	4
relevant terms and conditions generally associated with the products, ser-	5
vices, and activities of the operator and virtual currency, including but	6
not limited to transaction fees collected and exchange rates used. Such dis-	7
closures shall be made in a clear, conspicuous, and easily readable manner in	8
the language chosen by the user.	9
(2) A user who engages with a virtual currency kiosk shall receive ac-	10
knowledgment of receipt of all disclosures required under this section via	11
confirmation of consent at such virtual currency kiosk.	12
(3) The disclosures required by this section shall address the follow-	13
ing in substantially the following form:	14
WARNING: this technology can be used to defraud you.	15
If someone asked you to deposit money in this machine and/or is on the	16
phone with you and claims to be a:	17
Friend or family member,	18
Government agent,	19
Computer software representative,	20
Bill collector,	21
Law enforcement officer, or	22
A person whom you do not know...	23
STOP THIS TRANSACTION IMMEDIATELY, contact law enforcement, and notify	24
the kiosk operator.	25
This may be a scam. NEVER SEND MONEY TO SOMEONE YOU DO NOT KNOW.	26
(4) The material risks associated with virtual currency and virtual	27
currency transactions shall be disclosed to each user of a virtual currency	28
kiosk in Idaho. Such disclosures shall be accompanied by information that	29
may be used by a user to seek assistance, including:	30
(a) The name, address, and telephone number of the operator;	31
(b) The days and times the operator is available and the methods that a	32
user may use to contact the operator for assistance; and	33
(c) The contact information for state and local law enforcement, which	34
shall be displayed on or at the location of the virtual currency kiosk or	35
on the first screen of such kiosk.	36
28-5406. CUSTOMER SERVICE REQUIREMENTS. (1) An operator shall provide	37
live customer service at a toll-free number seven (7) days a week. Daily	38
business hours shall be from, at a minimum, 8:00 a.m. to 8:00 p.m. local time	39
for all Idaho locations where the operator's virtual currency kiosks are lo-	40
cated.	41

-- 4 of 8 --

5
(2) Trained representatives of an operator shall be available to re-	1
spond to customer telephone inquiries during the business hours required	2
pursuant to this section.	3
(3) Inquiries received after normal business hours shall be responded	4
to by a trained representative on the next business day.	5
28-5407. TRANSACTION RECEIPTS. (1) An operator shall provide each	6
user with paper or electronic receipts at the conclusion of each virtual	7
currency kiosk transaction.	8
(2) A receipt required pursuant to this section shall include the fol-	9
lowing information:	10
(a) The operator's name and toll-free customer service phone number	11
with operating hours;	12
(b) Relevant contact information for the operator, state and local law	13
enforcement, and the department;	14
(c) Type, value, date, and precise time of the transaction and each ap-	15
plicable virtual currency address and transaction hash;	16
(d) All transaction fees;	17
(e) The exchange rate of the virtual currency to U.S. dollars; and	18
(f) The virtual currency kiosk operator's refund policy.	19
28-5408. PREVENTION OF FRAUDULENT ACTIVITY AND MONEY LAUNDERING. (1)	20
An operator shall take reasonable steps to detect and prevent fraud and money	21
laundering. This shall include:	22
(a) Establishing and maintaining a written anti-fraud policy;	23
(b) Using blockchain analytics and tracing software to assist in the	24
prevention of sending virtual currency to a virtual currency wallet	25
known or likely to be affiliated with fraudulent activity at the time of	26
a transaction and to detect transaction patterns indicative of fraud or	27
other illicit activities;	28
(c) Blocking transactions to virtual currency wallets associated	29
with overseas exchanges non-accessible for users located in the United	30
States;	31
(d) Not accepting from or dispensing to a new customer an amount that	32
is more than two thousand dollars ($2,000) in United States currency,	33
or its equivalent in virtual currency, during any twenty-four (24) hour	34
period;	35
(e) Ensuring that during the thirty (30) calendar days following a new	36
customer's first transaction, the cumulative total of all transactions	37
with an operator shall not exceed ten thousand dollars ($10,000) in U.S.	38
currency or its equivalent in virtual currency; and	39
(f) Implementing the following protections for new customers:	40
(i) Delaying settlement of a new customer's first virtual cur-	41
rency kiosk transaction for seventy-two (72) hours; and	42
(ii) Allowing, upon request, for the full refund of any fraudulent	43
virtual currency kiosk transaction experienced by a new customer	44
within seventy-two (72) hours after such transaction, if such	45
user:	46

-- 5 of 8 --

6
1. Contacts the operator in writing to provide notice of the	1
fraudulent nature of the virtual currency kiosk transac-	2
tion; and	3
2. Files a report with a government or law enforcement	4
agency memorializing the fraudulent nature of the virtual	5
currency kiosk transaction.	6
(2) A refund pursuant to subsection (1)(f) this section shall include	7
all transaction fees paid by a new customer at the time of the transaction and	8
shall occur within ten (10) business days after such new customer provides	9
notice of a fraudulent virtual currency transaction. A refund pursuant to	10
this section shall be paid to a user in the user's originating currency.	11
(3) The transaction limits and protections provided for in this sec-	12
tion shall apply to all virtual currency transactions offered by an operator	13
through a virtual currency kiosk and any kiosks affiliated with such opera-	14
tor. Operators shall not use alternative methods, including but not limited	15
to online portals, affiliated kiosks, or over-the-counter transactions, to	16
evade or exceed the limits provided for in this section.	17
(4) The department may request evidence from any virtual currency kiosk	18
operator of its current use of blockchain analytics as part of the operator's	19
registration and maintenance of a money transmitter license.	20
(5) An operator shall provide notice to users regarding the delayed	21
settlement or refund provisions of this section, including contact informa-	22
tion to report a fraudulent transaction in writing.	23
28-5409. TRANSACTION FEE REFUNDS. (1) Subject to the requirements of	24
this section, an operator shall issue a refund of all transaction fees paid	25
by a user at the time of a transaction if such user experiences fraud with re-	26
spect to such transaction. Such refund shall be issued notwithstanding any	27
acknowledgment that a user may have made prior to finalizing such transac-	28
tion.	29
(2) A user who seeks a refund pursuant to the provisions of this section	30
shall:	31
(a) Have engaged in a transaction or transactions involving the virtual	32
currency kiosk that were affected by fraud, whether authorized or unau-	33
thorized;	34
(b) Contact the virtual currency kiosk operator to inform the opera-	35
tor of the fraudulent nature of the transaction or transactions at issue	36
within thirty (30) days after the last transaction to occur or becoming	37
aware of the theft; and	38
(c) Within thirty (30) days after contacting the virtual kiosk opera-	39
tor, submit a police report, government agency report, or a sworn state-	40
ment detailing the fraudulent nature of the transaction or transactions	41
and provide a copy to the virtual currency kiosk operator.	42
(3) If conditions for refund issuance pursuant to this section are met,	43
an operator shall issue a full refund of transaction fees within ten (10)	44
business days after receiving notice from a user and receiving a copy of the	45
police report, government agency report, or sworn statement.	46
(4) A refund pursuant to this section shall be paid to a user in the	47
user's originating currency.	48

-- 6 of 8 --

7
(5) The refund available pursuant to this section is distinct from the	1
refund available to protect new customers pursuant to section 28-5408, Idaho	2
Code, and such refunds shall be exclusive of each other.	3
28-5410. PENALTIES. (1) A violation of this chapter shall be deemed an	4
unfair and deceptive practice in violation of the Idaho consumer protection	5
act, chapter 6, title 48, Idaho Code.	6
(2) The attorney general may undertake any and all actions authorized	7
by the Idaho consumer protection act to investigate and enforce a violation	8
of this chapter.	9
(3) A person harmed by a violation of this chapter may initiate a civil	10
action and may seek remedies pursuant to section 48-608, Idaho Code.	11
(4) In addition to any other penalties:	12
(a) An operator who violates this chapter shall be subject to revoca-	13
tion of such operator's money transmitter licensure pursuant to the	14
provisions of chapter 29, title 26, Idaho Code; and	15
(b) An operator who willfully and knowingly violates this chapter shall	16
be guilty of a misdemeanor and, upon conviction, may be sentenced to pay	17
a fine not exceeding one thousand dollars ($1,000).	18
28-5411. INFORMATION-SHARING RELATED TO VIRTUAL CURRENCY KIOSK	19
FRAUD. (1) Notwithstanding any provision of law to the contrary, upon rea-	20
sonable suspicion of fraud or financial exploitation involving a virtual	21
currency kiosk transaction, the department, the attorney general, any state	22
or local law enforcement agency, the Idaho commission on aging, or an adult	23
protective services provider may share relevant information relating to	24
such suspicion for the purposes of investigation, enforcement, or consumer	25
protection.	26
(2) If the department is conducting an investigation or becomes aware	27
of an ongoing investigation involving suspected fraud or financial ex-	28
ploitation related to a virtual currency kiosk transaction, the department	29
shall share relevant information with the attorney general and any state or	30
local law enforcement agency with jurisdiction and with the Idaho commission	31
on aging or an adult protective services provider when the affected individ-	32
ual is a potentially vulnerable older adult.	33
(3) Information shared pursuant to this section that is confidential or	34
exempt from disclosure under chapter 1, title 74, Idaho Code, shall retain	35
its confidential status and shall not be subject to public disclosure except	36
as otherwise authorized by law.	37
(4) Any agency, political subdivision, or employee thereof who acts in	38
good faith when sharing information pursuant to this section shall be immune	39
from any civil or criminal liability arising from the sharing of such infor-	40
mation.	41
28-5412. APPLICABILITY. (1) This chapter shall only be construed to	42
regulate transactions conducted through a virtual currency kiosk.	43
(2) Nothing in this chapter shall apply to online transactions or over-	44
the-counter transactions conducted by a virtual currency kiosk owner.	45
(3) Nothing in this chapter shall be construed to modify or limit the	46
applicability of any other provision of Idaho law, including the Idaho money	47

-- 7 of 8 --

8
transmitters act, to online or over-the-counter transactions conducted by a	1
virtual currency kiosk owner outside of a virtual currency kiosk.	2
SECTION 2. An emergency existing therefor, which emergency is hereby	3
declared to exist, this act shall be in full force and effect on and after	4
July 1, 2026.	5

-- 8 of 8 --