Struck = removed from the bill ยท
added = the amendment's new text.
LEGISLATURE OF THE STATE OF IDAHO Sixty-eighth Legislature Second Regular Session - 2026 Moved by Ruchti Seconded by Taylor IN THE SENATE SENATE BILLAMENDMENT NO.TO S.B.
1359,NO. As Amended BY STATE AFFAIRS COMMITTEE AN ACT RELATING TO THE VIRTUAL CURRENCY KIOSK FRAUD PREVENTION ACT;
AMENDING1359 TITLEAMENDMENT 28, IDAHO CODE, BY THE ADDITION OF A NEW CHAPTER 54, TITLE 28, IDAHO CODE, TO PROVIDESECTION A1 SHORTOn TITLE,page TO6 DEFINEof TERMS,the TOprinted ESTABLISHbill, Ain LICENS-line ING14, REQUIREMENT,delete TO"kiosks ESTABLISHaffiliated REPORTINGwith REQUIREMENTS,such TOopera-"; PROVIDE FOR MANDATORY DISCLOSURES, TO ESTABLISH CUSTOMER SERVICE REQUIREMENTS, TO PROVIDE FOR TRANSACTION RECEIPTS, TO PROVIDE FOR THE PREVENTION OF FRAUDULENT ACTIVITY AND MONEY LAUNDERING, TO PROVIDE FOR REFUNDS, TO PROVIDE FOR PENALTIES, TO PROVIDE FOR INFORMATION-SHARING RELATED TO VIRTUAL CURRENCY KIOSK FRAUD, AND TO PROVIDE FOR CHAPTER APPLICABILITY;
ANDand DECLARINGdelete ANlines EMERGENCY15 ANDthrough PROVIDING17, ANand EFFECTIVEinsert: DATE.
Be"affiliated Itkiosks.". Enacted by the Legislature of the State of Idaho:
SECTION 1.
That Title 28, Idaho Code, be, and the same is hereby amended by the addition thereto of a NEW CHAPTER , to be known and designated as Chap- ter 54, Title 28, Idaho Code, and to read as follows:
CHAPTER 54 VIRTUAL CURRENCY KIOSK FRAUD PREVENTION ACT 28-5401.
SHORT TITLE.
This act shall be known and may be cited as the "Virtual Currency Kiosk Fraud Prevention Act." 28-5402.
DEFINITIONS.
For the purposes of this chapter:
(1) "Blockchain analytics" means the analysis of data from blockchains or public distributed ledgers, including associated transaction informa- tion.
(2) "Blockchain analytics and tracing software" means a software ser- vice that uses blockchain analytics data to provide risk-specific informa- tion and tracing of virtual currency wallet addresses.
(3) "Department" means the Idaho department of finance.
(4) "Fraud" or "fraudulent" means an intentional deception or misrep- resentation made by a person with the knowledge that the deception could re- sult in some unauthorized benefit to himself or some other person.
(5) "New customer" means a user who is transacting with an operator:
(a) For the first time;
or (b) Within seventy-two (72) hours after such user's first transaction with the operator.
(6)(a) "Operator" means a person who owns, operates, or manages a vir- tual currency kiosk located in the United States or in any United States territory.
(b) "Operator" does not include a bank or credit union that solely pro- vides services to supply a virtual currency kiosk with legal tender or that provides deposit services for legal tender deposited in a virtual currency kiosk.
(7) "Potentially vulnerable older adult" means a person sixty-five (65) years of age or older who is unable to protect himself from maltreatment because of:
(a) A mental, physical, or developmental disability;
(b) A degenerative brain disease;
(c) An inability to communicate or implement decisions regarding his person;
or (d) Other infirmities of aging in an older adult.
(8) "Transaction fees" means fees or expenses paid by a user in order to conduct a virtual currency kiosk transaction.
Transaction fees equal the difference between the market price of the virtual currency and the price of the virtual currency charged to the user.
(9) "Transaction hash" means the unique alphanumeric identifier as- signed to a virtual currency kiosk transaction.
(10) "User" means any individual or entity that initiates, authorizes, or completes a transaction involving virtual currency through a virtual cur- rency kiosk, whether for the purpose of purchasing, selling, transferring, or otherwise exchanging virtual currency.
(11) "Virtual currency" means a type of digital asset, as defined in section 28-5303, Idaho Code, that confers economic, proprietary, or access rights or powers and is recorded using cryptographically secured dis- tributed ledger technology or any similar analogue.
(12) "Virtual currency address" means an alphanumeric identifier asso- ciated with a virtual currency wallet identifying the location to which a virtual currency transaction can be sent.
(13) "Virtual currency kiosk" means a stand-alone machine that is ca- pable of accepting or dispensing legal tender in exchange for virtual cur- rency.
(14) "Virtual currency kiosk transaction" means a transaction con- ducted or performed, in whole or in part, by electronic means via a virtual currency kiosk.
Virtual currency kiosk transaction also means a transaction made at a virtual currency kiosk to purchase virtual currency with or to sell virtual currency for United States dollars.
(15) "Virtual currency wallet" means a software application or other mechanism providing a means to hold the keys necessary to access and transfer virtual currency.
28-5403.
OPERATOR LICENSING REQUIREMENT.
In order for an operator to engage in or hold itself out as being able to engage in a virtual currency kiosk transaction, such operator must be a licensed money transmitter pur- suant to the provisions of chapter 29, title 26, Idaho Code.
28-5404.
OPERATOR REPORTING REQUIREMENTS.
(1) An operator shall com- plete, collect, and maintain quarterly reports and any supporting records for each virtual currency kiosk that it operates in Idaho.
Such reports and records shall be made available to the department, upon request, in a format specified by the department, within three (3) business days of such request.
Reports pursuant to this subsection shall include, at a minimum, the follow- ing information:
(a) The operator's legal name;
(b) Any fictitious or trade name used by the operator, if applicable;
(c) The operator's physical address;
(d) The date the operator commenced operation of the virtual currency kiosk at the location;
(e) The date the operator ceased operation of the virtual currency kiosk at the location, if applicable;
(f) Each address used by the operator to provide customer service in Idaho;
and (g) The number of transactions that the operator declined due to suspi- cion of fraud or other illegal activity.
(2) An operator shall complete, collect, and maintain annual reports and any supporting records for each virtual currency kiosk it operates in Idaho, to be completed on or before March 31, relating to the operator's business conducted in the prior year.
Such reports and records shall be made available to the department, upon request, in a format specified by the de- partment, within three (3) business days of such request.
A report pursuant to this subsection shall be on a form prescribed by the department and shall include, at a minimum:
(a) Gross revenue attributable to virtual currency transactions con- ducted via virtual currency kiosks in the state;
(b) A copy of any complaint filed against the operator with the bet- ter business bureau, with any state agency other than the department, or with any federal agency, and a description of the resolution, if any, of each such complaint;
(c) The total number and value of virtual currency transactions con- ducted via the operator's virtual currency kiosks in the state;
(d) The total number of refunds requested by users, the number of refund requests granted and the number of refund requests denied by the opera- tor, and the total dollar amount of such refunds;
(e) Contact details of the operator's compliance officer;
(f) A dedicated United States phone number and email address for commu- nications with government fraud investigators and law enforcement;
and (g) The total number of virtual currency corresponding locations.
(3) The phone number and email address required pursuant to subsection (2)(f) of this section shall be frequently monitored.
Upon request from law enforcement or the department, a virtual currency kiosk operator shall pro- vide trace findings and grant assistance with blockchain analytics for in- vestigative purposes.
(4) Within ten (10) business days after receipt of a request from the department, the virtual currency kiosk operator shall provide any transac- tion and user information requested by the department, including with re- spect to any transactions attempted but denied.
(5) Transaction data collected by the department pursuant to this sec- tion shall be confidential and may be released only in composite form, unless otherwise required by law.
(6) Failure to complete, collect, or maintain a report or record as re- quired pursuant to this section, or to timely provide such reports or records to the department, shall constitute a violation of this chapter.
28-5405.
MANDATORY DISCLOSURES.
(1) An operator shall disclose all relevant terms and conditions generally associated with the products, ser- vices, and activities of the operator and virtual currency, including but not limited to transaction fees collected and exchange rates used.
Such dis- closures shall be made in a clear, conspicuous, and easily readable manner in the language chosen by the user.
(2) A user who engages with a virtual currency kiosk shall receive ac- knowledgment of receipt of all disclosures required under this section via confirmation of consent at such virtual currency kiosk.
(3) The disclosures required by this section shall address the follow- ing in substantially the following form:
WARNING:
this technology can be used to defraud you.
If someone asked you to deposit money in this machine and/or is on the phone with you and claims to be a:
Friend or family member, Government agent, Computer software representative, Bill collector, Law enforcement officer, or A person whom you do not know...
STOP THIS TRANSACTION IMMEDIATELY, contact law enforcement, and notify the kiosk operator.
This may be a scam.
NEVER SEND MONEY TO SOMEONE YOU DO NOT KNOW.
(4) The material risks associated with virtual currency and virtual currency transactions shall be disclosed to each user of a virtual currency kiosk in Idaho.
Such disclosures shall be accompanied by information that may be used by a user to seek assistance, including:
(a) The name, address, and telephone number of the operator;
(b) The days and times the operator is available and the methods that a user may use to contact the operator for assistance;
and (c) The contact information for state and local law enforcement, which shall be displayed on or at the location of the virtual currency kiosk or on the first screen of such kiosk.
28-5406.
CUSTOMER SERVICE REQUIREMENTS.
(1) An operator shall provide live customer service at a toll-free number seven (7) days a week.
Daily business hours shall be from, at a minimum, 8:00 a.m.
to 8:00 p.m.
local time for all Idaho locations where the operator's virtual currency kiosks are lo- cated.
(2) Trained representatives of an operator shall be available to re- spond to customer telephone inquiries during the business hours required pursuant to this section.
(3) Inquiries received after normal business hours shall be responded to by a trained representative on the next business day.
28-5407.
TRANSACTION RECEIPTS.
(1) An operator shall provide each user with paper or electronic receipts at the conclusion of each virtual currency kiosk transaction.
(2) A receipt required pursuant to this section shall include the fol- lowing information:
(a) The operator's name and toll-free customer service phone number with operating hours;
(b) Relevant contact information for the operator, state and local law enforcement, and the department;
(c) Type, value, date, and precise time of the transaction and each ap- plicable virtual currency address and transaction hash;
(d) All transaction fees;
(e) The exchange rate of the virtual currency to U.S.
dollars;
and (f) The virtual currency kiosk operator's refund policy.
28-5408.
PREVENTION OF FRAUDULENT ACTIVITY AND MONEY LAUNDERING.
(1) An operator shall take reasonable steps to detect and prevent fraud and money laundering.
This shall include:
(a) Establishing and maintaining a written anti-fraud policy;
(b) Using blockchain analytics and tracing software to assist in the prevention of sending virtual currency to a virtual currency wallet known or likely to be affiliated with fraudulent activity at the time of a transaction and to detect transaction patterns indicative of fraud or other illicit activities;
(c) Blocking transactions to virtual currency wallets associated with overseas exchanges non-accessible for users located in the United States;
(d) Not accepting from or dispensing to a new customer an amount that is more than two thousand dollars ($2,000) in United States currency, or its equivalent in virtual currency, during any twenty-four (24) hour period;
(e) Ensuring that during the thirty (30) calendar days following a new customer's first transaction, the cumulative total of all transactions with an operator shall not exceed ten thousand dollars ($10,000) in U.S.
currency or its equivalent in virtual currency;
and (f) Implementing the following protections for new customers:
(i) Delaying settlement of a new customer's first virtual cur- rency kiosk transaction for seventy-two (72) hours;
and (ii) Allowing, upon request, for the full refund of any fraudulent virtual currency kiosk transaction experienced by a new customer within seventy-two (72) hours after such transaction, if such user:
1.
Contacts the operator in writing to provide notice of the fraudulent nature of the virtual currency kiosk transac- tion;
and 2.
Files a report with a government or law enforcement agency memorializing the fraudulent nature of the virtual currency kiosk transaction.
(2) A refund pursuant to subsection (1)(f) this section shall include all transaction fees paid by a new customer at the time of the transaction and shall occur within ten (10) business days after such new customer provides notice of a fraudulent virtual currency transaction.
A refund pursuant to this section shall be paid to a user in the user's originating currency.
(3) The transaction limits and protections provided for in this sec- tion shall apply to all virtual currency transactions offered by an operator through a virtual currency kiosk and any affiliated kiosks.
(4) The department may request evidence from any virtual currency kiosk operator of its current use of blockchain analytics as part of the operator's registration and maintenance of a money transmitter license.
(5) An operator shall provide notice to users regarding the delayed settlement or refund provisions of this section, including contact informa- tion to report a fraudulent transaction in writing.
28-5409.
TRANSACTION FEE REFUNDS.
(1) Subject to the requirements of this section, an operator shall issue a refund of all transaction fees paid by a user at the time of a transaction if such user experiences fraud with re- spect to such transaction.
Such refund shall be issued notwithstanding any acknowledgment that a user may have made prior to finalizing such transac- tion.
(2) A user who seeks a refund pursuant to the provisions of this section shall:
(a) Have engaged in a transaction or transactions involving the virtual currency kiosk that were affected by fraud, whether authorized or unau- thorized;
(b) Contact the virtual currency kiosk operator to inform the opera- tor of the fraudulent nature of the transaction or transactions at issue within thirty (30) days after the last transaction to occur or becoming aware of the theft;
and (c) Within thirty (30) days after contacting the virtual kiosk opera- tor, submit a police report, government agency report, or a sworn state- ment detailing the fraudulent nature of the transaction or transactions and provide a copy to the virtual currency kiosk operator.
(3) If conditions for refund issuance pursuant to this section are met, an operator shall issue a full refund of transaction fees within ten (10) business days after receiving notice from a user and receiving a copy of the police report, government agency report, or sworn statement.
(4) A refund pursuant to this section shall be paid to a user in the user's originating currency.
(5) The refund available pursuant to this section is distinct from the refund available to protect new customers pursuant to section 28-5408, Idaho Code, and such refunds shall be exclusive of each other.
28-5410.
PENALTIES.
(1) A violation of this chapter shall be deemed an unfair and deceptive practice in violation of the Idaho consumer protection act, chapter 6, title 48, Idaho Code.
(2) The attorney general may undertake any and all actions authorized by the Idaho consumer protection act to investigate and enforce a violation of this chapter.
(3) A person harmed by a violation of this chapter may initiate a civil action and may seek remedies pursuant to section 48-608, Idaho Code.
(4) In addition to any other penalties:
(a) An operator who violates this chapter shall be subject to revoca- tion of such operator's money transmitter licensure pursuant to the provisions of chapter 29, title 26, Idaho Code;
and (b) An operator who willfully and knowingly violates this chapter shall be guilty of a misdemeanor and, upon conviction, may be sentenced to pay a fine not exceeding one thousand dollars ($1,000).
28-5411.
INFORMATION-SHARING RELATED TO VIRTUAL CURRENCY KIOSK FRAUD.
(1) Notwithstanding any provision of law to the contrary, upon rea- sonable suspicion of fraud or financial exploitation involving a virtual currency kiosk transaction, the department, the attorney general, any state or local law enforcement agency, the Idaho commission on aging, or an adult protective services provider may share relevant information relating to such suspicion for the purposes of investigation, enforcement, or consumer protection.
(2) If the department is conducting an investigation or becomes aware of an ongoing investigation involving suspected fraud or financial ex- ploitation related to a virtual currency kiosk transaction, the department shall share relevant information with the attorney general and any state or local law enforcement agency with jurisdiction and with the Idaho commission on aging or an adult protective services provider when the affected individ- ual is a potentially vulnerable older adult.
(3) Information shared pursuant to this section that is confidential or exempt from disclosure under chapter 1, title 74, Idaho Code, shall retain its confidential status and shall not be subject to public disclosure except as otherwise authorized by law.
(4) Any agency, political subdivision, or employee thereof who acts in good faith when sharing information pursuant to this section shall be immune from any civil or criminal liability arising from the sharing of such infor- mation.
28-5412.
APPLICABILITY.
(1) This chapter shall only be construed to regulate transactions conducted through a virtual currency kiosk.
(2) Nothing in this chapter shall apply to online transactions or over- the-counter transactions conducted by a virtual currency kiosk owner.
(3) Nothing in this chapter shall be construed to modify or limit the applicability of any other provision of Idaho law, including the Idaho money transmitters act, to online or over-the-counter transactions conducted by a virtual currency kiosk owner outside of a virtual currency kiosk.
SECTION 2.
An emergency existing therefor, which emergency is hereby declared to exist, this act shall be in full force and effect on and after July 1, 2026.