On April 13, 2026, Kentucky Governor Andy Beshear signed Senate Bill 189 (“SB 189”) into law, creating a new regulatory framework for virtual currency kiosk operators, commonly known as crypto ATMs, in the Commonwealth. Codified as a new Subtitle 13 of KRS Chapter 286, the law establishes a standalone licensing regime and significant consumer protection requirements for operators. The law takes effect April 30, 2027, and the Kentucky Department of Financial Institutions (“DFI”) must issue implementing regulations by January 1, 2027.
No person may operate a virtual currency kiosk in Kentucky without first obtaining a license from the DFI Commissioner, with banks, credit unions, and certain affiliates exempt. Applications must be submitted through NMLS and renewed annually. Licensees must maintain a minimum net worth of $500,000 and a surety bond of at least $500,000, which the Commissioner may increase up to $5 million depending on the operator’s risk profile and transaction volume.
The law also imposes direct transaction limits and fee restrictions. Operators may not facilitate transactions exceeding $2,000 per day per user or $10,500 in the aggregate for new users during their first 30 days. Fees are capped at the greater of $5 or 18% of the transaction value. Operators must also verify customer identity, provide clear pre-transaction disclosures regarding fees and transaction risks, and maintain anti-fraud and anti-money laundering policies compliant with the Bank Secrecy Act, including the designation of a chief compliance officer.
One of the most significant provisions is the mandatory refund requirement. Operators must issue full refunds of kiosk charges to users who were fraudulently induced into transactions and report the fraud within 90 days with supporting documentation. If the operator or its agent is responsible for the fraud, the refund obligation extends to the full transaction amount. This provision materially shifts fraud risk from the consumer to the operator and will likely require enhanced onboarding, monitoring, and transaction review procedures.
The DFI may impose civil penalties of $1,000 to $5,000 per violation per day, and violations may also constitute unfair trade practices enforceable by the Kentucky Attorney General. Operating without a license is a Class C felony.
Kentucky’s law is one of the more aggressive state crypto ATM statutes enacted to date and may serve as a model for other states focused on fraud prevention and consumer protection. Operators currently active in Kentucky should begin reviewing their licensing posture, compliance systems, and refund protocols well before the April 30, 2027 effective date.