MVA White Collar Defense, Investigations, and Regulatory Advice Blog

North Carolina has joined a growing number of states seeking to address the consumer-protection risks associated with cryptocurrency kiosks. On July 8, 2026, Governor Josh Stein signed House Bill 920 into law, creating the Virtual Currency Kiosk Consumer Protection Act (the “Act”), which provides a comprehensive regulatory framework governing virtual currency kiosks operating in the State. The Act takes effect on January 1, 2027.

The Act is similar to model legislation used by many other states that are seeking to balance consumer demand for access to transactions in virtual currencies with protections that guard against their related risks. North Carolina has leveraged this framework to impose stringent compliance, consumer-protection, and anti-fraud measures but has also incorporated more novel, or at least less common, elements, such as an interactive fraud warning process and a provision that leaves room for the State’s cities and counties to further regulate local kiosk operations.

Crypto Kiosk Operators Will Be Subject to Licensing, Regulation, and Risk Management Requirements

The Act creates new Article 26 of Chapter 53 of the North Carolina General Statutes and subjects virtual currency kiosk operators to licensing under North Carolina’s money transmitter law (under Article 16B of Chapter 53), as well as examination, reporting, and ongoing supervision by the Commissioner of Banks.

Operators must:

• provide records and evidence of compliance upon request;
• report kiosk locations quarterly;
• demonstrate compliance with applicable state and federal laws; and
• cooperate with examinations and regulatory inquiries.

The Act also requires operators to take reasonable steps to prevent fraud, including by maintaining written anti-fraud policies, and to have compliance policies addressing applicable state and federal requirements. In addition, operators must employ a full-time compliance officer and designate a consumer protection officer, neither of whom may own more than 20 percent of the operator. Operators must also provide detailed transaction receipts and maintain live customer-service support during all hours of kiosk operation.

The Act Imposes Extensive Consumer Protection, Disclosure, and Anti-Fraud Requirements

A central feature of the Act is its comprehensive disclosure regime. Before establishing a customer relationship and before completing a transaction, operators must provide disclosures addressing material risks of virtual currency transactions. Among other matters, customers must be informed that virtual currency:

• is not legal tender, is not backed by any governmental authority, and is not insured by the FDIC or SIPC;
• may be subject to fraud, cyberattacks, or other risks, and that resulting losses may not be recoverable;
• generally involves irreversible transactions; and
• may become inaccessible due to technical failures, and any bonds or trust accounts maintained for customer protection may be insufficient to cover losses.

Operators also must disclose key contractual terms, including customer rights and liabilities, exchange rates, and applicable fees and charges. These provisions closely resemble disclosure frameworks commonly found in traditional financial-services products and reflect the legislature’s emphasis on ensuring customers understand the risks associated with crypto assets.

Before a transaction can proceed, operators must provide warnings and obtain customer acknowledgments confirming:

• the potential for heightened risk of scams involving requests for kiosk payments from persons claiming to be a bank representative, financial adviser, software provider, law enforcement officer, or a new romantic partner or friend;
• that the transaction is being entered into voluntarily by the customer and is irreversible and nonrefundable; and
• that the customer is sending funds to a digital wallet owned or controlled by the customer.

A notable feature of the Act is its interactive fraud screening process. Customers must respond to prompts indicating whether any fraud warning applies to their circumstances, and each warning screen must remain visible for at least ten seconds, accompanied by a countdown timer or similar indicator. Operators may not allow customers to bypass, skip, or accelerate the process.

If a customer indicates that any warning applies, the operator must immediately terminate the transaction and disable the customer’s account, wallet address, phone number, or other unique identifier for at least 24 hours.

Additional anti-fraud measures include:

• prohibiting customer authentication through QR codes, barcodes, or similar scan-based login methods (customers instead must use manually entered credentials, manually entered verification codes, or other methods approved by the Commissioner);
• requiring the use of blockchain analytics to prevent transmission of virtual currency to wallet addresses known to be associated with fraudulent activity at the time of the transaction;
• requiring the disablement or physical blocking of scanning devices except when used for approved identity-verification purposes; and
• imposing (i) mandatory 48-hour holds on transactions by new customers, and (ii) daily transaction limits of $2,000 for new customers and $5,000 for existing customers.

The Act also requires operators to provide certain refunds in cases when a customer reports a fraudulent transaction to the Commissioner within 30 days after transmission of funds and the Commissioner subsequently determines that the transaction resulted from fraud.

The Act Leaves the Door Open for More Restrictive Local Regulation

Unlike the frameworks enacted in many states that currently regulate crypto kiosks, North Carolina’s Act expressly reserves the right of local governmental authorities to further regulate their operation. The Act permits cities and counties to regulate virtual currency kiosks so long as local requirements do not conflict with the Act. Local governments are expressly authorized to adopt zoning ordinances that:

• designate areas where kiosks are permitted or prohibited;
• impose conditions on kiosk placement, density, or operation; and
• prohibit kiosks within all or part of the jurisdiction. 

Practical Implications

North Carolina now joins a growing number of states that have chosen to regulate cryptocurrency kiosks rather than prohibit them outright.

For operators, state authorization comes at a significant cost – operation within a highly structured regulatory environment designed to combat fraud, enhance transparency, and strengthen consumer protections.

Compliance burdens will be substantial and may require significant operational enhancements before the January 1, 2027, effective date.

In addition, the Act establishes only a regulatory floor. Because cities and counties retain authority to impose more stringent zoning and operational restrictions, the practical ability of kiosk operators to deploy and operate kiosks throughout the State may ultimately depend as much on local regulation as on compliance with the Act itself.