Florida crypto ATM law forces operators to refund scam victims

Florida’s new HB 505 will require crypto‑ATM operators to issue full refunds within 72 hours for a victim’s first transaction if fraud is reported, shifting the cost of scams onto the businesses starting Jan 1 2027 [1].

Refund duty and transaction limits

HB 505 creates a “virtual currency kiosk framework” that obliges operators to post fraud warnings, provide receipts, and enforce daily transaction caps. The most consequential provision is the conditional refund right: if a customer reports alleged fraud to both the kiosk and law‑enforcement within 60 days and supplies proof (e.g., police report), the operator must return the full cash amount within 72 hours [1]. The law also caps daily purchases at $2,000 for new users and $10,000 for existing ones, directly targeting the early stage of a victim’s relationship with the kiosk [1].

Context and compliance burden

Florida’s Office of Financial Regulation noted 26 crypto‑ATM providers in the state, only nine of which held money‑transmitter licenses, leaving many operators outside traditional oversight [1]. The FBI’s Internet Crime Complaint Center recorded 1,213 crypto‑ATM complaints in 2025, amounting to $32.8 million in adjusted losses—roughly 3 % of the national total of 13,460 complaints and $389 million losses [1]. By making operators financially responsible for fraud, the law forces them to invest in ID verification, transaction monitoring, and record‑keeping systems that were previously optional.

Potential ripple effects

The law’s staged rollout—operations must register by March 1 2027—gives businesses a short window to adapt. If operators absorb the compliance costs, Florida could become a model for other states, especially as Congress considers a federal “Stop Crypto ATM Scams Act” with similar caps and refund provisions [1]. Conversely, heightened liability may prompt some operators to reduce kiosk density, raise fees, or exit the market, altering the accessibility of crypto cash‑in services in the Southeast.

What to watch

• Regulatory compliance dates – March 1 2027 deadline for kiosk registration.
• Refund claim volume – Number of fraud reports filed within the 60‑day window after the law takes effect.
• Operator response – Changes in kiosk numbers or fee structures in Florida’s 3,100‑plus crypto‑ATM network.

The law turns fraud prevention from a public‑education exercise into a business‑level risk, testing whether operators can sustain the added liability while keeping crypto‑ATM services viable in Florida.