Bitcoin ATMs Are Under Intense Federal and State Scrutiny
Bitcoin ATMs have become one of the fastest-growing channels for financial fraud in the United States. The FBI reported that from January through November 2025, Bitcoin ATM fraud resulted in over $333.5 million in reported losses and more than 12,000 complaints. That figure represents a sharp increase from 2024, when reported losses were approximately $250 million. In 2023, the number was $114 million. In 2022, it was $78 million. The trajectory is unmistakable.
Federal and state enforcement actions against Bitcoin ATM operators are accelerating at the same pace. In November 2025, a federal grand jury in the Northern District of Illinois indicted the founder of a Chicago-based cryptocurrency ATM company on money laundering conspiracy charges alleging at least $10 million in laundered criminal proceeds. In September 2025, the District of Columbia Attorney General sued one of the nation's largest Bitcoin ATM operators for facilitating fraud and charging undisclosed fees to scam victims. In August 2025, Illinois enacted two landmark laws imposing registration requirements, fee caps, and transaction limits on cryptocurrency kiosk operators.
The enforcement pressure is coming from every direction. Federal prosecutors. State attorneys general. State legislatures. Congress. The message to Bitcoin ATM operators is clear: the era of minimal oversight is over.
For anyone who operates Bitcoin ATMs, owns a company that provides cryptocurrency kiosk services, or works in the compliance infrastructure of a digital asset business, the current enforcement landscape presents serious criminal and civil exposure.
The Northern District of Illinois Indictment: United States v. Isa
The most significant recent federal criminal action against a Bitcoin ATM operator was unsealed in the Northern District of Illinois in November 2025. A federal grand jury charged Firas Isa and his company, Virtual Assets LLC (doing business as Crypto Dispensers), with one count of money laundering conspiracy under 18 U.S.C. § 1956. The charge carries a maximum sentence of 20 years in federal prison.
According to the indictment, Isa operated a cash-to-cryptocurrency exchange through a network of ATMs and bank accounts. Customers could deposit cash, checks, or wired funds for conversion into digital assets. Prosecutors allege that between 2018 and 2025, the operation processed millions of dollars in proceeds from wire fraud schemes and narcotics trafficking. The money was allegedly converted into cryptocurrency and transferred to external wallets to obscure its source.
The government's theory is direct. Prosecutors allege that Isa knew the proceeds were tied to criminal activity and processed them anyway. The indictment describes specific transactions where cash from fraud operations was collected, converted into cryptocurrency, and transferred out.
United States v. Isa, No. 25-CR (N.D. Ill. 2025) — Federal grand jury indicted the founder of Virtual Assets LLC (d/b/a Crypto Dispensers) on one count of money laundering conspiracy under 18 U.S.C. § 1956. Prosecutors allege the operation laundered at least $10 million in criminal proceeds through a network of cryptocurrency ATMs. Both defendants pleaded not guilty. A status hearing was scheduled before U.S. District Judge Elaine E. Bucklo.
The indictment also includes a forfeiture notice. The government seeks any property linked to the alleged crimes, including a personal money judgment. If specific assets cannot be recovered, prosecutors intend to pursue substitute property under federal forfeiture law.
This case was brought by a special grand jury convened in April 2025. It signals sustained prosecutorial focus, not a one-off action.
The Bitcoin of America Precedent
The Isa indictment follows an earlier high-profile prosecution of a Bitcoin ATM operator. In March 2023, a Cuyahoga County grand jury in Ohio indicted the founder of Bitcoin of America and two co-conspirators on charges including conspiracy, money laundering, receiving stolen property, and operating cryptocurrency kiosks without a money transmission license. The U.S. Secret Service Cyber Fraud and Money Laundering Task Force led the investigation with assistance from nearly 30 law enforcement agencies. Authorities seized 52 Bitcoin ATMs across two Ohio counties.
Prosecutors alleged that Bitcoin of America took approximately 20 percent of every transaction as a fee, never disclosed the fee to users, and never returned its fee even when customers reported being scammed. The founder ultimately pleaded guilty to lesser charges and was sentenced to probation in November 2023. The company shut down.
The pattern across both cases is the same. Operators who fail to implement meaningful anti-money laundering controls, who profit from transactions they know or should know involve fraud proceeds, and who ignore red flags face criminal prosecution.
The Federal Statutes That Create Liability for Bitcoin ATM Operators
Bitcoin ATM operators sit at the intersection of several federal criminal statutes. The potential charges are severe.
The Knowledge Element
The central question in most Bitcoin ATM prosecutions is knowledge. Federal money laundering statutes require the government to prove that the defendant knew the funds involved were proceeds of criminal activity or conducted transactions designed to conceal their nature or source.
Prosecutors rarely have direct evidence of knowledge. They build their case through circumstantial evidence. A pattern of high-volume cash deposits from multiple individuals at the same machine, the absence of any meaningful KYC verification, the failure to file SARs despite obvious red flags, and continued processing of transactions after receiving complaints from scam victims are all facts prosecutors use to establish the operator knew what was happening.
Deliberate ignorance is legally equivalent to actual knowledge. If an operator structures the business to avoid learning whether transactions involve criminal proceeds, the government can prove the knowledge element through willful blindness.
Federal prosecutors do not need a confession or a recording. A pattern of ignored red flags, absent compliance controls, and continued processing of suspicious transactions is often enough to prove knowledge at trial.
FinCEN Registration and BSA Compliance: The Regulatory Floor
Every Bitcoin ATM operator in the United States is a money transmitter under federal law. That is not a grey area. FinCEN settled the question in its 2013 guidance on virtual currency, which classified administrators and exchangers of convertible virtual currency as money services businesses subject to the Bank Secrecy Act.
The obligations are substantial.
| Requirement | Detail |
|---|---|
| FinCEN Registration | File FinCEN Form 107 within 180 days of establishing the business. Renew every two years. |
| AML Program | Develop and implement a written anti-money laundering program. Designate a compliance officer. Conduct ongoing employee training. Perform independent audits. |
| Know Your Customer | Verify customer identity before processing transactions. Screen against the OFAC Specially Designated Nationals list. |
| Currency Transaction Reports | File CTRs for transactions (or daily aggregate amounts) exceeding $10,000. |
| Suspicious Activity Reports | File SARs for transactions of $2,000 or more that the operator knows, suspects, or has reason to suspect involve criminal activity or lack a lawful purpose. |
| Recordkeeping | Maintain transaction records for five years. |
| State Licensing | Obtain money transmitter licenses in each state that requires them. Requirements vary by state. |
Failure to meet any of these requirements creates exposure. Operating without FinCEN registration is a criminal offense under 18 U.S.C. § 1960. Willful failure to maintain an AML program or file required reports is a criminal offense under 31 U.S.C. § 5322. And BSA compliance failures are exactly the kind of evidence federal prosecutors use to build money laundering cases. If an operator has no AML program and no KYC procedures, it becomes much easier for the government to argue that the operator was deliberately blind to the criminal nature of the transactions flowing through its machines.
The D.C. Attorney General Lawsuit Against Athena Bitcoin
The civil enforcement side of Bitcoin ATM regulation is equally aggressive. In September 2025, D.C. Attorney General Brian Schwalb filed suit against Athena Bitcoin, Inc., one of the nation's largest Bitcoin ATM operators, in D.C. Superior Court. The allegations are striking.
According to the complaint, 93 percent of all funds deposited into Athena's seven D.C. machines during its first five months of operation were tied to scams. The median age of victims was 71. One elderly resident lost nearly $98,000 through a single scam conducted via an Athena kiosk.
The complaint alleges that Athena charged undisclosed fees of up to 26 percent per transaction. It hid those fees in a misleading "exchange rate" that did not reflect the actual market price of Bitcoin. When scam victims requested refunds, Athena enforced a blanket "no refunds" policy. In some cases, Athena offered capped refunds of $7,500, but required victims to sign a confidential release waiving future claims.
The lawsuit charges Athena with violations of the D.C. Consumer Protection Procedures Act and the D.C. Abuse, Neglect, and Financial Exploitation of Vulnerable Adults and the Elderly Act.
The Athena lawsuit is not an isolated action. The FTC has published data showing that fraud losses at Bitcoin ATMs increased nearly tenfold from 2020 to 2023 and that scammers prefer some operators over others, likely because of differences in fraud prevention measures. That finding puts every operator on notice: if your machines are disproportionately used for fraud, regulators and prosecutors will ask why.
What the Athena Case Means for Operators
The D.C. lawsuit advances a theory with broad implications. It does not allege that Athena was itself a criminal enterprise. It alleges that Athena knew its machines were being used primarily by scammers, failed to implement effective safeguards, and continued to profit from those transactions. That is a negligence and consumer protection theory, not a criminal one. But the facts alleged in the D.C. complaint are precisely the kind of facts federal prosecutors use to build willful blindness arguments in criminal money laundering cases.
For operators, the lesson is direct. Having fraud warnings on the screen is not enough. The D.C. complaint specifically alleges that rapid prompts, dense legal disclaimers, and complicated on-screen warnings do not protect consumers when scammers are coaching victims through the transaction in real time.
The Legislative Response: State and Federal Action
Legislators at both the state and federal level have moved to impose new regulatory requirements on Bitcoin ATM operators.
Illinois: The Digital Asset Kiosk Act
In August 2025, Illinois Governor JB Pritzker signed two landmark bills into law. The Digital Asset Kiosk Act (SB 2319) imposes specific requirements on cryptocurrency ATM operators in Illinois. Operators must register with the Illinois Department of Financial and Professional Regulation. Transaction fees are capped at 18 percent. Daily transactions for new customers are capped at $2,500. Operators must designate both a compliance officer and a consumer protection officer. And operators must provide full refunds to new customers who report being scammed.
The companion bill, the Digital Assets and Consumer Protection Act (SB 1797), gives IDFPR authority to regulate digital asset exchanges more broadly, with enforcement penalties of up to $100,000 per day for unlicensed activity.
Illinois has roughly 1,600 crypto ATMs. Over 1,100 are in Chicago. That concentration makes Illinois a natural focus of enforcement, and the state's new laws give regulators powerful tools.
Federal Legislation: The Crypto ATM Fraud Prevention Act
At the federal level, Senator Dick Durbin introduced the Crypto ATM Fraud Prevention Act in February 2025. The bill would cap new-user transactions at $2,000 per day and $10,000 over a 14-day period. It would require operators to speak directly with new customers seeking to make transactions over $500. It would mandate full refunds when users file police reports and notify the operator within 30 days.
The bill had not been enacted as of this writing. But it reflects a clear congressional appetite for regulation of the Bitcoin ATM industry.
Local Action
Some municipalities have taken even more aggressive steps. St. Paul, Minnesota voted to ban Bitcoin ATMs outright. Other jurisdictions are considering similar measures. The patchwork of state and local regulation creates a complex compliance landscape for operators that spans multiple jurisdictions.
Common Fraud Schemes That Flow Through Bitcoin ATMs
Understanding the fraud schemes that federal investigators associate with Bitcoin ATMs is essential for any operator assessing its compliance risk.
Government and Business Impersonation Scams
The most common Bitcoin ATM fraud pattern involves impersonation. Scammers contact victims by phone, text, or pop-up alert. They claim to be from a bank, the IRS, the Social Security Administration, or a technology company like Microsoft or Apple. They tell the victim that their account has been compromised or that their identity has been linked to criminal activity. They direct the victim to withdraw cash from their bank and deposit it into a Bitcoin ATM, ostensibly to "protect" the funds. The cash goes directly into a wallet controlled by the scammer.
The FTC reports that in the first half of 2024, the median loss per Bitcoin ATM scam was $10,000. People over 60 were more than three times as likely as younger adults to report losses. More than two-thirds of all dollars lost to Bitcoin ATM fraud were lost by older adults.
Romance and Investment Fraud
A second category involves what law enforcement calls "pig butchering" schemes. Criminals develop relationships with victims through social media or dating applications. They gradually convince the victim to invest in cryptocurrency. The victim is directed to a Bitcoin ATM to deposit funds. The cryptocurrency is routed to wallets controlled by the fraud network, which often operates overseas.
Drug Proceeds and Direct Money Laundering
The third category involves direct laundering of criminal proceeds. In the Virtual Assets LLC case in the Northern District of Illinois, prosecutors alleged that the operation processed proceeds from both wire fraud and narcotics trafficking. The Bitcoin ATMs served as the conversion point, turning physical cash into cryptocurrency that was then moved through a series of wallet transfers to obscure its origin.
What to Do if You Receive a Subpoena, Grand Jury Target Letter, or Agent Contact
Frequently Asked Questions
What federal crimes can a Bitcoin ATM operator be charged with?
Bitcoin ATM operators face potential liability under several federal statutes. Money laundering conspiracy under 18 U.S.C. § 1956 carries up to 20 years in prison. Operating an unlicensed money transmitting business under 18 U.S.C. § 1960 carries up to five years. Willful violations of BSA anti-money laundering requirements carry criminal penalties under 31 U.S.C. § 5322. If an operator knowingly facilitates fraud by processing transactions tied to wire fraud or other schemes, conspiracy charges under 18 U.S.C. § 371 may also apply.
Is a Bitcoin ATM operator required to register with FinCEN?
Yes. FinCEN classifies Bitcoin ATM operators as money transmitters and therefore money services businesses under the Bank Secrecy Act. Operators must register with FinCEN by filing Form 107 within 180 days of establishing the business and renew every two years. They must also implement a written anti-money laundering program, establish KYC procedures, file CTRs for transactions over $10,000, and file SARs for suspicious transactions of $2,000 or more.
What happened in the Virtual Assets LLC indictment?
In November 2025, a federal grand jury in the Northern District of Illinois indicted Firas Isa and his company, Virtual Assets LLC (d/b/a Crypto Dispensers), on one count of money laundering conspiracy under 18 U.S.C. § 1956. Prosecutors alleged that between 2018 and 2025, the operation processed at least $10 million in criminal proceeds through cryptocurrency ATMs. The funds were allegedly tied to wire fraud and narcotics trafficking. Both defendants pleaded not guilty.
What is the difference between a criminal prosecution and a state AG lawsuit against a Bitcoin ATM operator?
A federal criminal prosecution seeks prison time, criminal fines, and asset forfeiture. It requires proof beyond a reasonable doubt. A state attorney general lawsuit is a civil enforcement action seeking restitution, civil penalties, and injunctive relief under consumer protection statutes. It requires a lower standard of proof. Both actions can proceed simultaneously. An operator may face criminal and civil liability arising from the same conduct. Statements made in civil proceedings can be used in criminal cases.
What are the BSA requirements for Bitcoin ATM operators?
Under the Bank Secrecy Act and FinCEN's implementing regulations, operators must register as money services businesses, develop and implement a written AML program, designate a compliance officer, conduct ongoing employee training, file CTRs for transactions exceeding $10,000, file SARs for suspicious transactions of $2,000 or more, maintain transaction records for five years, and screen customers against the OFAC Specially Designated Nationals list.
Can an operator face criminal liability for customer transactions?
Yes. If an operator knows or deliberately avoids knowing that customer transactions involve proceeds of criminal activity, the operator faces potential money laundering charges under 18 U.S.C. §§ 1956-1957. Willful failure to implement BSA-required AML controls can itself be a criminal offense. Federal prosecutors have charged operators with conspiracy when evidence shows the operator facilitated fraud by ignoring red flags, failing to file SARs, or structuring the business to avoid regulatory detection.
What is the Crypto ATM Fraud Prevention Act?
The Crypto ATM Fraud Prevention Act is federal legislation introduced by Senator Dick Durbin in February 2025. It would impose daily transaction limits of $2,000 for new users and $10,000 over a 14-day period, require operators to speak directly with new customers seeking transactions over $500, and mandate full refunds when customers file police reports and notify the operator within 30 days. The bill had not been enacted as of March 2026.
What state laws now regulate Bitcoin ATM operators?
State-level regulation is expanding rapidly. In August 2025, Illinois enacted the Digital Asset Kiosk Act (SB 2319), requiring operators to register with IDFPR, capping transaction fees at 18%, limiting daily transactions to $2,500 for new customers, and mandating refunds for scam victims. California, New York, and Louisiana have enacted digital asset regulations that affect kiosk operators. Some municipalities, including St. Paul, Minnesota, have voted to ban Bitcoin ATMs outright.
How does willful blindness apply to Bitcoin ATM operators?
Willful blindness, sometimes called deliberate ignorance, is a legal doctrine that allows a jury to find that a defendant "knew" about criminal activity if the defendant deliberately avoided confirming a fact that was highly probable. For Bitcoin ATM operators, structuring the business to avoid learning whether transactions involve criminal proceeds, failing to implement KYC procedures, and ignoring patterns of suspicious activity can all support a willful blindness instruction at trial. Courts treat deliberate ignorance as the legal equivalent of actual knowledge.
What forfeiture risks do Bitcoin ATM operators face?
A money laundering conviction under 18 U.S.C. § 1956 triggers mandatory criminal forfeiture of all property involved in the offense and all property traceable to proceeds of the offense. This can include the cryptocurrency ATMs themselves, bank accounts, cryptocurrency wallets, vehicles, real property, and any other assets acquired with or connected to laundered funds. If specific property cannot be located, the government may pursue substitute assets of equivalent value.
How do Scott Armstrong and Drew Bradylyons at Armstrong & Bradylyons PLLC defend crypto fraud and money laundering cases?
Scott Armstrong has first-chair trial and investigation experience defending individuals across the cryptocurrency market. His nationwide crypto fraud defense practice involves high-stakes defense of individuals facing allegations of wire fraud, money laundering, computer fraud, and conspiracy. As an Assistant Chief at DOJ, Scott tried the first-ever federal criminal case involving the manipulation of a cryptocurrency through an algorithm that placed over $300 million in spoof orders and wash trades. He supervised investigations and prosecutions involving cryptocurrency Ponzi schemes, "rug pulls" involving NFTs, "pig butchering" schemes, and investment fraud involving various digital assets. Drew Bradylyons, former Chief of EDVA's Financial Crimes and Public Corruption Unit, prosecuted complex financial crime cases involving cryptocurrency investment fraud and civil asset forfeiture of cryptocurrency proceeds. Together, they provide a trial-ready defense in federal cryptocurrency investigations brought by the DOJ Fraud Section, CCIPS, and U.S. Attorney's Offices around the country.
Where do Scott Armstrong and Drew Bradylyons defend crypto fraud and money laundering cases?
Scott Armstrong and Drew Bradylyons defend individuals and businesses in cryptocurrency fraud and money laundering investigations in federal courts nationwide. The firm is based in Washington, D.C., and regularly practices in the District of Columbia (D.D.C.), the District of Maryland (D. Md.), the District of New Jersey (D.N.J.), the Southern District of Florida (S.D. Fla.), the Eastern District of New York (E.D.N.Y.), and the Central District of California (C.D. Cal.), which covers Los Angeles. Armstrong & Bradylyons PLLC also defends clients in investigations and cases brought by DOJ's Fraud Section, the Computer Crime and Intellectual Property Section (CCIPS), and U.S. Attorney's Offices across the country. Federal cryptocurrency cases are not confined to a single jurisdiction. Bitcoin ATM operators, exchange founders, and individuals under investigation for money laundering or BSA violations may face charges wherever the relevant transactions occurred or where the financial institutions are located.
Under Investigation for Bitcoin ATM-Related Activity?
As a former Assistant Chief at DOJ's Fraud Section, Scott Armstrong has first-chair trial and investigation experience defending individuals and businesses in federal money laundering and cryptocurrency fraud investigations nationwide. As the former Chief of EDVA's Financial Crimes and Public Corruption Unit, Drew Bradylyons similarly defends clients facing federal financial crime charges, including money laundering, wire fraud, and BSA violations. Together, the attorneys at Armstrong & Bradylyons PLLC bring over 25 years of combined DOJ experience to the defense of complex federal cases.
