Read the full stored bill text
HB303 ENROLLED
Page 0
HB303
9JC44MP-3
By Representative Bedsole
RFD: State Government
First Read: 21-Jan-26
1
2
3
4
5
HB303 Enrolled
Page 1
First Read: 21-Jan-26
Enrolled, An Act,
Relating to cryptocurrency; to add Section 8-7A-28 to
the Code of Alabama 1975; to require operators of
cryptocurrency kiosks to provide certain disclosures during a
transaction; to require that kiosk operators provide a receipt
for a cryptocurrency transaction; to implement certain fraud
protection measures for cryptocurrency kiosk transactions and
require refunds for fraudulently induced transactions; and to
provide for certain civil and criminal penalties.
BE IT ENACTED BY THE LEGISLATURE OF ALABAMA:
Section 1. Section 8-7A-28 is added to the Code of
Alabama 1975, to read as follows:
§8-7A-28
(a) This section shall be known and may be cited as the
Cryptocurrency Kiosk Fraud Prevention Act.
(b) For purposes of this section, the following terms
have the following meanings:
(1) BLOCKCHAIN ANALYTICS. Analysis of data from
blockchains or publicly distributed ledgers, including
associated transaction information.
(2) BLOCKCHAIN ANALYTICS AND TRACING SOFTWARE. A
software service that uses blockchain analytics data to
provide risk-specific information and tracing of virtual
currency wallet addresses, among other virtual items.
(3) CONSUMER. Any individual who uses a cryptocurrency
kiosk.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
HB303 Enrolled
Page 2
kiosk.
(4) CRYPTOCURRENCY. A virtual representation of value
or rights that can be transferred, stored, or traded
electronically and used for payments or investment purposes.
(5) CRYPTOCURRENCY ADDRESS. An alphanumeric identifier
that represents a potential destination for a cryptocurrency
transfer. A cryptocurrency address is associated with a
virtual wallet.
(6) CRYPTOCURRENCY KIOSK. A physical, electronic
terminal that is a mechanical agent of the cryptocurrency
kiosk operator and that enables a cryptocurrency kiosk
operator to facilitate the purchase, sale, or exchange of
cryptocurrency for money, bank credit, or other
cryptocurrency.
(7) EXISTING CONSUMER. Any consumer who engages in a
cryptocurrency kiosk transaction that is not the consumer's
initial transaction or within the 30-day period immediately
following his or her initial transaction.
(8) FEE. A charge or expense paid by the consumer.
(9) FINANCIAL INSTITUTION. Any bank, savings and loan
association, or credit union operating in Alabama which is
chartered under federal or state statutes.
(10) NEW CONSUMER. A consumer who is engaging in a
transaction at a cryptocurrency kiosk in this state for the
first time or who is within the 30-day period immediately
after engaging in his or her first cryptocurrency kiosk
transaction.
(11) OPERATOR. Any person that engages in
cryptocurrency business activity through a cryptocurrency
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
HB303 Enrolled
Page 3
cryptocurrency business activity through a cryptocurrency
kiosk located in Alabama or operates or manages a
cryptocurrency kiosk.
(12) PRIVACY COIN. A cryptocurrency with
privacy-enhancing features designed to increase anonymity and
reduce or eliminate the ability for the cryptocurrency to be
traced using blockchain analytics and tracing software.
(13) TRANSACTION. A transaction conducted or performed
through a cryptocurrency kiosk to purchase or sell
cryptocurrency.
(14) TRANSACTION HASH. A unique identifier consisting
of a string of characters that acts as a record of and
provides proof that the transaction was verified and added to
the blockchain.
(15) VIRTUAL WALLET. A software application or other
electronic mechanism that provides a means to hold, store, or
transfer cryptocurrency or nonfungible tokens.
(c)(1) A cryptocurrency kiosk operator shall disclose
in a clear and conspicuous manner all relevant terms and
conditions to use the products, services, kiosks, and other
activities of the operator. The operator shall receive an
acknowledgment of receipt of all disclosures required from a
consumer through confirmation or consent. This disclosure
shall include:
a. The United States dollar amount of the
cryptocurrency involved in the transaction;
b. A listing, in United States dollars, of all fees to
be collected by the cryptocurrency kiosk operator;
c. The total amount, in both the cryptocurrency and
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
HB303 Enrolled
Page 4
c. The total amount, in both the cryptocurrency and
United States dollars, used in the transaction; and
d. The exchange rate clearly showing the difference
between the market price of the cryptocurrency and the price
of the cryptocurrency charged to the consumer.
(2)a. At the beginning of a transaction at a
cryptocurrency kiosk, the operator shall ensure that the kiosk
displays the following disclosures:
"WARNING: CONSUMER FRAUD OFTEN STARTS WITH CONTACT FROM
A STRANGER ONLINE, BY PHONE, OR BY TEXT WHO IS INITIATING A
DISHONEST SCHEME OR CRIMINAL OR FRAUDULENT ACTIVITY THAT MAY
APPEAR IN MANY FORMS, INCLUDING THE FOLLOWING:
1. COMMUNICATION INITIATED BY SOMEONE STARTING A
ROMANTIC RELATIONSHIP WHO BEGINS ASKING FOR FUNDS FOR REASONS
SUCH AS AN EMERGENCY OR TO PAY TO VISIT YOU.
2. PROMPTS TO CLICK ON DESKTOP POP-UPS THAT INCLUDE
VIRUS WARNINGS OR COMMUNICATION FROM ALLEGED FAMILIAR
MERCHANTS.
3. COMMUNICATIONS FROM SOMEONE IMPERSONATING A
REPRESENTATIVE OF YOUR BANK OR A LAW ENFORCEMENT OFFICER.
4. CLAIMS OF A FROZEN BANK ACCOUNT OR CREDIT CARD.
5. CLAIMS OF A FRAUDULENT BANK TRANSACTION.
6. CLAIMS OF IDENTITY THEFT OR AN OFFER OF EMPLOYMENT
IN EXCHANGE FOR PAYMENT.
7. REQUESTS FOR A PAYMENT TO A GOVERNMENT AGENCY OR
COMPANY.
8. REQUESTS FOR DISASTER RELIEF DONATIONS OR LOANS.
9. OFFERS TO PURCHASE LOTTERY TICKETS, SWEEPSTAKES, OR
DRAWINGS FOR VEHICLES.
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
HB303 Enrolled
Page 5
DRAWINGS FOR VEHICLES.
10. CLAIMS OF WINNING A LOTTERY BUT REQUIRES UP-FRONT
FEES TO BE PAID BEFORE COLLECTING ANY WINNINGS.
11. COMMUNICATION FROM SOMEONE OFFERING TO TEACH YOU
HOW TO TRADE CRYPTOCURRENCY.
IF YOU BELIEVE THAT YOU ARE A VICTIM OF FRAUDULENT
CONDUCT, STOP AND CALL YOUR LOCAL LAW ENFORCEMENT AGENCY AND
THE CRYPTOCURRENCY KIOSK OPERATOR."
"WARNING: LOSSES DUE TO FRAUDULENT OR ACCIDENTAL
TRANSACTIONS MAY NOT BE RECOVERABLE. TRANSACTIONS IN
CRYPTOCURRENCY ARE IRREVERSIBLE. PEOPLE MAY USE CRYPTOCURRENCY
TRANSACTIONS TO STEAL YOUR MONEY BY IMPERSONATING THE
GOVERNMENT, ORGANIZATIONS, OR PEOPLE YOU KNOW. IMPERSONATORS
MAY THREATEN JAIL TIME, CLAIM YOUR IDENTITY HAS BEEN STOLEN,
ALLEGE THAT YOUR COMPUTER HAS BEEN HACKED, OR USE A NUMBER OF
OTHER SCAMS. DO NOT DISCLOSE YOUR PRIVATE KEY THAT IS
ASSOCIATED WITH YOUR VIRTUAL WALLET TO A THIRD PARTY. IF YOU
BELIEVE THAT YOU ARE BEING SCAMMED, STOP AND CALL YOUR LOCAL
LAW ENFORCEMENT AGENCY AND THE CRYPTOCURRENCY KIOSK OPERATOR."
b. The kiosk shall display the disclosures in a
conspicuous font and a color that contrasts with the
background of the kiosk screen.
c. Each disclosure shall appear separately on the
kiosk, and both disclosures must be accepted by the consumer
before the transaction may be executed.
(d) At the completion of each transaction, the operator
shall provide the consumer who made the transaction a physical
or digital receipt that contains all of the following
information:
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
HB303 Enrolled
Page 6
information:
(1) The operator's name and contact information,
including a telephone number to answer questions and register
complaints.
(2) The type, value, date, and precise time of a
transaction, and each applicable receiving cryptocurrency
address in its entirety. If a digital receipt is selected, the
operator shall provide the entire transaction hash in addition
to the aforementioned items.
(3) The name and contact information of the sender.
(4) The name and contact information of the designated
recipient if known.
(5) Fees charged by the operator.
(6) The exchange rate of the applicable cryptocurrency
to the United States dollar.
(7) A statement of the operator's refund policy.
(8) A statement of the refund policy required by this
section.
(9) Any additional information required by rule or
order of the commission under this chapter.
(e) If a consumer opts for a digital receipt pursuant
to subsection (c), the operator shall provide the receipt to
the email address or phone number provided by the consumer and
to the commission.
(f)(1) A cryptocurrency kiosk operator shall use
blockchain analytics and tracing software to prevent any
transaction that involves a cryptocurrency address identified
as being associated or affiliated with fraud or other criminal
activity. If a consumer attempts to transact with a virtual
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
HB303 Enrolled
Page 7
activity. If a consumer attempts to transact with a virtual
wallet that is detected to be associated or affiliated with
fraud or other criminal activity, the kiosk shall not execute
the transaction.
(2)a. For a new consumer, an operator shall not accept
transactions of more than one thousand United States dollars
($1,000) in cash, or the equivalent amount of foreign currency
or cryptocurrency, in one calendar day, or ten thousand United
States dollars ($10,000) in cash, or the equivalent amount of
foreign currency or cryptocurrency in a calendar month, from
the same consumer, regardless of whether the consumer uses one
or multiple kiosks in the state.
b. For an existing consumer, an operator shall not
accept transactions of more than ten thousand five hundred
United States dollars ($10,500) in cash, or the equivalent
amount of foreign currency or cryptocurrency, in one calendar
day.
c. An operator shall use an identification verification
process, operated in accordance with federal law, to verify
the identity of every consumer for each transaction in order
to comply with this subsection for all transactions.
(g) An operator shall provide enhanced due diligence
protections for consumers who are 60 years of age or older.
The commission shall adopt rules, pursuant to Section 8-7A-26,
to implement this requirement.
(h) All operators headquartered in the United States
shall provide live, United States-based, toll-free consumer
service at all times. Operators shall prominently display the
consumer service phone number on the cryptocurrency kiosk or
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
HB303 Enrolled
Page 8
consumer service phone number on the cryptocurrency kiosk or
on the kiosk screen during the transaction. The operator shall
report all calls from consumers in Alabama regarding fraud to
the commission upon request of the commission.
(i)(1) Operators shall provide a United States phone
number and email address to serve as a dedicated communication
line between the operator and relevant government agencies.
This dedicated line shall be frequently monitored and used to
facilitate law enforcement and regulatory agency
communications with the operator.
(2) At the request of the commission, an operator shall
provide the requesting agency with data from the operator's
blockchain analytics and tracing software or any other
information regarding that data.
(j)(1)a. If a new consumer has been fraudulently
induced to engage in a cryptocurrency kiosk transaction and
has completed the requirements of subdivision (2), the
operator shall issue a full refund for the fraudulently
induced transaction, as well as all fees incurred through the
transaction.
b. If an existing consumer has been fraudulently
induced to engage in a cryptocurrency kiosk transaction and
has completed the requirements of subdivision (2), the
operator shall issue a refund for one-half of the value of the
transaction, including all fees incurred through the
transaction.
(2) The consumer shall complete all of the following to
receive the refund pursuant to subdivision (1):
a. Contact the operator not more than 60 calendar days
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
HB303 Enrolled
Page 9
a. Contact the operator not more than 60 calendar days
after the cryptocurrency kiosk transaction.
b. Contact a law enforcement agency, as well as the
commission, not more than 60 calendar days after the
transaction.
c. File a report with a law enforcement agency or the
commission regarding the fraudulently induced transaction.
(3) A consumer who has been determined to be a victim
of fraud is eligible to receive a refund regardless of whether
an operator provided the disclosures prescribed in subsection
(c) and the receipt required in subsection (d).
(4) An operator shall maintain a report of all refund
requests made. The operator shall provide to the commission
the name and contact information of the consumer who made the
request, as well as the information on the receipt, upon
request of the commission.
(k) An operator shall not share a kiosk with any
financial institution and shall not use any signage that makes
the cryptocurrency kiosk appear to be affiliated with or
represented by any financial institution.
(l) An operator shall comply with all federal reporting
requirements under the Bank Secrecy Act of 1970, Pub. L. No.
91-508, the USA PATRIOT Act, Pub. L. No. 107-56, and any other
reporting requirement imposed from the Financial Crimes
Enforcement Network or the Office of Foreign Assets Control.
(m) An operator shall not permit the buying, selling,
or sending of privacy coins from cryptocurrency kiosks or
online platforms in any capacity.
(n)(1) The commission, pursuant to Section 8-7A-19, may
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
HB303 Enrolled
Page 10
(n)(1) The commission, pursuant to Section 8-7A-19, may
assess a civil penalty against a person that violates this
section or a rule adopted or an order issued under this
section.
(2) Any proceeding under this section pursued by the
commission shall not preempt any criminal action or civil
liability which may arise under any other state law.
Section 2. This act shall become effective on October
1, 2026.
253
254
255
256
257
258
259
260
HB303 Enrolled
Page 11
1, 2026.
________________________________________________
Speaker of the House of Representatives
________________________________________________
President and Presiding Officer of the Senate
House of Representatives
I hereby certify that the within Act originated in and
was passed by the House 24-Feb-26, as amended.
John Treadwell
Clerk
Senate 17-Mar-26 Amended and Passed
House 31-Mar-26 Concurred in Senate
Amendment
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293