CVC Kiosks: What You Need to Know
The first “crypto ATM” in America went online in Albuquerque in February of 2014. By the end of 2025 there were estimated to be over 30,000 convertible virtual currency (CVC) kiosks operating across the country.
Convertible currency kiosks, often referred to as cryptocurrency ATMs, allow customers to quickly exchange physical currency for digital currencies like Bitcoin, taking payment in cash or via credit card. Some also allow users to sell crypto. In 2024, the FBI’s Internet Crime Complaint Centre experienced a 99% year-on-year increase in complaints involving CVC kiosks, with a total loss to victims of approximately $246.7 million. Subsequently, in August of last year, FinCEN issued Notice FIN-2025-NTC1 warning financial institutions to “be vigilant in identifying and reporting suspicious activity involving CVC kiosks”.
With easy-to-use interfaces and their ongoing proliferation in convenient locations, kiosks are a fast, straightforward way to convert physical currency into cryptocurrency. It can be a seemingly straightforward proposition for customers who have heard of or have some interest in cryptocurrency but don’t have a strong understanding of the more complex technology that has previously been necessary for its use.
It’s simple to see the benefits of that offering, but the potential risks are also self-evident. CVC kiosks require identification to use, but what form of ID they request ranges widely – where some need a scan of a government issued ID, others only ask for information like a phone number. This creates clear AML and CTF risks.
A 2021 report from the State of New Jersey Commission of Investigation, cited in the FinCEN Notice, found that more than 33% of companies operating kiosks within the state had not registered as Money Service Businesses. These non-compliant kiosk operators are especially vulnerable to misuse by criminals – scammers have reportedly directed their victims to utilize specific kiosks which are known to have weak AML controls. Some of these non-compliant operators have been found to not have implement an AML/CTF program and to not be collecting or verifying customer identification at all.
Some types of suspicious activity that the FinCEN notice highlights including unusually high value transactions from customers without a history of similar, advertising for kiosks that boast of low or no ID requirements and customers making payments close to but under reporting thresholds across multiple accounts and kiosks.
They also suggest being wary of elderly customers carrying out large transactions who may be following remote instructions, especially if they’ve also recently made a significant cash withdrawal. Due to the speed of the transactions and the difficulty in recovering funds, CVC is very useful to criminals who would previously have scammed victims into bank or wire transfers.
Any business running a CVC kiosk should be registered as an MSB, which carries with it the obligation to comply with all Bank Secrecy Act obligations. The FinCEN notice points to the particular importance of Suspicious Activity Reporting. Institutions are required to file SARs when they know or suspect that a transaction that has been attempted or conducted through their business involves money derived from illegal activity, lacks a clear lawful purpose, is designed to evade regulations or could be used to facilitate crime. In addition to filing the report, the organization needs to maintain a copy of the SAR and any supporting documentation for five years from the date of filing.
FinCEN also notes the importance of information sharing between financial institutions and strongly encourages businesses to share information regarding individuals, organizations, and entities which they suspect of being involved in money laundering or terrorist financing.
As cryptocurrency becomes a more regulated, more easily accessible financial service, it will be vital for businesses to make sure they are operating in line with those regulations. I also think being viewed as highly compliant will benefit their image with consumers, shaking off the association many of the public still have between cryptocurrency and illegal activity.
Compliance reviews and audits are going to be critical. Firms need to be testing and documenting AML and KYC checks, securely and correctly storing that documentation and ensuring they can prove to relevant regulators and law enforcement that they’re doing everything necessary to identify and prevent fraudulent transactions.
How Can Kind Consultancy Help
If your organization operates CVC kiosks or is otherwise active in the virtual currency and digital asset space and you are concerned about complying with regulations, Kind Consultancy can support you.
As a specialist executive search and staffing firm, Kind Consultancy focusses exclusively on Governance, Risk, Compliance and Financial Crimes roles within Financial Services and Banking. Kind have led their niche in the UK for over a decade and are now bringing their expertise to customers in the US market who want to work with recruitment specialist with a genuine, deep understanding of the importance of financial regulations. We have worked with many firms going through regulatory change, and we can connect your firm to top-tier Financial Crime talent, on a permanent or contract basis.
Whether you’re developing and enhancing internal policies and controls, building out a permanent AML team, maybe you need a temporary KYC analysts or you’re looking for a Subject Matter Expert to oversee a specific regulatory transformation project, we can help.
Contact us today on (704) 663 6514 or lynsey.us@kindconsultancy.com
