Author: BlockSec
Today, Australia's Minister for Home Affairs, Tony Burke, officially announced new regulations targeting cryptocurrency ATMs, clearly categorizing these devices as "high-risk products" associated with money laundering, fraud, and child exploitation. Burke stated that the number of cryptocurrency ATMs in Australia has surged from 23 to over 2,000 in six years. An investigation by the Australian Transaction Reports and Analysis Centre (AUSTRAC) found that in large user transactions, 85% of the funds were linked to fraud or money laundering activities. The proposed legislation will empower AUSTRAC to restrict or prohibit "high-risk products," specifically targeting cryptocurrency ATMs. Burke indicated that the relevant bill will be submitted to Parliament in the coming months.
Earlier, on August 4 of this year, the U.S. Department of the Treasury's Financial Crimes Enforcement Network (FinCEN) issued a notice numbered FIN-2025-NTC1, which primarily requires financial institutions to be vigilant against illegal activities related to convertible virtual currency kiosks (CVC Kiosks, i.e., cryptocurrency ATMs), standardizing suspicious activity report (SAR) submissions, and clarifying compliance requirements and risk warnings.
Why have cryptocurrency ATMs attracted strong attention from both the U.S. and Australia, and what role do they play in the criminal activities of wrongdoers? FinCEN has always been an important barometer for global Web3 regulation. Today, BlockSec provides a deep dive into the report released by FinCEN in 3,500 words.
1. What is a CVC Kiosk?
A CVC Kiosk is a device similar to an ATM that allows users to exchange fiat currency for virtual currency or vice versa. They are commonly found in convenience stores, gas stations, and other crowded places, generating profit through transaction fees. Most support Bitcoin transactions and can also handle Litecoin, Ethereum, and other virtual currencies.
（Wallet address and related transactions of BitNational ATM）
Data shows that the risks associated with these terminals are quite prominent. In 2024, the FBI's Internet Crime Complaint Center (IC3) received over 10,900 fraud complaints involving CVC Kiosks, with victims losing approximately $246.7 million, a 99% increase in complaints and a 31% increase in losses compared to 2023. The U.S. Federal Trade Commission (FTC) also found that fraud losses through these terminals have shown "explosive growth."
The reason fraudsters target CVC Kiosks lies in the transaction characteristics of virtual currencies—once a transfer is successful, it is nearly impossible to reverse, and funds can be received almost instantly, much faster than traditional bank transfers (which usually settle in 1-2 days), leaving victims with little chance to recover their money. Even more concerning is that the elderly population has become a primary target: individuals aged 60 and above are more than three times as likely to lose money to CVC Kiosk fraud compared to younger individuals, with $2 out of every $3 lost to CVC Kiosk fraud coming from seniors.
In addition to fraud, CVC Kiosks have also become "money laundering tools" for drug trafficking organizations. FinCEN's analysis of data related to the Bank Secrecy Act (BSA) found that these terminals are frequently used to launder drug proceeds. The U.S. Drug Enforcement Administration (DEA) further reported that transnational criminal organizations (TCOs), such as the "Jalisco New Generation Cartel," are increasingly relying on CVC Kiosks because they enable rapid cross-border transfers, avoiding the regulatory risks associated with cash smuggling. For example, in Illinois, there are currently 1,626 CVC Kiosks, with 1,167 located in Chicago alone, making this area a "disaster zone" for laundering drug money. DEA investigations have shown that criminals from other states even travel to Chicago specifically to use CVC Kiosks to convert cash earned from drug trafficking into virtual currency, which is then transferred to overseas accounts.
2. Current Status of CVC Kiosk Operators
（Global distribution map of CVC Kiosks）
As the number of CVC Kiosks worldwide surges (from 4,128 in the U.S. to 37,342 in six years, with approximately 224 deployed in Hong Kong, concentrated in commercial areas like Mong Kok), the compliance management of operators has become a key line of defense against risks. However, FinCEN has explicitly pointed out that the current compliance rate of CVC Kiosk operators in the U.S. is "concerning," with numerous violations further amplifying the risks of illegal activities.
1. What should compliant operators do?
According to the Bank Secrecy Act (BSA), CVC Kiosk operators typically fall under the category of "money services businesses (MSB)"—in simple terms, operating without completing MSB registration is akin to running a bank without a financial license, which constitutes "unqualified operation," and those found in violation will face criminal penalties. These operators must fulfill three core obligations:
Registration Obligation: They must complete MSB registration with FinCEN within 180 days of commencing operations; operating without registration is illegal.
Reporting Obligation: They must monitor transactions in real-time, and if they detect a single transaction or cumulative currency transaction exceeding $10,000, they must submit a Currency Transaction Report (CTR); if they suspect a transaction involves illegal activity, even if the amount is only $2,000, they must submit a Suspicious Activity Report (SAR).
Record-Keeping Obligation: They must retain customer identity information, transaction receipts, and other records for at least five years for regulatory review.
Additionally, some state governments in the U.S. have enacted stricter local regulations. For example, California's Digital Financial Assets Law explicitly states that a CVC Kiosk may not receive or disburse more than $1,000 to the same customer in a single day; Iowa has directly pursued legal action against operators that condone fraud— in February 2025, the state's Attorney General sued two CVC Kiosk operators for their violations, which led to Iowa residents being defrauded of over $20 million.
2. How chaotic are non-compliant operators?
On one hand, there are clear compliance requirements, while on the other, the violation rates remain high. Data shows that the number of CVC Kiosks in the U.S. has skyrocketed more than eightfold in six years, but behind this rapid expansion lies a significant number of operators "walking the line":
Unregistered Operators: A 2021 investigation by the New Jersey Commission revealed that over one-third of CVC Kiosk operators in the state had not registered with FinCEN as MSBs, constituting "unqualified operation."
Failure to Implement Customer Verification: Compliant terminals require customers to provide government-issued ID (such as a driver's license or passport) for identity verification, but many non-compliant operators, in an effort to "boost business," only require customers to provide a phone number or even an email to complete transactions, leaving opportunities for fraudsters.
Falsifying Information to Open Accounts: Some non-compliant operators falsify business licenses, conceal the true nature of their operations, or even use personal accounts or "fake company accounts" to handle cash deposits and withdrawals at terminals, evading regulatory scrutiny.
Splitting Transactions to Avoid Reporting: To avoid triggering CTR (the $10,000 threshold) or SAR (the $2,000 threshold), some operators assist customers in splitting transactions—for example, allowing customers to deposit $2,000 in five separate transactions or using multiple terminals to disperse transfers. This "structured transaction" is itself prohibited by federal law.
These violations not only turn CVC Kiosks into "hotbeds of crime" but may also implicate other financial institutions. FinCEN specifically warns that some non-compliant operators falsely claim to have "completed FinCEN registration and comply with all BSA requirements," misleading banks or exchanges into providing services, ultimately leading these financial institutions to become embroiled in illegal transaction risks.
3. The Cost of Non-Compliance
In its notice, FinCEN sounded the alarm with multiple real cases, demonstrating that the consequences of non-compliant operations are far more severe than imagined:
Orange County "Crypto ATM Network" Case: In 2021, former bank employee Kais Mohammad was sentenced to 24 months in prison for operating an illegal CVC Kiosk network. Between 2014 and 2019, through his company "Herocoin" and multiple CVC Kiosks, he processed approximately $25 million in funds (some of which came from criminal proceeds), failing to register as an MSB and deliberately neglecting anti-money laundering procedures—customers could transact without providing ID, and could split transactions to transfer $3,000 multiple times in a single day, while never submitting an SAR. Even after FinCEN warned him to register in 2018, he still refused to comply, ultimately facing legal consequences.
New Hampshire "Fake Business" Case: In 2022, three operators were convicted of telecommunications fraud for processing CVC Kiosk funds using "fake company accounts." They concealed the true nature of their operations when opening bank accounts, using personal accounts or fictitious "tech company" accounts to deposit and withdraw cash, assisting customers in splitting transactions to evade taxes, and were ultimately sentenced to fines and imprisonment.
FinCEN emphasized that these cases are not isolated incidents—dozens of non-compliant CVC Kiosk operators have been prosecuted in the U.S. in recent years, facing not only imprisonment but also the forfeiture of illegal proceeds, with maximum fines reaching millions of dollars.
3. Insights Behind the Risks of CVC Kiosks
The actions of FinCEN and Australia may seem to focus on the specific scenario of "offline cryptocurrency terminals," but they actually serve as a compliance wake-up call for the entire Web3 industry. From fraudsters exploiting terminal vulnerabilities for money laundering to operators facing legal consequences due to compliance failures, these cases reflect the core logic of "risk knows no boundaries, and compliance is never trivial" in the virtual currency sector. They also highlight the necessity of on-chain compliance tools—this is precisely the intention behind BlockSec's launch of Phalcon Compliance.
1. Compliance is not a choice; it is a matter of survival.
The explosive growth of CVC Kiosks sharply contrasts with the high violation rates, essentially reflecting a mindset among some practitioners that "regulation lags behind innovation." However, from FinCEN's strengthening of SAR reporting requirements to the DEA's tracking of transnational drug trafficking funds, it is evident that global regulation of virtual assets is shifting from "passive response" to "active prevention." Whether for offline CVC Kiosk operators or online exchanges and DeFi protocols, to avoid the risks of "fines + imprisonment," compliance must be embedded throughout the entire business process—this is precisely the need that Phalcon Compliance addresses. Leveraging a 400 million+ address label database and millisecond-level response API, it can accurately identify high-risk addresses related to fraud, gambling, and sanctions, leaving no room for "non-compliant operations" to hide.
2. Risk Traceability Determines Compliance Confidence
FinCEN repeatedly emphasizes in its notice that financial institutions must "clearly explain the sources of risk"—for example, whether the funds from CVC Kiosks are related to drug trafficking organizations or if there are suspicions of cross-address split transactions. This is particularly crucial in the Web3 space: the anonymity and cross-chain characteristics of virtual currencies often lead to fragmented fund flows, making traditional manual checks not only inefficient but also prone to missing key connections. Phalcon Compliance's visual fund flow mapping and cross-chain tracking capabilities precisely address this pain point: it can intuitively break down the complete path of funds from "source" to "destination," even marking the risk level of each transaction, allowing regulatory agencies to clearly understand "why this address is high risk," significantly reducing the cost of generating suspicious transaction reports (STRs).
3. Compliance is Not Exclusive to Large Enterprises; Lightweight Tools are Key to Breaking the Deadlock
Many small CVC Kiosk operators abandon compliance due to "high thresholds and costs of compliance tools," ultimately becoming "accomplices" to criminal organizations. This dilemma is common in the Web3 industry: small and medium-sized enterprises or individual users lack the compliance budgets of large institutions while facing the same regulatory pressures. The launch of the self-service subscription version of Phalcon Compliance is aimed at breaking this "compliance monopoly"—without complex development, users can register and choose KYT/KYA function packages as needed, even offering free quotas for initial experience. Whether for individuals checking address security or small and medium-sized enterprises responding to periodic regulatory requirements, they can build a professional compliance barrier at a high cost-performance ratio, truly achieving "professional on-chain risk control for just 1,000 yuan."
Innovation in Web3 should never come at the expense of safety and compliance. The risk cases of CVC Kiosks have already proven that only by deeply binding "technological innovation" with "compliance prevention" can virtual assets truly serve legitimate scenarios. Phalcon Compliance is the "compliance infrastructure" that BlockSec provides for the industry—enabling every practitioner to innovate safely within the regulatory framework, making on-chain risks preventable, controllable, and traceable.
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
