FinCEN Flags Rising Fraud Risks at Crypto Kiosks

On 4 August 2025, the Financial Crimes Enforcement Network issued a formal notice warning US financial institutions that convertible virtual currency (CVC) kiosks have become a preferred conduit for fraud, money laundering, and transnational crime. The FBI's 2024 data shows nearly 11,000 kiosk-related complaints and roughly $246.7 million in victim losses — a 99 percent jump in incident volume and a 31 percent rise in dollar losses versus 2023. For compliance officers, auditors, and CFOs at any firm that touches these machines directly or indirectly, the notice carries immediate operational weight.

What FinCEN Is Saying and Why It Matters Now

CVC kiosks are self-service terminals that let customers swap fiat currency for digital assets such as bitcoin, ether, and stablecoins, and back again. They differ from traditional ATMs in one critical way: the funds move to or from a cryptocurrency wallet rather than a regulated deposit account. FinCEN has tracked these machines since 2013, but the agency's latest notice reflects a changed landscape. There are now more than 37,000 kiosks in operation across the United States, and the ecosystem around them has attracted increasingly sophisticated threat actors.

The notice is not targeted solely at institutions that bank kiosk operators. FinCEN's language is broader: any institution whose customers interact with these terminals, even occasionally, carries exposure under the Bank Secrecy Act framework. That framing matters because it pulls in community banks, credit unions, and payment processors that may not have considered themselves part of this risk picture at all.

Fraud Typologies Highlighted by FinCEN

The agency singles out impostor schemes as the most visible harm, with older adults disproportionately targeted. In a typical scenario, a fraudster poses as a government official, utility provider, or law enforcement contact and instructs the victim to deposit cash at a nearby kiosk, scanning a QR code that routes funds directly to a wallet the fraudster controls. The transaction clears in minutes, and recovery is rarely possible.

Beyond consumer fraud, the notice flags the involvement of transnational criminal organizations, including drug trafficking networks, that use kiosks to layer illicit proceeds and move value across borders quickly. The near-instant settlement and limited on-machine oversight make these terminals attractive for layering at scale, particularly when perpetrators rotate across multiple locations to stay below reporting thresholds.

Red Flags Financial Institutions Should Track

FinCEN's notice provides a set of behavioral indicators that institutions should incorporate into their monitoring logic. The list below is drawn directly from the advisory and is not exhaustive. Institutions must weigh each indicator against the customer's overall profile, transaction history, and the context of the specific activity before concluding that a filing is warranted.

Customer-Level Indicators

• A customer, particularly an elderly one, makes a first-time or unusually large crypto purchase with no prior pattern of digital asset activity.
• The customer appears coached or distracted, uses scripted language when explaining the transaction, or mentions receiving instructions from a third party.
• Multiple cash deposits at different kiosk locations occur within a short window, suggesting deliberate structuring to avoid reporting thresholds.
• The destination wallet address or QR code changes across repeated visits, indicating the recipient is rotating wallets to obscure the trail.

Operator and Account-Level Indicators

• A business account associated with a kiosk operator shows cash activity inconsistent with a registered money services business (MSB) profile.
• The operator cannot produce evidence of FinCEN MSB registration, a current AML policy, or an independent compliance audit.
• Transaction velocity on the account accelerates sharply without a corresponding change in the operator's reported business volume.
• Fund flows from the operator's account link to high-risk jurisdictions or show clustering patterns consistent with layering through decentralized finance protocols.

BSA Reporting Obligations and the SAR Reference Code

When a kiosk-related transaction meets the suspicious activity threshold, FinCEN's notice gives institutions a specific filing instruction: the reference code FIN-2025CVCKIOSK must appear in Field 2 of the SAR and be restated within the narrative. This tagging allows FinCEN to aggregate data across filers and map emerging typologies in near real time. Omitting the code does not invalidate the filing, but it reduces the agency's ability to build a national picture of kiosk-related crime patterns. Compliance teams should update their SAR templates and staff guidance to include this reference as a standing default for all kiosk-related reports.

The notice also reiterates that filing a SAR does not require certainty. If a transaction or pattern raises a reasonable suspicion that illicit activity may be occurring, the filing obligation is triggered. Institutions should resist the temptation to wait for definitive proof before acting, particularly given the speed at which kiosk transactions clear.

Program-Level Actions: What Compliance Teams Should Do

The advisory stops short of prescribing specific program structures, but it is direct about expectations. Institutions need controls calibrated to kiosk-specific risk, not generic digital asset monitoring rules that were written before these machines proliferated. The following actions align with FinCEN's guidance and with broader BSA examination expectations.

Strengthen Transaction Monitoring

Existing alert logic that flags large or unusual crypto-related transactions may not catch the velocity patterns associated with kiosk fraud. Institutions should implement tiered thresholds that detect rapid, repeated purchases across multiple machines over short periods. Geographic risk scoring should be layered in, with alerts escalating automatically when activity clusters around known high-density kiosk corridors. For customers in higher-risk demographic segments, first-time crypto purchase alerts add an additional early-warning layer.

For institutions that use digital asset accounting software or crypto bookkeeping software to reconcile digital asset flows, this is also a moment to confirm that the data feeds from kiosk-linked accounts are captured within the monitoring perimeter. Gaps in data ingestion can create blind spots that survive until an examiner finds them. Ensuring that your crypto accounting software integrates kiosk transaction data is a practical step that compliance and finance teams can take in parallel.

Tighten Kiosk Operator Due Diligence

Any institution that provides banking services to a kiosk operator is exposed to the operator's compliance posture, not just its own. FinCEN's notice places the onus on banks to confirm MSB registration status, review the operator's AML policies and procedures, and require written evidence of licensing before processing transactions. Onboarding documentation should be supplemented with periodic compliance attestations and, where the relationship warrants it, on-site AML audits. Operators that cannot meet these requirements should not be brought on, and existing relationships that fall short should be escalated to senior compliance leadership for a formal risk assessment.

Train Frontline Staff on Impostor Scheme Patterns

Branch staff are often the last line of defense before a fraud transaction completes. Teller-level training should cover the specific behavioral cues that FinCEN associates with coached victims: scripted explanations, urgency about completing a transaction quickly, reluctance to discuss the purpose, and references to government agencies or legal threats as the reason for the transfer. Scenario-based training, updated at least annually to reflect current typologies, is more effective than memo-only updates. Staff should have a clear escalation path to the BSA/AML officer when a transaction feels wrong but does not yet meet a hard reporting threshold.

Integrate Blockchain Forensics Into the Investigation Workflow

When a suspicious transaction is identified, standard AML investigation tools may not be sufficient to trace fund flows through the on-chain leg of the transaction. Integrating blockchain analytics into the SAR investigation process allows compliance teams to map wallet-destination patterns, identify layering through multiple protocols, and provide richer narratives in filings. This capability is increasingly expected by examiners in digital asset enforcement contexts. Firms that have already adopted digital asset accounting software with on-chain data integration are better positioned to extend this into the compliance workflow without building from scratch.

The notice's emphasis on proactive and agile controls signals that static, annual reviews of AML programs will not be sufficient. Institutions should build periodic threshold reviews, ideally quarterly for the highest-risk segments, into their governance calendars, with documented evidence that controls are being updated in response to supervisory guidance and observed typologies. For context on how US banking regulators have been escalating their expectations across digital asset risk categories, see our coverage of US banking regulators warning on crypto exposure. The stablecoin-specific compliance landscape is also shifting rapidly; the OCC's finalized GENIUS Act stablecoin rule adds another layer of regulatory expectation that institutions with kiosk exposure will need to integrate into their broader digital asset risk frameworks.

Accounting and Audit Implications

For accounting firms and CFOs advising financial institution clients, the FinCEN notice creates several immediate considerations beyond the compliance program itself.

First, institutions that bank kiosk operators or process kiosk-linked transactions carry a heightened BSA/AML risk profile. That profile should be reflected in audit risk assessments and in the scope of AML-related testing during internal and external audits. If kiosk-related activity is material to the institution's transaction volume, auditors should consider whether existing controls have been tested against the specific typologies FinCEN has now put on record.

Second, SAR-related contingent liabilities deserve attention. An institution that has been processing kiosk-linked transactions without adequate controls faces potential regulatory action if an examination reveals gaps. While SARs themselves are confidential, the adequacy of the underlying program is not. Institutions should document the steps they have taken in response to the August 2025 notice as evidence of good-faith remediation.

Third, for clients using crypto bookkeeping software or digital asset accounting software to manage any aspect of their digital asset holdings or reconciliations, this is a timely moment to confirm that these systems are producing audit trails that meet BSA record-keeping standards. FinCEN's record-keeping rules for MSBs and the broader transaction monitoring requirements for banks both demand accessible, timestamped records that can be produced promptly in the event of an examination or law enforcement request.

Source: Forvis Mazars

Frequently Asked Questions

What is a CVC kiosk and how does it differ from a regular ATM?

A convertible virtual currency kiosk is an electronic terminal that lets a user exchange cash for a digital asset, such as bitcoin or a stablecoin, or the reverse. Unlike a standard ATM, which connects to a deposit account at a regulated bank, a CVC kiosk routes funds to or from a cryptocurrency wallet. That distinction means the receiving institution has far less visibility over where the funds go once the transaction clears.

Which institutions are covered by FinCEN's August 2025 notice?

The notice is addressed broadly to financial institutions subject to the Bank Secrecy Act, including commercial banks, community banks, credit unions, and payment processors. It applies not only to institutions that directly bank kiosk operators but also to those whose customers use kiosks, even if the institution has no direct commercial relationship with the kiosk business itself.

What is the SAR reference code and why does it matter?

FinCEN has designated the code FIN-2025CVCKIOSK for use in Field 2 and the narrative of any SAR related to CVC kiosk activity. Using this code allows FinCEN to aggregate filings across institutions and identify systemic patterns more quickly. Institutions should build this reference into their SAR templates for all kiosk-related filings going forward.

How should an audit firm assess a financial institution client's kiosk-related risk?

Start by determining whether the institution banks kiosk operators or has retail customers who regularly use kiosks. If so, test whether the institution's transaction monitoring rules include kiosk-specific thresholds and behavioral flags. Review whether staff training materials have been updated to reflect the typologies in the FinCEN notice, and check that SAR filings from the relevant period include the designated reference code. Document findings and management's remediation response as part of the AML audit workpapers.

Does the notice create new legal obligations or does it reinforce existing ones?

The notice reinforces and clarifies existing BSA/AML obligations rather than creating new statutory requirements. However, it is now part of the documented supervisory record. Examiners will use it as a benchmark when assessing whether an institution's controls are reasonably designed to detect the specific typologies described. An institution that was unaware of or chose not to act on the notice would have limited grounds to argue it lacked notice of the risk.