Crypto ATMs and peer-to-peer trades

As of September 2026: The DC and Iowa lawsuits against kiosk operators are allegations; this review did not confirm final outcomes. Kiosk rules are changing fast, with state limits, licensing and refund laws being added, so check current state law. FBI figures are complaint counts and reported losses, not audited totals.

Also called: bitcoin ATMs · crypto kiosks · CVC kiosks · P2P crypto marketplaces.

What are crypto ATMs and peer-to-peer trades?

A crypto ATM looks like a bank machine but works differently. You insert cash or a card, scan or type a wallet address, and the machine buys cryptocurrency and sends it there. The operator earns fees and often sits inside a convenience store, gas station, or cafe. FinCEN calls these machines convertible virtual currency (CVC) kiosks and treats their operators as money services businesses, which means they owe the same customer checks and reports as other money transmitters.

Peer-to-peer (P2P) trading is the same idea without a machine. A platform matches a person holding crypto with a person holding cash, or a gift card, or access to a bank account, and the two swap. Some P2P platforms verify everyone. Some hardly try.

Both are on-ramps. They sit at the border between the cash world and the crypto world, so they belong to placement: the moment when physical money or scam payments first become a digital asset in the criminal’s hands. From there the coins usually continue into layering.

The most visible harm is fraud, not classic laundering. Scammers phone older people, claim their bank account is compromised or that they owe the government money, and coach them to withdraw savings and feed it into a kiosk. But FinCEN’s August 2025 notice also says kiosks have been used to launder suspected drug proceeds, and the DEA reports that cartels are adopting crypto because it moves money across borders quickly.

How do crypto ATMs and P2P trades work for launderers?

1. Cash appears. The cash is either taken from a victim under false pretenses or is the proceeds of something like drug sales. Scam victims are often instructed step by step to withdraw money, find a kiosk, and deposit it, staying on the phone throughout.
2. The kiosk or trader converts it. The customer scans a QR code that contains the destination wallet address. The address belongs to the scammer or to the person collecting the proceeds, not to the person standing at the machine. On a P2P platform, a trader receives cash or a payment and releases coins.
3. Pooling. FinCEN describes scam operations combining payments from many victims into a single wallet before laundering the total.
4. Swap and hop. Proceeds are often swapped quickly into a stablecoin, frequently through cross-chain bridges, a form of chain-hopping that FinCEN’s notice describes. The stablecoin leg is covered in the related pages below.
5. Cash-out. The coins end up with an over-the-counter broker, an exchange account, or another off-ramp.

Two twists matter to investigators. First, FinCEN says law enforcement has seen scammers steer victims to particular kiosks, sometimes across state lines, likely to avoid operators with strong controls. Second, some scammers tell victims to split deposits into several smaller ones or to use more than one machine. That can look like structuring or smurfing, except the victim is doing it under instruction and does not know why.

Why do crypto ATMs and P2P trades work?

Cash meets crypto with little friction. Banks watch cash deposits closely. A kiosk turns cash into coins on the spot, and the coins can leave for anywhere. The customer only needs to hold a QR code.

Irreversibility. Bank transfers can sit pending for a day or two, and banks can sometimes claw payments back. A blockchain transfer cannot be recalled. FinCEN notes that the recipient owns the coins instantly and often moves them on right away.

Fees do not deter criminals. FinCEN reports kiosk fees ranging from 7 to 20 percent, and scammers accept them for fast receipt of the coins. The Iowa Attorney General alleged fees of 23 percent and 21 percent at two operators. The DC Attorney General alleged fees of up to 26 percent per transaction at a third. A cost that would ruin a legitimate business is just overhead for a scam.

Uneven compliance. FinCEN’s notice pointed to a 2021 New Jersey Commission of Investigation finding that more than a third of the kiosk companies operating in that state had not registered with FinCEN as money services businesses. Registration is a legal duty, not a stamp of approval, and FinCEN warns that some non-compliant operators tell banks they are registered while skipping the actual controls.

Familiarity. A kiosk resembles an ATM. A frightened person who has never used a wallet can follow a scammer’s instructions to a machine. That is a social weakness, not a technical one, and it explains why the FBI reported that more than half of kiosk complaints came from people over 50.

Real cases: Herocoin and Paxful

Herocoin. Kais Mohammad, a former bank employee who had trained others on compliance, ran Herocoin in Orange County, California, from December 2014 to November 2019. He offered bitcoin-to-cash exchange at commissions of up to 25 percent, well above market rates, and ran a network of kiosks. According to the US Attorney’s Office for the Central District of California, as described in FinCEN’s notice, the machines let customers transact without identification and make consecutive transactions of up to $3,000 each without any suspicious activity report. FinCEN had contacted him in July 2018 about registering; he did so, but kept failing to do due diligence and report. He pleaded guilty in September 2020 to operating an unlicensed money transmitting business, money laundering, and failing to maintain an effective anti-money-laundering program, and was sentenced on May 28, 2021 to 24 months in prison. Prosecutors said he exchanged up to $25 million, some of it for criminals.

Paxful. Paxful ran a P2P marketplace where users traded virtual currency for fiat currency, prepaid cards and gift cards. DOJ said that from January 2017 to September 2019 it facilitated 26.7 million trades worth about $3 billion and collected $29.7 million in revenue, while not implementing know-your-customer checks, presenting anti-money-laundering policies to outsiders that were not enforced, and not filing suspicious activity reports. Among the flows DOJ described were about $17 million in bitcoin sent to Backpage and similar sites. Paxful agreed in December 2025 to plead guilty to conspiracy to violate the Travel Act, to operate an unlicensed money transmitting business, and to violate the Bank Secrecy Act. On February 10, 2026 it was sentenced in the Eastern District of California to a $4 million criminal penalty, set by its ability to pay against a calculated $112.5 million. An Assistant Attorney General said it profited by touting its lack of anti-money-laundering controls.

State actions. In February 2025 the Iowa Attorney General sued two large kiosk operators under the state consumer fraud law, saying Iowans sent more than $20 million through their machines over less than three years. In September 2025 the DC Attorney General sued a third operator, alleging that 93 percent of deposits at its machines were the direct result of scams and that 48 percent of funds deposited led consumers to report to the company that they had been scammed. These are allegations, not findings.

How does it get caught?

Operator duties. Kiosk operators must file suspicious activity reports on transactions of $2,000 or more that look suspicious. FinCEN’s notice lists what to watch for: payments just under thresholds from several locations, one wallet receiving deposits from unrelated customers in different places, and several customers tied to the same phone number or address.

Blockchain analytics. Because scam proceeds are pooled into a small number of wallets, tracing connects payments made by different victims at different times. FinCEN says blockchain analysis can link kiosk payments and flag wallets tied to fraud, and that chain-hopping into stablecoins does not erase that trail.

Banks and tellers. A bank customer withdrawing an unusual amount of cash, especially an older one who mentions a caller’s instructions, is a prompt for staff to intervene. FinCEN lists this as a red flag for banks. Banks also look at who their kiosk-operator customers are, since FinCEN describes non-compliant operators giving false information to open accounts.

Prosecution of operators. The Herocoin sentence and the Paxful plea show that an operator’s willful indifference is itself a crime, even when the operator committed no fraud personally. Federal prosecutors have also used unlicensed money transmitting charges against kiosk operators.

Limits and laws. State rules now set daily limits and disclosures. California’s law, for example, prohibits accepting or dispensing more than $1,000 per day per customer at a kiosk, according to FinCEN’s notice. Learn more about how detection works across banks and platforms, or see how thresholds shape reporting.

First published September 21, 2026 · Last updated September 21, 2026 · Legal statuses current as of September 2026