What HB 505 does, in one table
| Requirement | Detail | From |
|---|---|---|
| Registration | Kiosk businesses must register with the Florida Office of Financial Regulation before operating; existing operators get 30 days from 1 Jan 2027 to apply | 1 Mar 2027 |
| New-customer daily cap | $2,000 per day for customers within their first seven days, aggregated across transactions and kiosks | 1 Jan 2027 |
| Standard daily cap | $10,000 per day for all other customers | 1 Jan 2027 |
| Fraud warnings | Displayed before a transaction, including asking whether the customer has used another kiosk that day | 1 Jan 2027 |
| Receipts | Physical or electronic, showing business contact details, transaction hash, source and destination wallet addresses, all fees, and refund policy | 1 Jan 2027 |
| First-transaction refund | Full refund within 72 hours where the victim notifies operator and law enforcement within 60 days with documentation | 1 Jan 2027 |
| Money transmitter exemption | Licensed money transmitters need no separate kiosk registration but must follow the conduct rules | 1 Jan 2027 |
Summary of the enacted bill as reported in the Florida Legislature's bill records and analyses. This is general information, not legal advice. The authoritative text is at flsenate.gov.
Why Florida passed it
The legislative record is unusually clear about the motivation, and it is not a general dislike of cryptocurrency. It is elder fraud.
FBI Internet Crime Complaint Center data cited during the 2026 session recorded 1,213 complaints involving cryptocurrency kiosks in Florida in 2025, with $32.8 million in adjusted losses. The victim profile in these cases skews heavily towards people over sixty, and the mechanism is consistent: a caller impersonating a bank, a utility, the Social Security Administration, Medicare or a sheriff's office instructs a victim to withdraw cash and deposit it at a specific machine, staying on the line throughout.
Representative Michael Owen sponsored the bill, which was framed explicitly around protecting seniors from schemes in which "scammers convince seniors to withdraw large sums of cash from their banks and deposit the money into crypto ATMs". AARP Florida publicly supported it.
The wider context was an industry already under pressure. Bitcoin Depot — the largest US kiosk operator, with roughly 9,700 machines including about 156 in Florida — filed for Chapter 11 in the Southern District of Texas on 18 May 2026, citing among other things multi-state attorney general litigation over allegations that it facilitated crypto scams. Florida's law arrived into a market that was already contracting.
Shifting cost onto operators rather than banning machines
Florida did not prohibit crypto kiosks. Instead it made fraud expensive for the operator — mandating a refund on a victim's first transaction — while requiring disclosures at the moment of the transaction. That is a deliberate policy choice: it keeps the product legal for legitimate users while removing the economics of a network that profits from scam volume.
Registration with the Office of Financial Regulation
Kiosk businesses must register with the Florida Office of Financial Regulation before operating in the state. Existing operators are given 30 days after 1 January 2027 to apply, and registration is required from 1 March 2027.
Businesses that already hold a Chapter 560 money transmitter licence — which many larger operators do — are exempt from the separate kiosk registration requirement, but they remain bound by the core conduct rules on caps, warnings, receipts and refunds.
The consumer-facing significance is that Florida will, for the first time, have a public register of who legally operates the machine in front of you. Today the only checks available are the operator's own website and, for licensed money transmitters, the NMLS register. From March 2027 the OFR register closes that gap.
The daily transaction caps
The tiered structure is the interesting part, and it is well targeted. Impersonation scams typically involve a first-time kiosk user pushed into a large transaction within hours. A $2,000 first-week ceiling does not stop a determined fraud, but it caps the single-day damage at a level that many victims can survive, and it forces the scheme to extend over days — creating more opportunities for a family member, teller or neighbour to intervene.
Because the caps are aggregated across machines, operators must ask, before each transaction, whether the customer has used another kiosk the same day. That question is not paperwork — it is designed to be the moment where a victim mid-scam says something true out loud.
For legitimate users the practical effect is modest. Anyone wanting to move more than $10,000 a day should not be using a kiosk regardless: at 11% to 22% all-in that would cost $1,100 to $2,200, against roughly $25 on a licensed exchange order book or a negotiated 0.2% to 1% at an OTC desk.
Fraud warnings and disclosures
From 1 January 2027, operators must display fraud warnings before a transaction completes. The statutory design has three elements worth noting.
- Pre-transaction, not post. The warning appears before you commit, which is the only point at which a warning can change an outcome.
- An interrogative element. The customer is asked whether they have used another kiosk the same day — a question that serves the aggregation requirement and simultaneously prompts reflection.
- On-screen, at the machine. Not buried in terms of service. The intervention happens where and when the money moves.
Will it work? Partially. Warning screens suffer from habituation, and a victim being coached by a caller may click through anything. But interventions of this kind do measurably reduce loss rates in comparable payment contexts, and the marginal case — someone who hesitates, reads, and hangs up — is exactly the case worth catching.
The receipt requirement
This provision has received the least attention and may be the most useful for ordinary consumers.
Operators must provide a physical or electronic receipt showing:
- The business's contact information
- The transaction hash — the blockchain identifier for the transfer
- The source and destination wallet addresses
- All fees charged
- The refund policy
Two consequences follow, and both are significant.
First, fee transparency. A Florida kiosk currently earns money in two layers: a stated on-screen percentage, and an exchange-rate markup buried inside the quoted price. The second layer is invisible, undisclosed and typically accounts for a third to a half of the total cost. A receipt showing all fees charged, alongside a transaction hash that lets anyone verify the exact amount of crypto actually delivered at a verifiable timestamp, makes that markup reconstructable after the fact for the first time.
Second, investigability. A transaction hash and destination address are what law enforcement needs to trace stolen funds. Currently victims often have nothing but a vague memory of a machine's location. The Florida Attorney General's Cyber Fraud Enforcement Unit recovered $5.4 million in a single case announced in April 2026; that kind of tracing work gets considerably easier when the victim walks in holding the hash.
From 2027, the receipt is evidence
Keep every kiosk receipt. It is your proof of the fee actually charged, your record of cost basis for tax purposes, the input law enforcement needs if something goes wrong, and the documentation the refund provision depends on. Photograph it as soon as you get it — thermal paper fades.
The 72-hour refund right
This is the provision that genuinely changes the risk profile of a Florida kiosk, and it is also the one most likely to be misunderstood — so here it is precisely.
What you get
A full refund of the transaction, paid within 72 hours of a compliant report.
What it covers
Your first transaction at that kiosk business only. Not the second, not the tenth.
What you must do
Notify both the kiosk business and law enforcement within 60 days, with supporting documentation such as a police report.
The limitation to the first transaction is deliberate and worth understanding rather than resenting. It targets the specific harm the legislature identified — a first-time kiosk user manipulated into a transaction — without creating an open-ended reversal mechanism that would make the product unworkable or invite abuse.
It also means the practical advice is narrow: if you are defrauded at a Florida kiosk, report it immediately, to both the operator and the police, and get documentation. Sixty days sounds generous, but victims of these scams frequently delay out of embarrassment, and the deadline is real.
- Stop. Do not make further transactions. Do not talk to the caller again.
- Report to law enforcement. Your local police or sheriff's office, and FBI IC3. Get a report number.
- Notify the kiosk operator in writing. Email is fine; keep a copy. Include the receipt, the transaction hash, the machine location, the date and time, and the police report reference.
- Notify the Florida Attorney General. The Cyber Fraud Enforcement Unit handles exactly this.
- Keep everything. Receipts, call logs, screenshots, bank withdrawal records.
Key dates
- Passed both chambersCS/HB 505 clears the Florida House and Senate.
- Signed by the GovernorThe bill becomes law.
- Substantive provisions take effectTransaction caps, fraud warnings, receipt requirements and the refund right all become operative. Existing operators have 30 days from this date to apply for registration.
- Registration requiredKiosk operators must be registered with the Florida Office of Financial Regulation to operate legally in the state.
What it means for you, in practice
If you use kiosks legitimately
- Expect to be verified. Per-customer caps require operators to know who you are.
- Expect an extra screen or two before each transaction.
- Keep receipts — they now contain your fee record and cost basis.
- Plan around $2,000 a day for your first week with any operator.
- Check the OFR register from March 2027 to confirm the operator is legal.
If you have a vulnerable relative
- The refund right is real, but only for a first transaction and only if reported within 60 days.
- Tell them now: report immediately, to the operator and the police, without embarrassment.
- The caps mean a single day's loss is bounded — but a scheme run over a week is not.
- The best protection is still a family rule: any urgent, secret money request gets a phone call first.
What the law does not do
Being clear-eyed about the limits is more useful than cheerleading.
- It does not cap fees. An operator can still charge 20% all-in. The receipt requirement makes that visible after the fact; it does not make it illegal.
- It does not cover the second transaction. A victim defrauded twice has a right to one refund. Scammers will learn this.
- It does not reach online platforms. Investment fraud through fake trading websites — the costliest crypto fraud category in Florida by dollar value — is untouched by HB 505 and remains a federal and general consumer-protection matter.
- It does not stop romance-to-investment fraud, which typically routes through exchanges and wallets rather than kiosks.
- It cannot recover funds already sent. The refund obligation falls on the operator, not the blockchain. If an operator becomes insolvent — as Bitcoin Depot did in May 2026 — a refund right becomes a claim in a bankruptcy.
- It does not make kiosks a sensible way to buy crypto. Regulated and expensive is still expensive.
That last point is the honest conclusion. HB 505 is a genuinely well-designed consumer protection law that will prevent real harm. It does not change the arithmetic that a Florida kiosk costs fifty times what a licensed exchange costs for the identical asset.
Where to go next
Florida kiosk guide
Every operator, real fee ranges and corridor pricing.
Read →Florida scam guide
The frauds this law targets, described step by step.
Read →All Florida crypto law
Chapter 560, the CBDC ban, the reserve bills.
Read →Money transmitter licences
The other half of Florida's regulatory regime.
Read →Cheaper cash routes
Every way to buy with cash, ranked honestly.
Read →Tallahassee guide
Where this law was written, and who enforces it.
Read →