Woofun AI reports that Florida has fundamentally restructured the liability framework for cryptocurrency kiosks by mandating that operators absorb the financial cost of specific fraud incidents. The legislation, designated as HB 505, transforms scam prevention from a passive warning system into an active business-liability test where operators must issue full refunds under strict conditions. This regulatory shift targets the economic incentives of kiosk deployment, forcing a realignment of risk management strategies across the state's virtual currency infrastructure.

The implementation of these new duties follows a precise, staggered timeline designed to allow for operational adaptation while establishing a clear enforcement trajectory. The majority of the act's provisions are scheduled to take effect on Jan. 1, 2027, providing a defined window for compliance preparation.

However, the specific section requiring virtual currency kiosk businesses to register before commencing operations will not activate until March 1, 2027. This phased approach creates a distinct regulatory environment where existing operators must submit registration applications to the Office of Financial Regulation (OFR) within 30 days after the Jan. 1, 2027 date, while new entrants face a hard barrier to entry starting in March. The distinction ensures that the state can audit the current landscape before enforcing the pre-operation registration mandate.

The most consequential element of this legislative framework is the mandatory refund provision, which alters the traditional allocation of loss in fraud scenarios. Once the relevant provisions become active, a kiosk business is legally obligated to issue a full refund within 72 hours for a customer's first virtual currency kiosk transaction if specific criteria are met. The customer must report the alleged fraud to both the business and a law enforcement or governmental agency within 60 days of the incident.

Furthermore, the claimant must provide tangible proof of the fraud, such as a police report or a notarized affidavit. This structure effectively forces the operator to price, prevent, or manage at least a portion of the fraud risk, moving beyond the previous model where public warnings left the victim to bear the total loss if the warning failed.

Woofun AI data shows that the scale of the problem necessitating this intervention is substantial, with national and state-level figures highlighting the urgency. Nationally, the Internet Crime Complaint Center (IC3) listed 13,460 complaints and nearly $389 million in adjusted losses, though officials cautioned that these complaints may involve other transaction types used in scams involving kiosks. In Florida specifically, AARP Florida reported in February that the state hosted more than 3,100 crypto ATMs and had recorded more than $33 million in reported crypto ATM-facilitated fraud and scam losses over a five-year period. These figures underscore the magnitude of the exposure that the new refund duty aims to mitigate by placing the immediate financial burden on the entity controlling the machine.

The law also addresses a critical regulatory gap regarding licensing requirements for different types of operators. Previously, peer-to-peer, two-party kiosk operators were not required to hold a Florida money-transmitter license unless they acted as intermediaries, creating a scenario where some operators could sit outside ordinary money-transmitter licensing while still offering machines that turn cash into irreversible crypto transfers. HB 505 closes this loophole by linking consumer protections to transaction caps, receipts, registration information, compliance records, and refund documentation, all of which can be audited later. While licensed money transmitters are exempt from separate kiosk registration, they remain subject to the same key operating rules around disclosures, transaction limits, receipts, and refunds, ensuring a uniform standard of protection regardless of the operator's licensing status.

Operational constraints introduced by the law create significant pressure points for business models reliant on high-volume or high-value transactions. The legislation imposes a $2,000 daily cap for new customers, a measure that directly targets the first days of a customer relationship when a scam victim may be most vulnerable and when an operator has the least history with that person. For existing customers, a $10,000 cap applies, leaving more room for legitimate use but still placing an outer limit on a customer's daily kiosk volume. These caps function as both a revenue constraint on high-dollar transactions and a compliance cost around tracking, disclosures, receipts, and refunds, requiring operators to implement systems that track same-day activity across their own machines and maintain clearer onboarding records to distinguish between new and existing users.

Compliance with these new mandates will require operators to overhaul their customer experience management before, during, and after a transaction. Businesses will need to manage the customer experience before the transaction begins, keep records after it ends, and document compliance for renewal or inactive-registration scenarios. The law allows OFR to request evidence of compliance during renewal or inactive-registration processes, meaning operators must maintain records showing refunds were provided in required circumstances. This documentation requirement extends to customer-service processes for fraud reports and refund requests, necessitating a robust internal infrastructure to handle the administrative burden of the 72-hour refund window and the 60-day reporting deadline.

The broader implications of Florida's model extend beyond state borders, potentially influencing federal policy and other state jurisdictions. The proposal suggests that states should retain authority to impose stronger consumer protections, including full refunds for defrauded customers, although this federal proposal is not yet law. The debate is moving away from whether crypto ATM users should be warned and toward how much responsibility operators should carry when the machines become part of fraud workflows. Florida's law answers with a hybrid model that keeps kiosks legal while making access conditional on documented fraud controls, serving as a blueprint for making kiosk access conditional on documented fraud controls rather than relying solely on public education campaigns.

The practical test of this regulatory framework will unfold in 2027, determining whether the model is exportable to other states seeking a middle path between outright bans and public education campaigns. If operators absorb the requirements without pulling back from Florida, the model could look exportable to other states. Conversely, if operators reduce kiosk availability, raise costs, or tighten customer screening, the law may still travel, but as a clearer trade-off: less frictionless access in exchange for less unchecked exposure to fraud. Either way, Florida has changed the policy question, establishing that kiosk businesses should be required to slow, document, cap, and in some cases refund the transaction when the warning fails. This marks a definitive shift in how the industry must account for fraud as a core cost of doing business.