On May 6, 2026, Iowa Attorney General Brenna Bird announced that Governor Kim Reynolds signed SF2296 into law, establishing comprehensive licensing and oversight requirements for cryptocurrency ATM operators in the state. The legislation mandates that any entity owning, operating, marketing, or facilitating digital financial asset kiosks must first obtain a money transmission license from the Iowa Division of Banking.
Key Provisions of SF2296
The new law expands the regulatory framework for crypto kiosks by defining covered digital financial assets, requiring location reporting, and mandating clear fee disclosures. Operators must report each site they own, operate, or manage to the Iowa Division of Banking, and any changes must be reported within 30 calendar days. The division is required to publish the complete list of kiosk locations online. Violations under the law are classified as unlawful practices under Iowa's consumer protection statutes, allowing the state to pursue penalties and injunctions.
Attorney General Bird emphasized the importance of the legislation in protecting Iowans from scams: 'Finally, we continue to fight to protect Iowans from the scammers who prey on them through crypto ATMs.' She also thanked the legislature for bipartisan support and Governor Reynolds for signing the bill.
Enforcement and Penalties
The Iowa Attorney General has the authority to take enforcement actions when there is reasonable belief of a violation. These actions can include seeking injunctions, compliance orders, and civil penalties of up to $10,000 per violation involving digital financial asset kiosks. Notably, the law allows for penalties of up to $100,000 for violating injunctions tied to crypto kiosk enforcement actions. The law took effect immediately upon enactment and applies to civil actions commenced on or after that date.
The new fee disclosure rules require operators to disclose the dollar amount of all charges collected in a digital financial asset transaction and to base exchange calculations on the prevailing market value of the asset at the time of the transaction, rather than using a fixed reference price.
Previous Regulatory Measures
SF2296 builds upon SF449, which was signed into law on May 19, 2025, and took effect on July 1, 2025. SF449 targeted crypto ATM scams by imposing transaction limits — no more than $1,000 per calendar day per kiosk for users, and aggregate transaction limits of $10,000 for new consumers during their first 30 days with a specific operator. The earlier law also required operators to issue refunds to users who were fraudulently induced into transactions, provided they reported the fraud within 90 days and submitted required documentation.
Consumer Protection and Broader Context
The legislation comes amid rising concerns about crypto ATM fraud and financial exploitation. During the 2025 House debate, Representative Shannon Lundgren revealed that an Iowa Attorney General investigation found Iowans had lost approximately $20 million to crypto ATM scams over the prior three years. By implementing licensing and reporting standards similar to those for traditional money transmission services, Iowa aims to increase state oversight of kiosk businesses and reduce consumer vulnerability.
Other states have also intensified scrutiny of crypto ATM activity linked to fraud complaints and financial exploitation cases. Iowa's updated framework positions the state as a leader in crypto ATM regulation, potentially influencing similar measures across the country. Industry observers expect other jurisdictions to follow suit as the prevalence of crypto ATM fraud continues to challenge consumer protections.