On May 6, 2026, Iowa Governor Kim Reynolds signed SF2296 into law, mandating that all cryptocurrency ATM operators in the state obtain money transmission licenses and comply with expanded reporting and consumer protection requirements. The legislation grants state authorities broader enforcement powers, including civil penalties of up to $100,000 for violating injunctions tied to digital financial asset kiosk actions.
Background: SF449 Sets the Stage
This marks Iowa's second legislative effort targeting crypto ATMs. On May 19, 2025, Governor Reynolds signed SF449, effective July 1, 2025, which imposed daily transaction limits of $1,000, aggregate caps of $10,000 for new customers within their first 30 days, refund requirements for fraud victims, fee caps, fraud warnings, and detailed receipt disclosures. SF2296 builds upon that framework, introducing licensing, location reporting, and enhanced enforcement.
Core Requirements of SF2296
Under the new law, no person may own, operate, market, or facilitate a crypto kiosk in Iowa without first obtaining a money transmission license. Operators must report each kiosk location to the Iowa Division of Banking and update the division within 30 calendar days of any change. The division is required to publish a complete list of all kiosk locations online. Additionally, businesses must disclose the exact dollar amount of all fees collected in each digital financial asset transaction and replace certain exchange-price references with the prevailing market value at the time of the transaction.
Iowa Attorney General Brenna Bird stated: “Finally, we continue to fight to protect Iowans from the scammers who prey on them through crypto ATMs. Thank you to the legislature for passing these bills with huge bipartisan support and to Governor Reynolds for signing them into law.”
Enforcement and Penalties
When the Attorney General has reasonable cause to believe a violation has occurred, the office may seek an injunction, compel compliance, and pursue civil penalties of up to $10,000 per violation involving digital financial asset kiosks. For violations of an injunction obtained in connection with a kiosk enforcement action, penalties can reach $100,000. The law classifies all violations as unlawful practices under Iowa’s consumer protection statutes, applying to civil actions commenced on or after the effective date.
Consumer Protection Strengthened
SF449 already provided refunds for victims who report fraud within 90 days and submit required documentation. SF2296 extends consumer protections by explicitly incorporating fraud into the state’s unfair practices framework, giving the Attorney General additional tools to pursue scammers. During the 2025 House debate, Representative Shannon Lundgren revealed that an Iowa Attorney General investigation found residents had lost approximately $20 million to crypto ATM scams over the preceding three years. The updated law aims to reduce such losses through stringent licensing and oversight.
As multiple U.S. states intensify scrutiny of crypto ATM activity linked to fraud and financial exploitation, Iowa's new framework sets a high bar for kiosk operators, aligning their obligations with those of traditional money transmitters.