Iowa Governor Kim Reynolds signed SF2296 into law on May 6, 2026, introducing comprehensive licensing and oversight requirements for cryptocurrency ATM operators in the state. The measure, announced by Attorney General Brenna Bird, mandates that any business owning, operating, marketing, or facilitating digital financial asset kiosks must first obtain a money transmission license from the Iowa Division of Banking.
Core Requirements Under SF2296
The new law brings crypto kiosks under Iowa's financial regulatory framework while granting state authorities broader enforcement powers. Operators must submit detailed location reports for each kiosk site they control, and any changes must be reported within 30 calendar days. The Division of Banking is required to publish the complete list of registered locations online, ensuring public transparency.
Fee disclosure rules have been updated as well. Businesses must now clearly state the dollar amount of all charges collected in a digital financial asset transaction. The statute replaces certain exchange-price references with the prevailing market value of the asset at the time of the transaction, providing a more accurate pricing standard.
Violations of the law are classified as unlawful practices under Iowa's consumer protection statutes. The Attorney General's office may seek injunctions, issue compliance orders, and pursue civil penalties of up to $10,000 per violation. For violations of injunctions tied to digital financial asset kiosk enforcement actions, penalties can reach $100,000. The law took effect immediately upon enactment and applies to civil actions commenced on or after that date.
Building on Previous Legislation
SF2296 follows SF449, which Reynolds signed on May 19, 2025, and took effect July 1, 2025. That earlier law targeted crypto ATM scams directly by imposing a daily transaction limit of $1,000 per user per machine. New customers are also capped at $10,000 in aggregate transactions during their first 30 days with a specific operator. Operators must issue refunds when users are fraudulently induced into transactions, provided the victim reports the fraud within 90 days and supplies required documentation.
Attorney General Bird praised the bipartisan support behind both bills: “Finally, we continue to fight to protect Iowans from the scammers who prey on them through crypto ATMs. Thank you to the legislature for passing these bills with huge bipartisan support and to Governor Reynolds for signing them into law.”
Scam Losses Driving Regulatory Action
The legislation arrives amid growing concerns over crypto ATM scams. During the 2025 House debate, Representative Shannon Lundgren revealed that an Iowa Attorney General investigation found Iowans had lost approximately $20 million to crypto ATM scams over the prior three years. Scammers often impersonate government agencies, utility companies, or emergency contacts, directing victims to deposit cash at crypto ATMs.
Iowa's updated framework increases state supervision of kiosk businesses while applying licensing and reporting standards similar to other money transmission services. Multiple states across the U.S. have escalated scrutiny of crypto ATM activity linked to fraud and financial exploitation. Industry observers note that while compliance costs may push smaller operators out of the market, the long-term effect could be a healthier, more trustworthy ecosystem.
Notably, around the time of the law's signing, Bitcoin Depot, one of the largest crypto ATM operators in the U.S., disclosed a cyberattack resulting in the theft of over 50 bitcoin (approximately $3.7 million). The incident underscores the urgency of both security and regulatory compliance. Iowa's framework may serve as a model for other states considering similar measures.