A crypto ATM is a cash-handling kiosk connected to a back-office server that prices trades, checks identity and sends coins from an operator-controlled wallet. The software is manageable; the hard parts are compliance, liquidity and stopping the kiosk from being used to move scam victims' cash.
How a transaction flows
- The customer chooses buy (cash to crypto) or, on two-way machines, sell (crypto to cash).
- The kiosk requests a quote from the back office, which applies the operator's spread to a price from one or more exchanges.
- Depending on amount and jurisdiction, the customer verifies a phone number, scans an ID, or takes a selfie for liveness checks.
- For a buy, the customer scans a wallet QR code and inserts notes; the bill validator reports each note.
- The back office screens the destination address, then broadcasts the transaction from a hot wallet and prints or texts a receipt.
- For a sell, the kiosk shows a deposit address; once the deposit confirms, the customer redeems a code for cash from the dispenser.
Software components
| Component | Responsibilities |
|---|---|
| Kiosk application | Touchscreen UI, QR scanning, drivers for bill validator, dispenser, printer and camera, offline handling, tamper alerts |
| Back office | Pricing and spreads, limits per customer and per day, KYC orchestration, transaction records, fleet monitoring |
| Wallet service | Hot wallet per asset, fee estimation, broadcasting, deposit monitoring for sells, refills from cold storage |
| Liquidity and hedging | Buying inventory on exchanges or via OTC desks so the operator is not exposed to price moves between sale and rebalance |
| Compliance tooling | Identity verification, sanctions screening, blockchain analytics on destination addresses, suspicious activity reporting, record keeping |
| Cash logistics | Cassette levels, collection scheduling, reconciliation of counted cash against logged notes |
Kiosks typically run a locked-down Linux or Windows build with remote management. Treat every kiosk as hostile territory: it sits in a public place, so keys must never live on the machine. The kiosk should only ask the server to send funds; signing happens in the back office, preferably through MPC or an HSM. The wallet development guide covers those custody options.
Compliance shapes everything
In the US, kiosk operators are generally money services businesses that must register with FinCEN, run an anti-money-laundering program, file suspicious activity reports and comply with state money transmitter licensing. A growing number of states have passed laws specific to crypto kiosks, such as daily transaction caps for new customers, mandatory fraud warnings on screen, and refund rights for scam victims. In the UK, the FCA has stated that no crypto ATM operator is registered with it, so running one there is illegal, and it has pursued criminal cases. Australia's AUSTRAC has also tightened conditions on kiosk operators. Check current rules where each machine will stand.
Software needs configurable rules by location: identity thresholds, daily and rolling limits, cooling-off periods for first-time users, and the ability to block destination addresses flagged by analytics providers.
Scams: the problem the industry has to solve
Regulators and consumer agencies in several countries have reported crypto kiosks being used heavily in scams, especially against older adults. The pattern is consistent: a fake government agent, bank fraud officer or tech-support caller tells the victim to withdraw cash and deposit it into a kiosk, scanning a QR code the scammer supplied. Once broadcast, the transaction cannot be reversed.
Controls that responsible operators build in:
- Prominent, interruptive warnings that no government agency or bank asks for payment via crypto ATM.
- Low first-day limits and holds for new customers, with live phone verification above thresholds.
- Screening destination addresses against known scam clusters before broadcasting.
- Flagging patterns such as repeated maximum deposits by a new, older customer to an address they have never used.
- A fast route for victims and law enforcement to report, and a refund policy where required by law.
Build, white-label or buy
Hardware manufacturers usually bundle kiosk software and a hosted back office. That route is fastest, but you are tied to their compliance features and fee model. Building your own back office makes sense for operators with large fleets and in-house compliance teams. Some open-source kiosk projects exist; review their maintenance status and security history carefully before deploying anything that handles cash and keys. If you plan to add online buying alongside kiosks, much of the back office overlaps with exchange software.
Cost drivers
- Hardware per kiosk, especially two-way machines with dispensers.
- Site rental, cash logistics and insurance, which often dominate operating costs.
- Per-check KYC fees and blockchain analytics subscriptions.
- Licensing in each state or country, which can take many months; see the exchange licensing overview for the kinds of regimes involved.
- Engineering for a custom back office: a reasoned estimate is a small team (three to five engineers) for several months, plus ongoing compliance updates.
Frequently asked questions
Do crypto ATMs need a license?
In most places, yes. In the US that means FinCEN registration plus state licensing; elsewhere it may be registration as a virtual asset service provider. Some countries effectively prohibit them.
Can a crypto ATM transaction be reversed?
Not on-chain. Once coins are sent, only the recipient can return them. That is why pre-transaction warnings, limits and address screening matter.
What is a two-way crypto ATM?
A machine that both sells crypto for cash and buys crypto back, dispensing notes. It needs a dispenser, deposit monitoring and more cash management.
Should private keys be stored on the kiosk?
No. Kiosks are physically exposed. Signing should happen in a secured back office, with the kiosk only requesting transactions.