FinCEN Notice on the Use of Convertible Virtual Currency Kiosks for Scam Payments and Other Illicit Activity (FIN-2025-NTC1)

1 FIN-2025-NTC1 August 4, 2025 FinCEN Notice on the Use of Convertible Virtual Currency Kiosks for Scam Payments and Other Illicit Activity The U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) is issuing this Notice to financial institutions1 urging them to be vigilant in identifying and reporting suspicious activity involving convertible virtual currency (CVC) kiosks. CVC kiosks—also called cryptocurrency (crypto) Automated Teller Machines (ATMs)—are ATM-like devices or electronic terminals that allow customers to exchange real (or fiat) currency for virtual currency and vice versa.2 While CVC kiosks can be a simple and convenient way for consumers to access CVC, scammers and other illicit actors can also exploit their simplicity and convenience. According to the Federal Bureau of Investigation’s (FBI) Internet Crime Complaint Center (IC3), criminals engaged in fraud schemes often direct victims to use a CVC kiosk to send payments under false pretenses. In 2024, the FBI’s IC3 received more than 10,956 complaints reporting the use of CVC kiosks, with reported victim losses of approximately $246.7 million.3 This represents a 99 percent increase in the number of complaints and a 31 percent increase in reported victim losses from 2023.4 The Federal Trade Commission (FTC) likewise identified, based on an analysis of consumer reports, that fraud losses through CVC kiosks have skyrocketed.5 FinCEN, through analysis of Bank Secrecy Act (BSA) information, has observed that CVC kiosks have also been used to launder suspected drug proceeds. The Drug Enforcement Administration (DEA) reports that transnational criminal organizations (TCOs) such as Cartel Jalisco Nueva Generación are increasingly adopting CVC because it enables rapid international funds transfers.6 In areas that face a significant drug-related threat and that have a significant

1. See 31 U.S.C. § 5312(a)(2); 31 CFR § 1010.100(t).
2. FinCEN previously discussed illicit finance risks related to CVC kiosks in a 2019 advisory. See FinCEN, FIN￾2019-A003, “Advisory on Illicit Activity Involving Convertible Virtual Currency” (May 9, 2019), at p. 7. This Notice supplements the information provided in that 2019 advisory.
3. FBI, IC3, “Internet Crime Report 2024” (“2024 IC3 Report”), at p. 36.
4. Id.
5. See FTC, “Bitcoin ATMs: A payment portal for scammers” (“FTC Report”) (Sept. 3, 2024).
6. See DEA, “2025 National Drug Threat Assessment” (May 2025), at pp. 10, 64. Suspicious Activity Report (SAR) Filing Request FinCEN requests that financial institutions reference this Notice in SAR field 2 (Filing Institution Note to FinCEN) and the narrative by including the key term “FIN-2025-CVCKIOSK”.

FINCEN NOTICE 2 number of CVC kiosks, TCOs may launder money through CVC kiosks as an alternative to bulk cash smuggling.7 This Notice describes illicit finance typologies associated with CVC kiosks, provides red flag indicators to assist with identifying and reporting related suspicious activity, and reminds financial institutions of their reporting requirements under the BSA. Illicit activity involving CVC kiosks is linked to fraud, certain types of cybercrime, and drug trafficking organization activity, which are three of FinCEN’s Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) National Priorities.8 The information contained in this Notice is derived from FinCEN’s analysis of BSA data, open￾source reporting, and information from law enforcement partners. How CVC Kiosks Work Whereas a traditional ATM enables customers to withdraw or deposit cash from a bank account, CVC kiosks enable customers to buy, and in some cases sell, CVC from a CVC wallet9 or exchange.10 CVC kiosks generate revenue for their operator through the collection of fees and are generally located in businesses with heavy foot traffic, long operating hours, and convenient access, such as convenience stores, gas stations, cafes, and supermarkets.11 Purchasing CVC at a CVC kiosk may resemble using an ATM, which may appeal to a customer who wishes to transact in CVC but lacks familiarity with blockchain technology. After providing the CVC kiosk with identification, which can range from a phone number to a scan of a government-issued ID, the customer enters the address of the CVC wallet that will receive the purchased CVC. The address could be the customer’s own CVC wallet or that of a third party,12 and is normally embedded in a quick response (QR) code, which is a square barcode that can be scanned and read with a smartphone or kiosk camera. Finally, the customer inserts cash or a debit or credit card into the machine to finalize the purchase of CVC. 7. For example, according to the DEA, large volumes of illicit proceeds are laundered throughout Illinois, with Chicago serving as the primary collection point for U.S. currency generated through illegal drug sales. With the presence of CVC kiosks in the area growing rapidly (with approximately 1,626 in Illinois and 1,167 in Chicago alone), virtual currency continues to be a popular and growing method used to launder illicit proceeds derived from drug sales. Law enforcement reporting indicates that individuals are traveling from other states to Chicago to use these kiosks. See DEA, “The Illegal Drug Threat to Illinois” (Sept. 2024), at pp. 2, 5. 8. FinCEN, “Anti-Money Laundering and Countering the Financing of Terrorism National Priorities” (June 30, 2021). 9. CVC wallets are interfaces housing the technical components required for storing and transferring CVC. There are different wallet types that vary according to the technology employed, where and how the value is stored, and who controls access to the value. See FinCEN, FIN-2019-G001, “Application of FinCEN’s Regulations to Certain Business Models Involving Convertible Virtual Currencies” (“FinCEN 2019 CVC Guidance”), at pp. 15–17. 10. See Id. at p. 17. CVC kiosks most commonly support bitcoin transactions, but many also handle other CVCs such as litecoin, ether, tether, and U.S. dollar coin (USDC). Federal Reserve Bank of Kansas City, “Payments System Research Briefing: The Controversial Business of Cash-to-Crypto Bitcoin ATMs” (“Federal Reserve Report”) (Aug. 30, 2023), at p. 1. 11. See FTC Report, supra note 5. 12. Some operators may require that users certify that the destination wallet belongs to the user and not a third party, which could discourage fraud. See New Jersey Commission of Investigation, “Bitcoin ATMs: Scams, Suspicious Transactions and Questionable Practices at Cryptocurrency Kiosks” (Feb. 2021), at p. 9.

FINCEN NOTICE 3 CVC kiosks may connect directly to a separate CVC exchanger,13 which performs the CVC transmission, or the kiosk may draw upon CVC held by its operator.14 The operator must maintain sufficient CVC and cash balances to run the kiosk and may use accounts at CVC exchanges and depository institutions for this purpose.15 Non-compliant CVC Kiosk Operators CVC kiosk operators generally facilitate money transmission16 between a CVC exchanger and a customer’s CVC wallet or operate as a CVC exchanger themselves and, as such, are considered money services businesses (MSBs) under the BSA.17 CVC kiosk operators that meet their obligations under the BSA play a key role in combating fraud and other illicit activity. In some states, CVC kiosk operators may also be subject to state law designed to, among other things, deter illicit activity and protect customers from fraud, including by imposing additional requirements on businesses subject to those state laws.18 However, the rapid growth in the number of CVC kiosks in the United States19 has coincided with substantial rates of non-compliance with AML/CFT rules by CVC kiosk operators. For example, a 2021 report by the State of New Jersey Commission of Investigation found that more than a third of the companies operating CVC 13. A CVC exchanger is a person or entity offering to exchange fiat currencies for virtual currencies or one virtual currency for another virtual currency. Depending on the specifics of their business model, CVC exchangers may be subject to obligations under the BSA. See FinCEN 2019 CVC Guidance, supra note 9, pp. 12–14; 31 CFR § 1010.100(ff)(8)(iii). 14. Under either formulation, CVC kiosk operators are subject to BSA obligations. See FinCEN 2019 CVC Guidance, supra note 9, at pp. 17-18. 15. See Federal Reserve Report, supra note 10. 16. Money transmission involves the “acceptance of currency, funds, or other value that substitutes for currency and the transmission of currency, funds, or other value that substitutes for currency to another location or person by any means.” 31 CFR § 1010.100(ff)(5)(i)(A). Transmitting CVC (other value that substitutes for currency) may constitute money transmission. See FinCEN 2019 CVC Guidance, supra note 9, at pp. 6-7. 17. As an MSB, any non-exempt person engaged in money transmission must register with FinCEN within 180 days of starting to engage in money transmission. See 31 CFR § 1022.380. Money transmitters must also comply with the recordkeeping, reporting, and transaction monitoring obligations set forth in parts 1010 and 1022 of 31 CFR chapter X. Examples of such requirements include the filing of Currency Transaction Reports (31 CFR § 1022.310) and Suspicious Activity Reports (31 CFR § 1022.320), as well as general recordkeeping obligations (31 CFR § 1010.410). 18. For example, California’s Digital Financial Assets Law, among other requirements, prohibits kiosk operators from accepting or dispensing more than $1,000 in a day from or to a customer via a kiosk. See Cal. Fin. Code § 3902; see also California Department of Financial Protection & Innovation, “Digital Financial Assets Law: Information for Kiosk Operators.” CVC kiosk operators may also be subject to state laws and regulations that are not specific to CVC kiosk operators. For example, on February 26, 2025, the Iowa Attorney General announced lawsuits against two CVC kiosk operators for alleged failures that allowed Iowans to transfer millions of dollars to scammers through their kiosks in violation of the Iowa Consumer Fraud Act. See Iowa Office of the Attorney General, “Attorney General Bird Sues Crypto ATM Companies for Costing Iowans More than $20 Million” (Feb. 26, 2025). 19. The website Coin ATM Radar reports that the number of CVC kiosks in the United States increased from 4,128 on January 1, 2019, to 37,342 on January 1, 2025. See Coin ATM Radar, “Bitcoin ATM Installations Growth” (last accessed Feb. 27, 2025). The data on Coin ATM Radar are self-reported by operators and are not comprehensive, as some large operators and perhaps many small kiosk operators do not report to the website. See Federal Reserve Report, supra note 10.

FINCEN NOTICE 4 kiosks in the state did not register with FinCEN as MSBs.20 Some non-compliant kiosk operators have been prosecuted for operating an unlicensed money transmitting business and other related offenses.21 CVC kiosks operated by non-compliant operators are especially vulnerable to abuse by scammers and other criminals. According to law enforcement, scammers have directed victims to specific CVC kiosks, in some cases across state lines, likely to avoid CVC kiosk operators with strong AML/CFT controls. In some cases, a non-compliant operator may represent to other financial institutions that the CVC kiosk business is registered with FinCEN—implying that it also complies with other BSA requirements—while failing to implement an AML/CFT program or other BSA obligations, such as collecting, retaining, and verifying customer identification.22 These non-compliant CVC kiosk businesses also often lack reasonably designed policies, procedures, and internal controls to respond to requests from law enforcement.23 In some instances, non-compliant CVC kiosk operators have provided financial institutions with false information to acquire accounts or engaged in money laundering. For example, kiosk operators have assisted in structuring transactions24 or falsely represented the nature of their business to CVC exchanges and depository institutions at which they hold accounts. Some non￾compliant operators may use a personal account or accounts in the names of fake businesses or other entities to make cash deposits and withdrawals.25 If asked about the purpose of transactions, the operators may avoid answering or provide misleading answers to financial institutions.26 20. New Jersey Commission of Investigation, “Bitcoin ATMs: Scams, Suspicious Transactions and Questionable Practices at Cryptocurrency Kiosks” (Feb. 2021), at p. 9. 21. See, e.g., U.S. Attorney’s Office (USAO), Central District of California, Press Release, “Westwood Man Agrees to Plead Guilty to Federal Narcotics, Money Laundering Charges for Running Unlicensed Bitcoin Exchange and ATM” (Aug. 23, 2019); USAO, Eastern District of California, Press Release, “Bitcoin ATM Company Forfeited Over $1 Million for Conspiring to Violate the Bank Secrecy Act” (Sept. 12, 2023). 22. MSBs are required to register with FinCEN as part of their obligations under the BSA, but that registration with FinCEN and a company’s appearance on the FinCEN MSB Registrant Search Page is not a recommendation, certification of legitimacy, or endorsement of the business by FinCEN or any other U.S. government agency. Further, while MSBs must register with and are regulated by FinCEN, FinCEN does not license MSBs to operate in the United States. Any claim that a registration with FinCEN is a recommendation, certification of legitimacy, or endorsement by FinCEN of the business, or equates registration as a license to operate in the United States, is false and may be part of a scam. See FinCEN, FIN-2024-Alert005, “FinCEN Alert on Fraud Schemes Abusing FinCEN’s Name, Insignia, and Authorities for Financial Gain,” (Dec. 18, 2024). The FinCEN MSB Registrant Search Page contains entities that have registered as MSBs pursuant to the BSA implementing regulations at 31 CFR § 1022.380. See FinCEN, MSB Registrant Search. 23. See 31 CFR § 1022.210(d)(1)(i)(D). 24. Structuring transactions is prohibited by federal law and includes the practice of breaking a transaction into smaller amounts to prevent a CTR from being filed or to evade reporting requirements. See 31 U.S.C. § 5324; 31 CFR § 1010.314. 25. See, e.g., USAO, District of New Hampshire, Press Release, “Three Plead Guilty to Wire Fraud In Connection with Unlawful Virtual Currency Sales Business” (Apr. 18, 2022); see also FinCEN, FIN-2019-A003, “Advisory on Illicit Activity Involving Convertible Virtual Currency” (May 9, 2019), at p. 7. 26. See, e.g., USAO, District of New Hampshire, Press Release, “Six Charged with Crimes Related to Virtual Currency Exchange Business” (Mar. 16, 2021).

FINCEN NOTICE 5 Case Study: Orange County Man Sentenced for Operating Illegal CVC Kiosk Network That Laundered Millions of Dollars of Bitcoin and Cash for Criminals’ Benefit On May 28, 2021, the U.S. Attorney’s Office for the Central District of California announced that a court sentenced Kais Mohammad, a.k.a. “Superman29,” to 24 months in federal prison for operating an illegal CVC MSB that exchanged up to $25 million—some of it on behalf of criminals—through in-person transactions and a network of CVC kiosks. Mohammad pleaded guilty in September 2020 to a three-count criminal information charging him with operating an unlicensed money transmitting business, money laundering, and failing to maintain an effective anti-money laundering program. From December 2014 to November 2019, Mohammad owned and operated Herocoin. As part of his business, Mohammad offered Bitcoin-to-cash exchange services, charging commissions of up to 25 percent—significantly above the prevailing market rate. During the time of Herocoin’s operation, Mohammad, a former bank employee who trained others on compliance matters, intentionally failed to register his company with FinCEN. Mohammad was aware that he was required to—but chose not to—develop and maintain an effective anti-money laundering program, file currency transaction reports for exchanges of currency in excess of $10,000, conduct due diligence on customers, and file suspicious activity reports for transactions over $2,000 involving customers he knew, or had reason to suspect, were involved in criminal activity. With respect to his CVC kiosk network, Mohammad’s machines allowed customers to conduct financial transactions without requiring any identification and permitted customers to conduct multiple, consecutive transactions of up to $3,000 each without ever reporting suspicious activity to regulators or law enforcement. After FinCEN contacted Mohammad in July 2018 about his need to register his company, Mohammad did so, but he continued to fail to comply fully with federal law concerning money laundering, conducting due diligence, and reporting suspicious customers.27 Use of CVC Kiosks to Facilitate Scam Payments The speed and difficulty of reversing CVC transactions28 makes CVC an attractive payment mechanism for scammers. Once a victim makes the transfer with a CVC kiosk, the recipient (i.e., a 27. See U.S. Attorney’s Office, Central District of California, Press Release, “Yorba Linda Man Sentenced to 2 Years in Prison for Operating Illegal ATM Network that Laundered Bitcoin and Cash for Criminals” (May 28, 2021). 28. Because most CVCs operate on permissionless blockchains (i.e. decentralized, digital ledgers anyone can use) to record transactions, there often is no centralized authority who can easily reverse a transaction in the event of fraud. See National Institute of Standards and Technology, “Blockchain Networks: Token Design and Management Overview” (Feb. 2021).

FINCEN NOTICE 6 criminal actor associated with the scam) instantly owns the CVC, and often immediately transfers the funds into another CVC wallet or exchange account they control. This generally differs from traditional bank or wire transfers where a payment transaction can remain pending for one to two days before settlement. The nature of CVC transactions can also make law enforcement’s recovery of the funds difficult. Scammers often seek to persuade victims to withdraw money from their traditional financial accounts, such as investment or retirement accounts, and use that money to send a payment via CVC kiosk.29 CVC kiosks can have high transaction fees relative to other means of transferring funds for senders and recipients, ranging from 7–20 percent, but scammers are willing to accept these costs for the quick receipt of CVC from victims, according to BSA and open-source information.30 CVC Kiosks and Elder Fraud Criminals targeting older individuals are particularly likely to direct victims to use CVC kiosks to send payments.31 According to FTC data, people aged 60 and over were more than three times as likely as younger adults to report a loss using a CVC kiosk.32 More than two of every three dollars reported lost to fraud using CVC kiosks was lost by an older adult.33 In addition, according to law enforcement, CVC kiosks have increasingly facilitated elder fraud, especially among tech/customer supports scams, government impersonation, confidence/romance scams, emergency/person-in-need scams, and lottery/sweepstakes scams.34 Many scammers using CVC kiosks initiate contact with potential victims through unsolicited calls.35 For example, a scammer may claim to be the victim’s bank calling about an unauthorized charge or pose as a government agency demanding taxes or fees. The most common scam typology associated with CVC kiosks is tech and customer support scams, in which scammers impersonate well-known companies as tech and customer support representatives to falsely claim that a virus or other malware has compromised the victims’ computers and direct victims to make payments by CVC 29. See FBI, IC3, “The FBI Warns of Fraudulent Schemes Leveraging Cryptocurrency ATMs and QR Codes to Facilitate Payment” (Nov. 4, 2021) (“FBI Crypto ATM PSA”). 30. FinCEN, “Elder Financial Exploitation: Threat Pattern & Trend Information, June 2022 to June 2023” (Apr. 2024), at p. 4. See also Federal Reserve Report, supra note 10, at p. 3. 31. FBI, IC3, “2023 Elder Fraud Report” (2023), at p. 16. 32. See FTC Report, supra note 5. 33. In contrast, younger adults were more likely to report virtual currency fraud losses not involving CVC kiosks, primarily those due to fake virtual currency investment opportunities. Ibid. 34. FBI, IC3, “2023 Elder Fraud Report” (2023), at p. 16. See also FinCEN, FIN-2022-A002, “Advisory on Elder Financial Exploitation” (June 15, 2022); see also FBI, IC3, “FBI Warns of the Impersonation of Law Enforcement and Government Officials” (Mar. 7, 2022); FBI, IC3, “Tech/Customer Support and Government Impersonation”; FBI, IC3, “Technical and Customer Support Fraud” (Mar. 16, 2023). 35. According to FTC data, phone calls were the initial contact method in about 47 percent of reported fraud cases involving CVC kiosks, followed by online ads or pop-ups (16 percent), and emails (9 percent). See FTC Report, supra note 5. See also FinCEN, FIN-2023-Alert005, “FinCEN Alert on Prevalent Virtual Currency Investment Scam Commonly Known as ‘Pig Butchering’” (Sept. 3, 2023).

FINCEN NOTICE 7 kiosk to address the issue.36 In such schemes, scammers may use online ads and emails to contact victims, which typically contain a phone number to call for assistance leading to the scammer.37 Regardless of the type of fraudulent scheme, the criminals typically provide detailed instructions to prospective victims, including how to (i) withdraw cash from their bank, (ii) locate a kiosk, and (iii) deposit and send funds using the CVC kiosk, normally using a QR code provided by the scammer to ensure the CVC is sent to the correct destination, i.e., a CVC wallet the scammer controls. After providing the victim with the QR code, the scammer then directs the victim to a physical CVC kiosk to purchase and send the scammer CVC, often staying in constant online or phone communication with the victim and providing step-by-step instructions until the payment is completed.38 According to law enforcement sources, scammers may provide victims with instructions designed to circumvent reporting thresholds,39 transaction limits, or other safeguards. For example, the scammer may direct the victim to separate cash deposits into multiple, lower-value transactions, which may constitute structuring. In some cases, the scammer may also direct the victim to split the payment across multiple different CVC kiosks, a tactic known as “smurfing.” Scammers also often attempt to extract repeated payments from the same victim. In some cases, the scammers may also ask the victim to make payments through a new mechanism, such as through wire transfers or by handing cash or gold to a courier.40 A scam operation may aggregate payments made by multiple victims into a single CVC wallet before continuing to launder the proceeds. Scammers will also often quickly swap scam proceeds into a stablecoin,41 most frequently through cross-chain bridges that claim to operate as decentralized finance (DeFi) services.42 Illicit actors use this technique, known as “chain-hopping,” to make it more difficult for authorities to trace financial transactions or for service providers to detect if incoming funds are tied to illicit activity.43 36. Tech support scams represented 46 percent of crimes related to CVC kiosks that were reported to FBI IC3 in 2023. See FBI, IC3, “2023 Cryptocurrency Fraud Report” (2023) at p. 16; see also FinCEN, FIN-2022-A002, “Advisory on Elder Financial Exploitation” (June 15, 2022), at p. 7. 37. See FTC Report, supra note 5. 38. See FBI Crypto ATM PSA, supra note 29. 39. As MSBs, CVC kiosk operators are required to report suspicious activity involving any transaction or pattern of transactions that involves or aggregates funds or other assets of at least $2,000. 31 CFR § 1022.320(a)(2). Some transactions conducted through CVC kiosks may be subject to additional reporting requirements. 40. See, e.g., U.S. Attorney’s Office, District of Arizona, Press Release, “Participants in “Tech Support” Scheme Charged with Conspiracy to Launder Fraudulent Proceeds” (Dec. 30, 2024); see also U.S. Attorney’s Office, Southern District of California, Press Release, “Man Charged in $1.49 Million Scam Involving Bitcoin ATM Deposits and Bulk Gold Purchases; Victim is Retiree who Lost Life Savings” (Apr. 18, 2024). 41. A stablecoin is a digital asset that aims to maintain a stable price (e.g., a 1:1 peg) compared to a reference asset, such as the U.S. dollar. Eva Su, “Stablecoins: Background and Policy Issues,” Congressional Research Service (Nov. 10, 2021). 42. DeFi services are virtual asset protocols and services that purport to allow for some form of automated peer-to-peer (P2P) transactions, often using self-executing code known as “smart contracts” based on blockchain technology. Cross-chain bridges allow users to exchange virtual assets or information from one blockchain to another. See Treasury, “Illicit Finance Risk Assessment of Decentralized Finance” (Apr. 2023), at pp. 3, 10. 43. Id., at p. 17. Despite these challenges, blockchain analytics can help financial institutions identify this particular type of suspicious activity because blockchain analysis often connects scam payments made through CVC kiosks at different times or by different victims. See FinCEN, FIN-2019-A003, “Advisory on Illicit Activity Involving Convertible Virtual Currency” (May 9, 2019).

FINCEN NOTICE 8 Case Study: Man Charged in $1.49 Million Scam Involving Bitcoin ATM Deposits and Bulk Gold Purchases; Victim Is Retiree Who Lost Life Savings On April 18, 2024, the U.S. Attorney’s Office for the Southern District of California announced that a California man made his first appearance in federal court to face charges that he participated in a multinational fraud conspiracy that targeted a 70-year-old retiree who was tricked into handing over $1.335 million. The victim was using her computer when a pop-up window appeared, advising her to call for help because her computer had been hacked. When she made the call, she was transferred through a series of co-conspirators pretending to work in tech support who told her to download software on her computer. She was also told her personal identifying and bank account information were compromised and was subsequently referred to co-conspirators posing as employees from her financial institutions. The victim was then told she needed to “secure” her assets. At the direction of someone posing as a bank employee, she deposited approximately $55,700 into CVC kiosks located in North County San Diego. The complaint further describes how once the scammers discovered the victim had substantial savings, they convinced her she could safeguard her funds by obtaining gold bars and sending them to the U.S. Treasury, which would create a locker under her name. In reality, the victim was scammed out of her life savings.44 Red Flag Indicators of Illicit Activity Involving CVC Kiosks FinCEN has identified the following red flag indicators to help detect, prevent, and report potential suspicious activity related to illicit activity involving CVC kiosks. Because no single red flag is determinative of illicit or other suspicious activity, financial institutions should consider the surrounding facts and circumstances, such as a customer’s historical financial activity, whether the transactions are in line with prevailing business practices, and whether the customer exhibits multiple red flags before determining if a behavior or transaction is suspicious or otherwise indicative of illicit activity. Red Flags for Operators of CVC Kiosks Regarding Scam Payments A customer sends multiple payments just below the suspicious activity reporting (SAR) threshold,45 or other applicable threshold set by state law, from multiple kiosk locations. 44. U.S. Attorney’s Office, Southern District of California, Press Release, “Man Charged in $1.49 Million Scam Involving Bitcoin ATM Deposits and Bulk Gold Purchases; Victim is Retiree who Lost Life Savings” (Apr. 18, 2024). 45. Money transmitters must report suspicious activity involving any transaction or pattern of transactions if it involves or aggregates funds or other assets of at least $2,000. See 31 CFR § 1022.320(a)(2).

FINCEN NOTICE 9 A customer structures cash deposits just beneath the Currency Transaction Report (CTR) threshold,46 or CVC kiosk daily limit, either by using multiple machines or multiple accounts (i.e., smurfing). A customer with limited or no transaction history makes a substantial deposit that is rapidly transferred through multiple addresses, commingled with multiple other deposits, or swapped into a different CVC. Multiple customers use CVC kiosks in geographically disparate locations to make deposits to the same CVC address over a short period of time while certifying that they are the owners of the deposit address. Multiple customer accounts or transactions are linked to the same phone number or CVC wallet address. Blockchain analysis indicates that a customer’s transaction is received by a CVC wallet that is identified as associated with fraud or other illicit activity. Blockchain analysis indicates that a customer’s transaction is received by a CVC wallet associated with a financial institution that has been identified as associated with TCOs perpetrating CVC investment scams. Red Flags for Other Financial Institutions Regarding Use of CVC Kiosks for Scam Payments A customer conducting an in-person banking transaction withdraws substantial amounts of cash from their bank account or retirement account and indicates that they have been directed by a person on the phone or internet to deposit the funds into a CVC kiosk. An older customer with no history of CVC-related activity conducts a high-value transaction or series of transactions with a CVC kiosk operator. A customer uses a debit card to make multiple payments below the CTR limit to a CVC kiosk operator. Red Flags for Financial Institutions Identifying Potential Non-Compliant CVC Kiosk Owner-Operators A customer operates a CVC kiosk business that is not registered with FinCEN as an MSB or does not maintain applicable state licenses. A customer operates a CVC kiosk business that fails to collect required customer and transaction information. A customer operates a CVC kiosk business that advertises the ability for customers to conduct transactions without identification, or with only a phone number or email address. 46. A report of each deposit, withdrawal, exchange of currency, or other payment or transfer, by, through, or to a financial institution that involves a transaction in currency of more than $10,000. Multiple transactions may be aggregated when determining whether the reporting threshold has been met. See 31 CFR §§ 1010.310-313, 1020.310- 313, 1021.310-313, 1022.310-313, 1023.310-313, 1024.310-313, 1026.310-313.

FINCEN NOTICE 10 A customer operates a CVC kiosk business that charges unusually high transaction fees relative to similarly situated operators, has opaque rates and fees, or has other business practices that diverge significantly from those of legitimate CVC kiosk operators. A customer that operates a CVC kiosk business structures cash transactions below the SAR or CTR threshold. Reminder of Relevant BSA Obligations and Tools for U.S. Financial Institutions Suspicious Activity Reporting Other Relevant BSA Reporting USA PATRIOT ACT Section 314(b) Information Sharing Authority Suspicious Activity Reporting A financial institution is required to file a SAR if it knows, suspects, or has reason to suspect a transaction conducted or attempted by, at, or through the financial institution involves funds derived from illegal activity; is intended or conducted to disguise funds derived from illegal activity; is designed to evade regulations promulgated under the BSA; lacks a business or apparent lawful purpose; or involves the use of the financial institution to facilitate criminal activity.47 All statutorily defined financial institutions may voluntarily report suspicious transactions under the existing suspicious activity reporting safe harbor.48 When a financial institution files a SAR, it is required to maintain a copy of the SAR and the original or business record equivalent of any supporting documentation for a period of five years from the date of filing the SAR.49 Financial institutions must provide any requested SAR and all documentation supporting the filing of a SAR upon request by FinCEN or an appropriate law enforcement or supervisory agency.50 When requested to provide supporting documentation, financial institutions should take special care to verify that a requestor of information is, in fact, a representative of FinCEN or an appropriate law enforcement or supervisory agency. A financial institution should incorporate procedures for such verification into its BSA compliance or AML program. These procedures may include, for example, independent employment verification with the requestor’s field office or face-to-face review of the requestor’s credentials. 47. See 31 CFR §§ 1020.320, 1021.320, 1022.320, 1023.320, 1024.320, 1025.320, 1026.320, 1029.320, 1030.320. 48. See 31 U.S.C. § 5318(g)(3). Financial institutions may report suspicious transactions regardless of amount involved and still take advantage of the safe harbor. 49. See 31 CFR §§ 1020.320(d), 1021.320(d), 1022.320(c), 1023.320(d), 1024.320(c), 1025.320(d), 1026.320(d), 1029.320(d), 1030.320(d). 50. Id.; see FinCEN, FIN-2007-G003, “Suspicious Activity Report Supporting Documentation” (June 13, 2007).

FINCEN NOTICE 11 SAR Filing Instructions SARs, and compliance with other BSA requirements, are crucial to identifying and stopping illicit activity related to CVC kiosks. FinCEN requests that financial institutions indicate a connection between the suspicious activity being reported and the activities highlighted in this Notice by including the key term “FIN-2025-CVCKIOSK” in SAR field 2 (Filing Institution Note to FinCEN), as well as in the narrative. Financial institutions may highlight additional advisory or notice keywords in the narrative, if applicable. Financial institutions also should select all other relevant suspicious activity fields, such as those in SAR Fields 36 (Money Laundering) and 38 (Other Suspicious Activities), if applicable. Financial institutions should include all available information relating to the account(s) and location(s) involved in the reported activity, identifying information and descriptions of any legal entities or arrangements involved and associated beneficial owners, and any information about related persons or entities involved in the activity. Financial institutions also should provide all available information regarding other domestic and foreign financial institutions involved in the activity; where appropriate, financial institutions should consider filing a SAR jointly on shared suspicious activity.51 Other Relevant BSA Reporting Requirements Financial institutions and other entities or persons also may have other relevant BSA reporting requirements to provide information in connection with the subject of this Notice. These include obligations related to the Currency Transaction Report (CTR),52 Report of Cash Payments Over $10,000 Received in a Trade or Business (Form 8300),53 Report of Foreign Bank and Financial Accounts (FBAR),54 Report of International Transportation of Currency or Monetary Instruments (CMIR),55 Registration of Money Services Business (RMSB),56 and Designation of Exempt Person (DOEP).57 51. See 31 CFR §§ 1020.320(e)(1)(ii)(A)(2))(i), 1021.320(e)(1)(ii)(A)(2)), 1022.320(d)(1)(ii)(A)(2), 1023.320(e)(1)(ii)(A)(2)(i), 1024.320(d)(1)(ii)(A)(2), 1025.320(e)(1)(ii)(A)(2), 1026.320(e)(1)(ii)(A)(2)(i), 1029.320(d)(1)(ii)(A)(2), 1030.320(d)(1)(ii)(A)(2). 52. A report of each deposit, withdrawal, exchange of currency, or other payment or transfer, by, through, or to a financial institution that involves a transaction in currency of more than $10,000. Multiple transactions may be aggregated when determining whether the reporting threshold has been met. See 31 CFR §§ 1010.310-313, 1020.310- 313, 1021.310-313, 1022.310-313, 1023.310-313, 1024.310-313, 1026.310-313. 53. A report filed by a trade or business that receives currency in excess of $10,000 in one transaction or two or more related transactions. The transactions are required to be reported on a joint FinCEN/Internal Revenue Service form when not otherwise required to be reported on a CTR. See 31 CFR §§ 1010.330, 1010.331. A Form 8300 also may be filed voluntarily for any suspicious transaction, even if the total amount does not exceed $10,000. 54. A report filed by a U.S. person that has a financial interest in, or signature or other authority over, foreign financial accounts with an aggregate value exceeding $10,000 at any time during the calendar year. See 31 CFR § 1010.350; FinCEN Form 114. 55. A form filed to report the transportation of more than $10,000 in currency or other monetary instruments into or out of the United States. See 31 CFR § 1010.340. 56. A form filed to register a money services business (MSB) with FinCEN, or to renew such a registration. See 31 CFR § 1022.380. 57. A report filed by banks to exempt certain customers from currency transaction reporting requirements. See 31 CFR § 1010.311.

FINCEN NOTICE 12 Information Sharing Information sharing among financial institutions is critical to identifying, reporting, and preventing identity theft and fraud schemes or other illicit financial activity. Financial institutions and associations of financial institutions sharing information under the safe harbor authorized by section 314(b) of the USA PATRIOT Act are reminded that they may share information with one another regarding individuals, entities, organizations, and countries suspected of possible terrorist financing or money laundering.58 FinCEN strongly encourages such voluntary information sharing. The Financial Crimes Enforcement Network’s Advisory Program communicates priority money laundering, terrorist financing, and other illicit finance threats and vulnerabilities to the U.S. financial system. Financial institutions may use this information to support effective, risk￾based, and reasonably designed anti-money laundering and countering the financing of terrorism (AML/CFT) programs and suspicious activity monitoring systems to help generate highly useful information for law enforcement and national security agencies. For Further Information FinCEN’s website at www.fincen.gov contains information on how to register for FinCEN Updates. Questions or comments regarding the contents of this Notice should be addressed to the FinCEN Regulatory Support Section by submitting an inquiry at www.fincen.gov/contact. The mission of the Financial Crimes Enforcement Network is to safeguard the financial system from illicit use, combat money laundering and its related crimes including terrorism, and promote national security through the strategic use of financial authorities and the collection, analysis, and dissemination of financial intelligence. 58. See FinCEN, “Section 314(b) Fact Sheet” (Dec. 2020).