Utah law limits cryptocurrency kiosk transactions and adds customer safeguards

Kiosk operators must limit each customer's transactions to $2,000 per day during the first three calendar days after the customer's first transaction, then $5,000 per day. The limits apply to each customer and transactions with the same operator. The limits count cash or its equivalent in virtual currency across all Utah kiosks run by the same operator. The first limit applies during the three calendar days following the customer's first transaction with that operator; the higher limit applies after that period.

Kiosk operators must explain transaction terms and risks, display fraud warnings, give customers receipts, and provide a toll-free help line. These requirements apply to virtual currency kiosk operators doing business in Utah and to each kiosk transaction. Disclosures must be in the customer's chosen language and say the transactions are not insured or guaranteed by the Federal Deposit Insurance Corporation or the Securities Investor Protection Corporation; customers must confirm they received them. Each kiosk must display the fraud warning in English and Spanish. Receipts must include transaction details, fees, contact information, and the operator's refund policy. Operators must provide a receipt after each transaction and keep the help line available 24 hours a day, seven days a week.

Kiosk operators must keep transaction records, cooperate with law enforcement, and report their kiosk locations to the state. These duties apply to virtual currency kiosk operators in Utah. Operators must cooperate with lawful requests about fraud and other unlawful activity and provide records for state examination or audit when asked. The Division of Consumer Protection may impose administrative fines up to $2,500 per violation and bring a court action. Violating an administrative or court order may bring a civil penalty up to $5,000 per violation. Operators must file a location report at least once each calendar year and notify the state within 30 days after installing or removing a kiosk.

Each local law enforcement agency must ensure at least one employed peace officer completes specialized cryptocurrency investigation training. The requirement applies to every local law enforcement agency in Utah. The training covers tracing digital assets, preserving evidence, using investigation tools, legal process, and coordination with federal agencies and exchanges. Training standards are set by the training director or designee with the council. The agency's chief or executive officer decides whether an officer meets those standards; a trained officer may assist other local agencies. The requirement begins July 1, 2026, and training must occur at least once every three years.

Local law enforcement agencies and the Division of Securities must report cryptocurrency investigation data to the State Commission on Criminal and Juvenile Justice, which must send an annual summary to a legislative committee. The reporting duties apply to each local law enforcement agency and the Division of Securities. The commission sends its summary to the Law Enforcement and Criminal Justice Interim Committee. Reports cover cases opened and closed, tracing, outcomes, arrests, charges, convictions, and digital assets recovered or seized. Information is protected from public release when disclosure would compromise an ongoing investigation or reveal investigative techniques. Agencies report quarterly; the commission must send its summary by November 30 each year. This reporting section is scheduled for repeal July 1, 2030.