HB2232 - 572R

Be it enacted by the Legislature of the State of Arizona:

Section 1. Title 6, chapter 12, article 1, Arizona Revised Statutes, is amended by adding sections 6-1237 and 6-1237.01, to read:

START_STATUTE6-1237. Cryptocurrency kiosk operators; licensure; requirements for operating cryptocurrency kiosks; civil penalties; violation; classification; rules; definitions

A. On or before January 1, 2027, a person who wishes to operate a cryptocurrency kiosk shall obtain a license that is issued by the department.

B. An applicant shall submit a complete application on a form as prescribed by the department that includes the names of all owners and managers of the cryptocurrency kiosk. If the director denies the application, the applicant is entitled to a hearing pursuant to title 41, chapter 6, article 10.

C. Each applicant for a cryptocurrency kiosk operator license shall submit a full set of fingerprints to the department of insurance and financial INSTITUTIONS to obtain a state and federal criminal records check pursuant to section 41-1750 and public law 92-544. The department of public safety may exchange this fingerprint data with the federal bureau of investigation. The department of INSURANCE and financial institutions shall conduct a review that includes all of the following:

1. A financial audit of the applicant's assets and solvency.

2. A review of the past fifteen years of financial and regulatory history.

3. Verification of the source of the applicant monies.

D. The department shall deny an application if the person has a conviction of any of the following:

1. Fraud.

2. Money laundering.

3. Taking the identity of another person or entity.

4. Participating in or assisting a criminal syndicate.

5. Any financial crime in which the person was convicted within the previous fifteen years.

E. A license is valid for one year after the date of issuance and shall be renewed annually.

F. A cryptocurrency kiosk operator may not complete any transaction unless all of the following verification steps are completed:

1. A government-issued identification is scanned and validated by using authentication technology.

2. A live facial capture of the customer is recorded and matched to the government-issued identification.

3. A two-factor authentication is performed using a phone verification and a device verification.

4. the customer's address is verified by using commercially reasonable means.

5. For all transactions that exceed $300, the customer must certify the purpose of the transaction and COMPLETE a fraud-screening questionnaire.

G. Any anonymous, unverifiable or mismatched transactions are strictly prohibited.

H. A cryptocurrency kiosk operator shall Freeze any suspicious transaction for at least seventy-two hours on notification of suspicious activity.

I. for all cryptocurrency kiosks and cryptocurrency kiosk transactions, A cryptocurrency kiosk operator shall do the following:

1. Maintain a CONTINUOUS quality video recording.

2. Maintain a continuous audio recording of all cryptocurrency kiosk transactions.

3. Maintain a timestamped global positioning system log of device activity.

4. Maintain a facial capture log for each customer.

5. Maintain a cryptocurrency kiosk transaction log for all activity.

6. Retain all the records for at least seven years.

J. A cryptocurrency kiosk operator shall report all suspected fraud or coercion to the department, the attorney general and the local law enforcement agency within fifteen minutes after discovery.

K. A cryptocurrency kiosk operator may not:

1. Conduct an anonymous or unverifiable cryptocurrency kiosk transaction.

2. Disable or obstruct the required video or audio surveillance.

3. Allow any cryptocurrency kiosk transaction that exceeds $2,000 in a twenty-four-hour period per customer.

4. Knowingly assist or facilitate fraud, coercion, elder exploitation or money laundering.

5. Refuse to provide records pursuant to a request from the department.

L. EAch cryptocurrency kiosk shall conspicuously display and audibly play the following warning:

WARNING: cryptocurrency kiosk transactions are irreversible. If anyone instructed you online, by telephone or in person to use this cryptocurrency kiosk, STOP IMMEDIATELY. You may be the target of a scam. Government agencies, law enforcement agencies, utility companies and courts DO NOT accept bitcoin or cryptocurrency as payment.

M. The warning must:

1. Appear on the cryptocurrency kiosk screen for at least ten seconds before any cryptocurrency kiosk transaction.

2. Be posted physically on the cryptocurrency kiosk.

3. Be provided in both English and Spanish.

4. Be read aloud through the cryptocurrency kiosk audio before proceeding.

N. All customer information, identity records, cryptocurrency kiosk transactions logs, surveillance footage, facial captures and suspicious activity reports required by this section are confidential and may only be provided to:

1. A law enforcement agency.

2. A regulatory agency that is engaged in an official investigation.

3. A court pursuant to a court order.

4. A federal agency that is engaged in cybercrime, financial crime or anti-money laundering enforcement.

O. A cryptocurrency kiosk operator shall provide the following to a law enforcement agency or the department on request within one hour:

1. A customer identity record.

2. Full cryptocurrency kiosk video and audio recordings.

3. Facial capture logs.

4. Global positioning system and device logs.

5. All suspicious ACTIVITY reports.

6. Banking and exchange integration logs.

P. The department may impose the following civil penalties against a cryptocurrency kiosk operator that violates this section:

1. Not more than $50,000 per violation.

2. $25,000 per day for operating a cryptocurrency kiosk without a license.

3. Not more than $100,000 for failing to implement the required surveillance in a cryptocurrency kiosk.

4. Not more than $25,000 per day if the cryptocurrency kiosk operator fails to DISPLAY the warnings as prescribed in this section.

Q. Civil penalties collected pursuant to this section shall be deposited, pursuant to sections 35-146 and 35-147, IN the digital asset oversight fund established by section 6-1237.01.

R. A cryptocurrency kiosk operator that:

1. Fails to report suspected fraud is guilty of a class 4 felony.

2. Fails to freeze a suspicious cryptocurrency kiosk transaction is guilty of a class 3 felony.

3. Knowingly assists in fraud is guilty of a class 2 felony.

4. knowingly disables surveillance equipment is guilty of a class 3 felony.

S. The director may establish fees as prescribed in rule.

T. The department shall adopt rules that are necessary to implement this section that include:

1. Identity verification standards.

2. Fraud screening procedures.

3. Cryptocurrency kiosk surveillance standards.

4. Reporting requirements.

5. Recordkeeping standards.

6. Fee schedules and renewal procedures.

7. Compliance audits.

U. For the purposes of this section, "Cryptocurrency kiosk", "cryptocurrency kiosk operator" and "cryptocurrency kiosk transaction" have the same meanings prescribed in section 6-1236. END_STATUTE

START_STATUTE6-1237.01. Digital asset oversight fund

The DIGITAL asset oversight fund is established consisting of civil penalties collected pursuant to section 6-1237. THe department shall administer the fund. Monies in the fund are continuously appropriated. END_STATUTE

Sec. 2. Appropriation; department of insurance and financial institutions; exemption

A. The sum of $4,000,000 is appropriated from the state general fund in fiscal year 2026-2027 to the department of insurance and financial institutions to administer section 6-1237, Arizona Revised Statutes, as added by this act.

B. The appropriation made in subsection A of this section is exempt from the provisions of section 35-190, Arizona Revised Statutes, relating to lapsing of appropriations.