The Coinme settlement: 34 state regulators close a crypto kiosk business over KYC, SAR and EDD gaps

The Coinme settlement is a multistate consent order, effective 7 October 2026, in which 34 state regulators fined the Seattle crypto firm 2.5 million dollars and ordered its virtual currency kiosks closed by 1 January 2027. Examiners found an ineffective BSA/AML program across transaction monitoring, KYC, SAR, EDD and recordkeeping, and the order clears Polygon Labs to acquire the company.

• The penalty is 2.2 million dollars plus 300,000 dollars of costs; a further 4 million dollars falls due if kiosks still operate in a participating state on 1 January 2027.
• The examination covered 31 March 2023 to 31 March 2025 and found deficiencies in transaction monitoring, KYC, SAR, EDD and recordkeeping.
• Coinme must engage an independent consultant within 60 days, receive an assessment report within six months, and complete a corrective action plan within 12 months.
• The order approves the change-of-control notice for Polygon Labs' acquisition of Coinme Holdings, announced in January 2026 in a deal worth more than 250 million dollars that also covers the wallet developer Sequence.
• The FBI logged more than 13,400 complaints and over 388 million dollars of losses involving crypto kiosks in 2025.

What does the Coinme settlement actually require?

The Coinme settlement is a Settlement Agreement and Consent Order dated 7 October 2026, coordinated through the Conference of State Bank Supervisors (CSBS) and the Money Transmitter Regulators Association (MTRA). It resolves a report of examination, imposes a 2.5 million dollar payment, ends the kiosk business in 34 jurisdictions, and installs a two-year independent consultant over the BSA/AML program.

The recitals set out the findings. During the examination period Coinme Inc. (NMLS 1185542) "did not maintain an effective BSA/AML program" for its kiosk business, with specific deficiencies in transaction monitoring controls, KYC policies, SAR policies, EDD policies and recordkeeping. These gaps, with insufficient responses to earlier examinations, "left it vulnerable to exploitation by criminal actors". Coinme neither admits nor denies the findings, and the order records that it has made material enhancements to the program. Washington DFI Director Charlie Clark said: "State regulation of money services exists to protect consumers from scams and bad actors."

The money comes in three layers. A 2.2 million dollar administrative penalty is divided among the states in the Appendix B amounts, which the Arkansas Securities Department says were allocated by transaction volume; Georgia, Washington, Florida and North Carolina take the largest shares. The seven states that ran the investigation share 300,000 dollars in costs. If Coinme has not ceased kiosk operations in all participating states before 1 January 2027, an additional 4 million dollars falls due, split equally at 117,647 dollars per jurisdiction.

The consultant provisions are the operational core of the Coinme settlement. Coinme must engage a qualified independent third party within 60 days; the lead states' executive committee (Alaska, Arkansas, Georgia, Illinois, North Carolina, Ohio and Washington) may object to the choice or scope within ten days. The consultant serves two years, delivers an assessment report within six months, then reports quarterly.

How did a 2025 Washington case become a 34-state order?

The Coinme settlement grew out of two tracks: a multistate examination that began in June 2025, and a Washington State case that reached a temporary cease-and-desist order in November 2025. The consent order resolves both, supersedes every pending state action against the company, and releases claims for covered conduct between 1 January 2020 and the effective date.

Washington's Statement of Charges of 25 November 2025, against Coinme and its chief executive Neil Bergquist, alleged that Coinme booked unredeemed kiosk vouchers as its own income, 2,201,254 dollars at year-end 2023 and 6,170,822 dollars at year-end 2024, without telling customers or escheating the funds. It also alleged negative tangible net worth at year-end 2022, 2023 and 2024, and inconsistent transaction volumes across filings. Washington sought licence revocation, a ten-year industry prohibition for both respondents and a 300,000 dollar fine.

In a statement reported by The Bellingham Herald on 9 October, Coinme said it had "resolved the multistate examination through a consent order and is carrying out its terms" and will complete its transition away from kiosk-based services by 1 January 2027.

Why do regulators treat crypto kiosks as a BSA/AML problem?

Crypto kiosks take cash from a customer and send virtual currency to a wallet the customer names, making them a common cash-out rail for impersonation and romance scams. Under FinCEN's 2019 guidance the kiosk owner-operator is a money transmitter, so MSB AML program, SAR and recordkeeping duties apply to every machine.

The FBI's Internet Crime Complaint Center reported in May 2026 that it received more than 13,400 complaints involving cryptocurrency kiosks in 2025, with losses above 388 million dollars, a 23 percent rise in complaints and a 58 percent rise in losses on 2024. More than half came from people over 50, who lost above 302 million dollars. The FBI cautions that losses are not solely attributable to kiosks.

States have two instruments. Many have passed kiosk statutes with daily limits and refund rights; Indiana went furthest with House Enrolled Act 1116, signed on 9 March 2026, which prohibits kiosk operation outright. The Coinme settlement uses the other instrument, the money transmission licence, to make one company exit the kiosk business as a condition of keeping its licences.

How does the Coinme settlement compare with earlier multistate actions?

The Coinme settlement is small in dollars and large in structure. The closest precedent is the January 2025 action against Block, Inc. and Cash App, in which 48 state regulators imposed an 80 million dollar penalty for BSA/AML failures. The Coinme settlement copies that architecture but adds a business-line exit and a change-of-control approval.

This month's 350 million dollar American Express AML penalty rests on two failure categories this order shares, suspicious activity reporting and transaction monitoring, at a federal charter.

The acquisition clause is the novel element. Polygon Labs announced on 13 January 2026 that it would buy Coinme and the wallet developer Sequence for more than 250 million dollars, with closing subject to regulatory approvals. Section VI of the consent order approves the advance change notice filed by Polygon Labs Holdings as of the effective date. It also bars anyone who left an operational manager role between 1 January 2023 and 30 days after that date from returning as an operational manager, or controlling Coinme's compliance or accounting functions, without state approval. The Coinme settlement is the regulatory gate through which the acquisition passes.

What does the Coinme settlement change for your obligations?

The Coinme settlement creates no new law, but shows which existing money services business duties the states will enforce by closing a product. The five deficiency categories map onto the federal MSB rules and state licensing conditions, and any transmitter running cash-in channels should read them as an examination checklist.

AML program (31 CFR 1022.210). Every money services business must maintain an effective anti-money laundering program. The finding that Coinme's program did not sufficiently mitigate kiosk risk is a finding against this rule.

Suspicious activity reporting (31 CFR 1022.320). MSBs must file a suspicious activity report on transactions aggregating at least 2,000 dollars that they know, suspect or have reason to suspect involve illicit funds, within 30 calendar days of detection. A customer following phone instructions, often holding a QR code from someone they have never met, is the FBI's archetype, and SAR policy was named as deficient in the Coinme settlement.

Know-your-customer and enhanced due diligence. The federal customer identification program rule does not apply to MSBs, but the states examined Coinme's KYC and enhanced due diligence policies as part of the AML program and found both wanting. The standard is risk-based: identify the customer well enough to monitor across sessions and machines, and escalate when behaviour matches scam patterns.

Transaction monitoring and recordkeeping. Transaction monitoring controls were the first deficiency listed. For kiosk operators that means velocity rules across locations, wallet-address reuse and structuring below thresholds, with five-year records.

State licensing conditions. The Washington charges add a layer federal rules do not: tangible net worth, permissible investments, accurate call reports and escheatment of unclaimed customer property.

What is still uncertain after the Coinme settlement?

The Coinme settlement says what the company must do, but leaves open who absorbs the consequences, how the kiosk estate is wound down or treated in the states that did not sign, and whether a 2.5 million dollar penalty changes behaviour in an industry with thousands of machines.

Scope of the exit. The cessation duty applies only in the 34 participating jurisdictions. Coinme's statement describes a complete transition away from kiosk services, which goes further than the order requires, but the order is silent on kiosks in non-participating states such as California, Texas or New York.

The customer-money question. Washington alleged unredeemed voucher value recorded as income, 2.2 million dollars at year-end 2023 and 6.2 million at year-end 2024, which DFI describes as more than 8 million dollars. The multistate order resolves those charges but contains no restitution schedule. Whether customers are made whole depends on the December 2025 Washington order, which required segregated safeguarding of unredeemed deposits, and on each state's unclaimed property law.

The acquirer's liability. The release covers Coinme, its parent, affiliates and successors. Polygon Labs acquires a clean slate for covered conduct up to 7 October 2026, with a consultant, quarterly state meetings and a corrective action plan attached. The states may revoke the order if they later find material misrepresentations, a contingent risk the buyer inherits.

Deterrence. Sixteen months passed between the opening of the examination and the order, and the states settled for a penalty smaller than the breakage income alleged by Washington alone. The real sanction is the business-line exit and the conditional 4 million dollars. The examination ran under the CSBS and MTRA protocol for multistate examinations, a standing framework for examining multistate MSB licensees, so the structure is reusable.

How should compliance teams respond?

Treat the Coinme settlement as a published examination scope for any money services business with cash-in or kiosk channels. The states will test transaction monitoring, KYC, SAR, EDD and recordkeeping against the MSB rules and against whether earlier findings were fixed.

Start with the findings log: the order cites insufficient responses to past examinations as an aggravating factor, so reconcile every open prior finding against evidence of closure. Test SAR decisioning on kiosk and cash channels against the FBI's scam typology: cash deposits by an older customer following phone instructions, QR codes supplied by a stranger, transactions that continue after the kiosk operator's fraud warning. Map monitoring rules to machines and wallet addresses, not only named customers. Check the state licensing fundamentals federal reviews skip, because the Washington case shows those produce charges against individuals.

Zyphe helps money transmitters and exchanges evidence the KYC and EDD side of this checklist without a central store of customer PII: documents and biometrics are verified, sharded and encrypted into the user's own vault, and the business receives results and an exportable audit trail for an examiner or independent consultant. If you are preparing for a multistate review, book a demo or see how our AML software and transaction monitoring software fit an MSB program.

The bottom line

The Coinme settlement shows state money transmission regulators using the licence, not the statute book, to remove a product they consider unmanageable. The dollar penalty is modest; the structural terms are not. A two-year consultant, quarterly meetings with seven lead states, a forced exit from kiosks and a conditional penalty for missing the date amount to supervised remediation of a business about to change hands. For any MSB running cash-in channels, the five named deficiency categories are the examination scope to prepare for, and the aggravating factor to avoid is a prior finding that was never closed.

Cited sources

• Settlement Agreement and Consent Order, Coinme Inc., C-25-4009-26-CO02, Washington DFI (effective 7 October 2026)
• CSBS press release: State financial regulators reach 2.5 million dollar settlement with crypto kiosk operator (8 October 2026)
• Washington DFI press release: multi-state consent order with Coinme, Inc. (8 October 2026)
• Washington DFI Statement of Charges, Coinme Inc. and Neil Bergquist, C-25-4009-25-SC01 (25 November 2025)
• Washington DFI Temporary Order to Cease and Desist, Coinme Inc., C-25-4009-25-TD01 (25 November 2025)
• Washington DFI press release: temporary cease-and-desist order against Coinme (1 December 2025)
• FBI IC3 public service announcement on cryptocurrency kiosk scams, 2025 data (15 May 2026)
• FinCEN guidance FIN-2019-G001, section 4.3 on CVC kiosks (9 May 2019)
• 31 CFR 1022.320, reports by money services businesses of suspicious transactions
• 31 CFR 1022.210, anti-money laundering programs for money services businesses
• CSBS press release: state regulators issue 80 million dollar penalty to Block, Inc. and Cash App (15 January 2025)
• Polygon Labs press release: agreement to acquire Coinme and Sequence (13 January 2026)
• Arkansas Securities Department: Arkansas joins 2.5 million dollar settlement with crypto kiosk operator (8 October 2026)
• Indiana Governor's Office, 2026 Bill Watch: HEA 1116 Virtual currency kiosks, signed 9 March 2026
• Indiana House Republicans: governor signs HEA 1116 banning cryptocurrency kiosks (May 2026)
• The Bellingham Herald via The Spokesman-Review: Seattle-based crypto exchange company agrees to multi-state settlement (9 October 2026)