Title 6.2. Financial Institutions and Services
Chapter 22.2. Virtual Currency Kiosks
§ 6.2-2254. (Effective July 1, 2027) Prevention of fraudulent activity and money laundering.
A. Each licensee shall take reasonable steps to detect and prevent fraud and money laundering, including by establishing and maintaining a written antifraud policy and abiding by all relevant provisions of the federal Bank Secrecy Act (31 U.S.C. § 5311 et seq.). Such policy shall include (i) identification and assessment of fraud and money laundering-related risk areas; (ii) procedures and controls to protect against identified risks; (iii) the allocation of responsibility for monitoring risks; and (iv) procedures for the periodic evaluation and revision of such policy, procedures, and controls.
B. Each licensee shall use blockchain analytics and tracing software to assist in the prevention of sending virtual currency to a virtual currency wallet known or likely to be affiliated with fraudulent activity at the time of a transaction and to detect transaction patterns indicative of fraud or other illicit activities. A licensee shall block transactions to virtual currency wallets associated with overseas exchanges non-accessible to U.S. users. The Commission may request evidence from any virtual currency kiosk operator of their current use of blockchain analytics.
C. Each licensee shall post a conspicuous written warning within readable sight of the virtual currency kiosk providing notice to users that criminals may direct victims of fraud or scams to send money via virtual currency kiosks. Such warning shall include the kiosk operator's toll-free customer service phone number.
D. For each attempted virtual currency transaction, the licensee or its agent shall verify the identity of the user prior to accepting payment, including by obtaining a copy of a government-issued identification card that identifies the user and by collecting additional user information including the user's name, date of birth, telephone number, address, and email address. No licensee shall allow a user to engage in any transaction at a virtual currency kiosk under any name, account, or identity other than the user's own true name and identity.
E. On an annual basis, each licensee shall provide each location with staff training materials that outline how criminals may exploit virtual currency kiosks for illicit activity, including red flag indicators that a virtual currency kiosk user may be the victim of fraud or a scam and common signs of financial abuse and exploitation. No licensee shall prohibit or prevent staff at the location of a virtual currency kiosk from educating users about fraud and scams.
F. In cases related to fraud, a licensee shall issue a refund to the user of any transaction fees at the time of the transaction, paid in the originating currency and regardless of any acknowledgements made by the user prior to finalizing such transaction. To receive a full refund, a user shall (i) have engaged in a transaction involving a virtual currency kiosk that was affected by fraud, whether authorized or unauthorized; (ii) inform the virtual currency kiosk operator of the fraudulent nature of the transaction at issue within 90 days after such transaction; and (iii) submit a police report, government agency report, or sworn statement detailing the fraudulent nature of the transaction to the virtual currency kiosk operator within 120 days after such transaction.
