Crypto ATM software connects a cash kiosk to a back-office server that prices each trade, checks the customer's identity and sends coins from the operator's wallet. This guide explains the software parts and the rules a bitcoin ATM business must follow. It also covers the scam controls that new laws require and the choice between buying and building the system.
How a crypto ATM transaction works
- The customer chooses to buy crypto with cash or, on a two-way machine, to sell crypto for cash.
- The kiosk asks the back office for a quote, and the back office takes a price from one or more exchanges and adds the operator's markup.
- The customer proves their identity. Depending on the amount and the location, the identity check asks for a phone number, an ID scan or a selfie for a liveness check.
- For a purchase, the customer scans a wallet QR code and inserts banknotes, and the bill validator reports each note to the kiosk.
- The back office screens the destination address against risk lists and then sends the coins from a hot wallet, and the kiosk prints or texts a receipt.
- For a sale, the kiosk shows a deposit address. After the deposit confirms on the blockchain, the customer redeems a code for cash at the dispenser.
Crypto ATM software components
| Component | What it does |
|---|---|
| Kiosk application | Runs the touchscreen and QR scanner. Drives the bill validator, dispenser, printer and camera. Handles lost connections and sends tamper alerts. |
| Back office | Sets prices and markups. Enforces limits per customer and per day. Runs identity checks, stores transaction records and monitors the fleet. |
| Wallet service | Keeps a hot wallet for each coin. Estimates network fees, sends transactions, watches deposits for sales and refills from cold storage. |
| Liquidity and hedging | Buys coins on exchanges or through OTC desks. Hedging limits the operator's loss if the price moves between a sale and the restock. |
| Compliance tools | Verify identity, screen sanctions lists, run blockchain analytics on destination addresses, file suspicious activity reports and keep records. |
| Cash logistics | Track cassette levels, schedule cash pickups and match counted cash against the notes the kiosk logged. |
Security of the kiosk and the server
Kiosks usually run a locked-down Linux or Windows build with remote management. A kiosk stands in a public place, so it must never store private keys and should only ask the server to send funds. The back office signs transactions, ideally with multi-party computation (MPC) or a hardware security module (HSM). The crypto wallet development guide compares those custody options.
The back-office server is the bigger target. In March 2023, an attacker used an unknown flaw in General Bytes' server software to take about 56 BTC from several operators, and General Bytes released a patch and closed its hosted cloud service. A self-hosted or vendor-hosted back office needs firewall rules, two-factor admin login, fast patching and withdrawal limits on hot wallets.
Licensing and compliance for a bitcoin ATM business
In the US, a kiosk operator is usually a money services business that must register with FinCEN, run an anti-money-laundering program and file suspicious activity reports. Most states also require a money transmitter license.
States have added rules that apply only to crypto kiosks:
| State | Daily limit | Other rules |
|---|---|---|
| California | $1,000 per customer (since January 2024) | Fee cap of $5 or 15% of the transaction, whichever is greater (since 2025) |
| Arizona | $2,000 for new customers, $10,500 for existing customers | Full refund, with fees, to a new customer who reports fraud within 30 days (law in effect September 2025) |
| Colorado | $2,000 new, $10,500 existing | Refund rights for some first-transaction fraud victims (2026) |
| Wisconsin | $1,000 per person | Paper receipts and refunds for proven fraud victims (April 2026) |
Some other countries have stricter rules:
- United Kingdom: the FCA has registered no crypto ATM operator, so running one is illegal. In February 2025 a UK court sentenced Olumide Osunkoya to four years in prison for running an unregistered crypto ATM network.
- Australia: AUSTRAC set a cap of AU$5,000 on cash deposits and withdrawals in 2025 and also requires scam warnings and stronger customer checks.
- New Zealand: the government announced a ban on crypto ATMs in July 2025, as part of an anti-money-laundering package.
Crypto ATM software therefore needs rules that change by location, covering identity thresholds, daily and rolling limits, waiting periods for new users, fee caps, receipt fields and a block list of flagged addresses.
Scams at crypto ATMs
The FBI received 10,956 complaints about crypto kiosks in 2024, with reported losses of $246.7 million. FinCEN published a notice on crypto kiosk scams in August 2025 and listed red flags for operators. The FBI reported more than 13,400 kiosk complaints and more than $388 million in losses for 2025.
Most of these scams follow one pattern. A caller poses as a government agent, a bank fraud officer or tech support and tells the victim to withdraw cash and put it into a kiosk, using a QR code that the scammer supplies. Once the kiosk sends the coins, nobody can reverse the transaction. Older adults lose the largest share of the money.
Operators build these controls into the software:
- Full-screen warnings that no government agency or bank asks for payment through a crypto ATM.
- Low first-day limits and holds for new customers, with a live phone call above a set amount.
- Screening of destination addresses against known scam wallets before the coins are sent.
- Alerts on patterns such as repeated maximum deposits by a new, older customer to an address that customer has never used.
- A fast channel for victims and police to report fraud, and a refund process where the law requires one.
Buy, white-label or build crypto ATM software
| Route | What you get | Trade-off |
|---|---|---|
| Manufacturer software | Hardware makers such as General Bytes and Lamassu ship kiosk software and a back office that the operator hosts or rents. | Fastest start. The operator depends on the vendor's compliance features, fees and patch schedule. |
| White-label platform | A software vendor supplies a branded back office that works with several kiosk models. | Less hardware lock-in. The operator still depends on one vendor for compliance updates. |
| Custom back office | The operator writes its own pricing, compliance and wallet services. | Full control over rules by state. Needs an engineering team and a compliance team. |
Some open-source kiosk projects exist, but before you deploy one, check how often it gets updates and how fast past security flaws were fixed. If you plan to sell crypto online as well, much of the back office overlaps with crypto exchange software.
Cost drivers of a bitcoin ATM business
A crypto ATM operator earns money from the markup on each trade. Costs come from these items:
- Hardware for each kiosk, where two-way machines with cash dispensers cost more than one-way machines.
- Rent for each site, cash pickup and insurance, which often make up most of the running cost.
- A fee for each identity check, and subscriptions to blockchain analytics tools.
- Licenses in each state or country, which can take many months. The crypto exchange license overview describes the main types of license.
- Engineering for a custom back office. A team of three to five engineers for several months is a reasonable estimate, plus ongoing work to follow new rules.
Coin ATM Radar counted about 38,900 crypto ATMs worldwide in March 2026, and about 30,200 of them were in the US. Daily limits and fee caps in new state laws reduce the revenue each machine can earn.
Frequently asked questions
Does a crypto ATM need a license?
In most countries, yes. In the US, an operator needs FinCEN registration and usually a state money transmitter license. Other countries require registration as a virtual asset service provider. The UK and New Zealand do not allow crypto ATMs.
Can a crypto ATM transaction be reversed?
No. Once the coins leave the operator's wallet, only the receiver can send them back, though some US states require operators to refund new customers who report fraud quickly.
What is a two-way crypto ATM?
A two-way crypto ATM sells crypto for cash and also buys crypto from customers for cash, so the machine needs a cash dispenser, deposit monitoring and more cash handling.
Should private keys be stored on the kiosk?
No. Anyone can reach a kiosk in a public place, so the back office should sign transactions, and the kiosk should only send requests.