§32A-2-8c. Virtual Currency Kiosk Requirements.

(a) A licensee, in establishing a relationship with a user and before entering into an initial virtual currency transaction on behalf of or with the user, shall disclose in clear, conspicuous, and legible writing all material risks associated with virtual currency generally. The material risks associated with virtual currency required to be disclosed include without limitation:

(1) A disclosure that is acknowledged by the customer, provided separately from the disclosures provided under subdivisions (2) and (7) of this subsection, and written prominently and in bold type stating the following: "WARNING: LOSSES DUE TO FRAUDULENT OR ACCIDENTAL TRANSACTIONS MAY NOT BE RECOVERABLE AND TRANSACTIONS IN VIRTUAL CURRENCY MAY BE IRREVERSIBLE.";

(2) Virtual currency is not backed or insured by the government, and accounts and value balances are not subject to protections of the Federal Deposit Insurance Corporation, National Credit Union Administration, or Securities Investor Protection Corporation;

(3) A virtual currency transaction may be deemed to be made when recorded on a public ledger which may not be the date or time when the customer initiates the virtual currency transaction;

(4) The value of virtual currency may be derived from the continued willingness of market participants to exchange fiat currency for virtual currency which may result in the permanent and total loss of the value of a particular virtual currency if the market for that virtual currency disappears;

(5) The volatility and unpredictability of the price of virtual currency relative to fiat currency may result in a significant loss over a short period of time;

(6) A bond maintained by the licensee for the benefit of the customers of the licensee may not be sufficient to cover all losses incurred by customers; and

(7) Virtual currency transactions may be irreversible and may be used by a person seeking to defraud customers, including, but not limited to, a person impersonating a customer’s family or friends, threatening jail time, stating that a customer’s identity has been stolen, insisting that a customer withdraw money from the customer’s bank account and purchase virtual currency, or alleging that a customer’s personal computer has been hacked.

(b) A licensee, when opening an account for a new customer and before entering into an initial virtual currency transaction for, on behalf of, or with the customer, shall disclose in clear, conspicuous, and legible writing, using not less than 24 point sans-serif-type font, all relevant terms and conditions associated with the products, services, and activities of the licensee and virtual currency generally. The disclosure shall include without limitation:

(1) The customer’s liability for unauthorized virtual currency transactions;

(2) The customer’s right to stop execution of a preauthorized virtual currency transfer and the procedure used to stop execution of the transaction;

(3) The circumstances under which the licensee, absent a court or government order, will disclose information concerning the customer’s account to third parties;

(4) The requirement that the licensee communicate to the customer what customer information may be disclosed to third parties;

(5) The customer’s right to receive a receipt for a virtual currency transaction at the time of the transaction;

(6) Upon a change in the rules or policies of the owner or operator, the customer’s right to consent to the changed rules or policies before performing a transaction after the change; and

(7) Any other disclosures that are customarily provided in connection with opening a person’s account.

(c) A licensee, before each transaction in virtual currency for, on behalf of, or with a customer, shall disclose to the customer in an easily readable manner that is in clear, conspicuous, and legible writing to advertise, solicit, or negotiate, either orally or in writing, for a transaction conducted in person, electronically, or by phone, using not less than 24 point sans-serif-type font, the terms and conditions of the virtual currency transaction. The terms and conditions shall include without limitation:

(1) The amount of the transaction;

(2) Any fees, expenses, and charges borne by the customer, including without limitation, applicable exchange rates;

(3) The type and nature of the virtual currency transaction;

(4) A warning that, once executed, the virtual currency transaction may not be undone, if applicable;

(5) A daily virtual currency transaction limit according to subsection (g) of this section;

(6) The difference in the sale price of the virtual currency versus the current market price; and

(7) Any other disclosures that are customarily given in connection with a virtual currency transaction.

(d) A licensee shall ensure that each customer acknowledges receipt of all disclosures required under this section.

(e) A licensee, upon the completion of a virtual currency transaction, shall provide to the customer a written, paper receipt. The receipt shall be provided in a retainable form and may be provided electronically if the customer requests and agrees to receive an electronic receipt. The receipt shall include without limitation:

(1) The name and contact information for the licensee, including without limitation, the licensee’s business address and a customer service telephone number established by the licensee to answer questions and register complaints;

(2) The name of the customer;

(3) The type, value, date, and precise time of the virtual currency transaction, transaction hash or identification number, and each virtual currency wallet address;

(4) The amount of the virtual currency transaction expressed in United States currency;

(5) The public virtual currency wallet address of the customer;

(6) The unique identifier of the virtual currency kiosk operator;

(7) A fee charged, including without limitation, a fee charged directly or indirectly by the licensee or a third party involved in the virtual currency transaction;

(8) The exchange rate, if applicable;

(9) Any tax collected by the licensee for the virtual currency transaction;

(10) A statement of the liability of the licensee for non-delivery or delayed delivery;

(11) A statement of the refund policy of the licensee;

(12) The name and telephone number of the Division of Financial Institutions and a statement disclosing that the licensee’s customers may contact the division with questions or complaints about the licensee’s virtual currency kiosk services; and

(13) Any additional information the commissioner may require.

(f) The following shall be the maximum daily virtual currency kiosk transaction limits:

(1) One thousand dollars for each new customer of a virtual currency kiosk; and

(2) Ten thousand dollars for each existing customer of a virtual currency kiosk.

(g) The licensee shall allow a new customer, upon the request of the customer, to cancel and receive a full refund for any fraudulent virtual currency transactions that occurred not later than 10 days after the new customer registered as a customer of the licensee if, not later than 30 days after the last virtual currency transaction that occurred during the 10-day period, the customer:

(1) Contacts the licensee and a government or law enforcement agency to inform them of the fraudulent nature of the virtual currency transaction; and

(2) Files a report with a government or law enforcement agency memorializing the fraudulent nature of the virtual currency transaction.

(h) Each licensee shall:

(1) Obtain a copy of a government-issued identification card that identifies each customer of the owner of the virtual currency kiosk or the virtual currency kiosk operator;

(2) Maintain restrictions that prevent more than one customer of the licensee from using the same virtual currency wallet;

(3) Be able to prevent designated virtual currency wallets from being used at a virtual currency kiosk owned or operated by the licensee;

(4) Use an established third party that specializes in performing blockchain analyses to preemptively perform the analyses to identify and prevent high risk or sanctioned virtual currency wallets from being used by customers at virtual currency kiosks owned or operated by the licensee;

(5) Define, in the licensee’s policies and procedures, a risk-based method of monitoring customers of the owner of the virtual currency kiosk or the virtual currency kiosk operator on a post-transaction basis;

(6) Offer, during the hours of operation of the virtual currency kiosks owned or operated by the licensee, live customer support by telephone from a toll-free telephone number prominently displayed at or on the virtual currency kiosks;

(7) Designate a contact person available to communicate with law enforcement regarding investigations involving transactions conducted through a kiosk operated by the operator

(8) Establish an enhanced due diligence protections policy and provide enhanced due diligence protections which shall include documentation of risk-based, pre-transaction procedures designed to identify and mitigate fraud, scams, or financial exploitation, including establishing the nature and purpose of the transaction, evaluating transaction and behavioral risk indicators, and placing a temporary transaction hold of up to 72 hours where elevated risk is identified. The licensee’s approval of the transaction shall be dependent upon the licensee’s assessment of the enhanced due diligence protections;

(9) Designate and employ a chief compliance officer who shall:

(A) Be qualified to coordinate and monitor a compliance program to ensure compliance with this section and all other applicable federal laws and regulations and state laws and rules; and

(B) Own not more than 20 percent of the licensee that employs the chief compliance officer; and

(10) Use full-time employees to fulfill the licensee’s compliance responsibilities under federal laws and regulations and state laws and rules.