The landscape for cryptocurrency kiosk operations in Arkansas changed dramatically in April 2025. House Bill 1467 introduced sweeping regulatory requirements that fundamentally alter how virtual currency kiosk operators must conduct business in the state. While Arkansas lawmakers aimed to protect consumers from fraud and elder financial abuse, these new provisions create significant compliance challenges for businesses operating in this space.

Understanding these requirements is crucial for any cryptocurrency kiosk operator doing business in Arkansas. At Bulldog Law, we help clients navigate complex financial services regulations and ensure their operations remain compliant with evolving state requirements.

Understanding the New Customer Rescission Rights

One of the most operationally challenging aspects of HB1467 is the newly created rescission right for customers who believe they've been defrauded. Unlike federal remittance transfer rules that provide a 30-minute cancellation window, Arkansas has established a more complex framework specifically targeting potential fraud scenarios.

Under the new law, kiosk operators must allow new customers to cancel transactions and receive full refunds for fraudulent virtual currency transactions that occurred within 72 hours of their initial registration. However, customers must act quickly. They have only 14 days after their last transaction during that 72-hour window to submit their refund request.

The process requires customers to take specific steps. They must contact both the kiosk operator and a government or law enforcement agency about the suspected fraud. Additionally, they need to file an official report with authorities documenting the fraudulent nature of the transaction.

This creates substantial operational hurdles. Kiosk operators need to develop technological solutions that integrate this rescission right into their machine interfaces and transaction flows. They also need sufficient staffing to process these claims efficiently. For businesses without robust customer service infrastructure, this requirement alone may necessitate significant operational changes.

Mandatory Disclosure Requirements That Impact Operations

Arkansas has standardized what information kiosk operators must provide to customers, codifying practices that some operators may have already adopted voluntarily. However, the specificity of these requirements means most operators will need to enhance their disclosure capabilities.

Before each transaction, customers must receive comprehensive information including the transaction amount, all fees and charges, applicable exchange rates, the type of virtual currency transaction, warnings about irreversibility, daily transaction limits, and the difference between the sale price and current market price. This pre-transaction disclosure ensures customers understand exactly what they're agreeing to before committing funds.

The transaction receipt requirements are even more detailed. Operators must provide receipts containing 13 specific categories of information, from basic contact details and customer names to transaction hashes, virtual currency addresses, fee breakdowns, exchange rates, tax collection information, refund policies, and state securities department contact information. Customers must be able to retain these receipts, and operators can provide them electronically if customers agree.

Arkansas also requires specific fraud warnings before each transaction. Operators must disclose material risks associated with virtual currency, including the lack of recoverability, absence of FDIC or NCUA protections, market volatility, and transaction irreversibility. Before opening customer accounts, additional disclosures about liability, payment rights, information sharing practices, and receipt rights are mandatory.

Technical Requirements That Change Kiosk Functionality

Beyond disclosures, HB1467 imposes specific technical requirements on how kiosks must operate. While many established operators have already implemented similar measures, the law makes these practices mandatory across Arkansas.

Every customer must provide government-issued identification. Kiosk operators must implement technology preventing multiple customers from using the same virtual currency wallet. The systems must also block specific wallets from use and identify high-risk or sanctioned wallets proactively. Post-transaction monitoring through risk-based methods becomes a legal requirement rather than a best practice.

These technical mandates require sophisticated software solutions and ongoing maintenance to ensure compliance. Operators using older kiosk models or basic transaction systems may face substantial upgrade costs.

Organizational Structure and Staffing Mandates

HB1467 goes beyond federal Bank Secrecy Act requirements by imposing specific organizational structure mandates. These provisions particularly impact smaller, closely held operations where owners wear multiple hats.

The law requires a qualified chief compliance officer responsible for ensuring legal compliance. Critically, this person cannot own more than 20 percent of the company. This ownership restriction may force some operators to restructure their businesses entirely.

Compliance duties must be handled by full-time employees rather than contractors or part-time staff. Operators must also provide live phone support during all kiosk operating hours, with the support number clearly displayed. For smaller operators accustomed to lean staffing models, these requirements represent substantial ongoing expenses.

Enhanced Compliance Programs and Elder Protection Measures

Arkansas has established compliance program requirements that extend beyond standard BSA obligations. These focus particularly on preventing elder financial abuse through cryptocurrency kiosk transactions.

Operators must provide annual training materials to authorized delegates on recognizing elder financial abuse and responding appropriately when transactions raise red flags. The law mandates specific elder adult safeguards requiring operators to speak with new elder customers before their first transaction, record these conversations, reconfirm attestations, discuss the transaction thoroughly, explain fraud risks, and approve transactions based on conversation outcomes.

These elder protection provisions recognize that cryptocurrency scams disproportionately target older adults. While well-intentioned, they create additional operational complexity and potential liability concerns for operators who must make judgment calls about transaction approval.

Transaction Limits and Fee Restrictions

Arkansas has imposed strict limitations on transaction amounts and fees that operators can charge. Operator fees are capped at either $5 or 18 percent of the transaction value, whichever applies. Daily transaction limits restrict new customers to $2,000 and existing customers to $7,500.

These limitations directly impact revenue potential, particularly for operators serving customers who previously conducted larger transactions. The daily limits may also drive some customers to competitors in neighboring states without similar restrictions.

The law also strengthens consumer claims against operators by requiring surety bonds to benefit claimants directly and allowing consumers to make direct claims against these bonds for faithful performance of transmission obligations.

Information Security Program Requirements

Perhaps the most technically demanding aspect of HB1467 is its classification of all money services businesses, including cryptocurrency kiosk operators, as financial institutions subject to comprehensive information security requirements.

Operators must designate a qualified individual to lead their information security program and conduct written risk assessments identifying internal and external threats to customer information security. These assessments must include criteria for evaluating security risks, assessing system confidentiality and integrity, and describing how identified risks will be mitigated.

Required safeguards include implementing access controls, encrypting customer information both at rest and in transit, securing applications transmitting customer data, implementing multi-factor authentication, developing data retention guidelines with secure disposal procedures, adopting change management procedures, and implementing activity logging controls.

Operators must regularly test their security programs through annual penetration tests and biannual vulnerability assessments. They must also ensure personnel receive security awareness training and that contractors maintain appropriate safeguards through contractual requirements.

The law mandates incident response plans addressing security incidents that could affect customer information confidentiality, integrity, or availability. These plans must define roles, communication protocols, remediation requirements, and documentation procedures.

For smaller operators encountering government-imposed information security regulations for the first time, these requirements may present significant implementation challenges. The only exception applies to operations maintaining fewer than 5,000 consumers' information.

How Bulldog Law Can Help

The complexity of Arkansas HB1467 creates substantial compliance challenges for cryptocurrency kiosk operators. From restructuring corporate ownership to implementing comprehensive information security programs, the requirements touch every aspect of operations.

At Bulldog Law, we work with financial services clients to ensure regulatory compliance while protecting their business interests. Whether you're entering the Arkansas market, adapting existing operations to new requirements, or facing enforcement actions, our team understands the intersection of cryptocurrency regulation and traditional money services law.

We can help evaluate your current compliance posture, develop policies and procedures meeting Arkansas requirements, structure corporate ownership to satisfy chief compliance officer mandates, implement training programs for elder financial abuse prevention, and respond to regulatory inquiries or investigations.

The regulatory environment for cryptocurrency continues evolving rapidly. Having experienced legal counsel helps you stay ahead of compliance requirements while focusing on business growth. Contact Bulldog Law to discuss how we can support your cryptocurrency kiosk operations in Arkansas and beyond.