Crypto ATM / CVC Kiosk Scams: The AML Red Flags Teams Are Expected to Catch

Answer in brief
FinCEN’s August 2025 notice says CVC kiosks are being exploited for scam payments, cyber-enabled fraud, and drug-related laundering. The high-signal patterns are third-party coaching, victim withdrawals of cash to fund kiosk purchases, structuring below thresholds, smurfing across machines, repeated use of the same wallet or phone number, and links to wallets already associated with fraud. ([FinCEN.gov][6])

Why this became urgent

FinCEN noted that in 2024 the FBI’s IC3 received more than 10,956 complaints involving CVC kiosks, with approximately $246.7 million in reported victim losses. FinCEN also said the number of complaints rose 99 percent from 2023, while reported losses rose 31 percent. ([FinCEN.gov][7])

Why kiosks are so attractive to scammers

FinCEN explains that victims are often given step-by-step instructions to withdraw cash, find a kiosk, and send funds to a QR-code-linked wallet controlled by the scammer. Scammers may tell victims how to break payments into smaller amounts, split deposits across multiple kiosks, and continue paying through new mechanisms once the first method works. ([FinCEN.gov][7])

Red flags for kiosk operators

FinCEN’s red flags include:

• multiple payments just below SAR or state-law thresholds from multiple kiosk locations,
• structuring below CTR thresholds or kiosk limits,
• a customer with little history making a substantial deposit that is rapidly moved, commingled, or swapped into a different CVC,
• multiple customers depositing to the same wallet in a short time,
• multiple customer accounts tied to the same phone number or wallet address,
• blockchain links to wallets associated with fraud or illicit activity. ([FinCEN.gov][7])

Red flags for banks and other financial institutions

FinCEN separately flags:

• large cash withdrawals from bank or retirement accounts where the customer says someone on the phone or internet told them to use a kiosk,
• older customers with no prior CVC activity suddenly making high-value kiosk-related transactions,
• repeated debit-card payments below thresholds to kiosk operators. ([FinCEN.gov][7])

The compliance trap

The trap is focusing only on the customer side and ignoring the operator side. FinCEN also warns about non-compliant kiosk operators that fail to register as MSBs, fail to collect required customer information, or even advertise that customers can transact with only a phone number or email address. ([FinCEN.gov][7])