The Illinois Digital Asset Kiosk Act

Why the Act exists

The Digital Asset Kiosk Act was not written in the abstract. It was written against a specific and well-documented pattern of harm.

In 2025 the FBI's Internet Crime Complaint Center received 13,460 complaints nationally involving cryptocurrency kiosks, with adjusted losses of $388,981,267 — complaints up 23% and losses up 58% on the previous year. Illinois accounted for 510 complaints and $20,077,277 in losses, sixth highest of any state. More than half of complainants nationally were aged fifty or over, accounting for over $302 million.

The mechanism was consistent: criminals gave victims detailed instructions on withdrawing cash from a bank, locating a specific kiosk, and depositing funds — often staying on the line throughout. The machines were not compromised. They were used exactly as designed, by people who had been manipulated into using them.

SB 2319 was signed by Governor J.B. Pritzker on 18 August 2025, the same day as the Digital Assets and Consumer Protection Act. Unlike DACPA, whose licensing provisions were deferred to 2027, the kiosk consumer protections took effect immediately.

The fee cap and transaction limits

Three numbers, and they apply to every kiosk in Illinois regardless of operator.

The cap is a genuine protection — before it, Chicago-area machines were quoted in surveys at anywhere from 10% to 23%. It is also worth being clear that 18% remains an extraordinary rate by the standards of any other consumer financial product, and published Illinois rates still run to the mid and high teens on the buy side.

For a full dollar-by-dollar breakdown of what the cap permits at each transaction size, see our fees and limits guide.

Disclosure duties

Operators must provide disclosures before engaging in each transaction — not afterwards, and not buried in terms you agree to once.

In practice the disclosure screen should show you four things, and you should read all four:

1. The fee, as a percentage or dollar amount.
2. The exchange rate the machine will use — a separate cost from the fee, and where much of the real variation between machines lives.
3. The amount of crypto you will actually receive.
4. Any network fee passed on separately.

Operators must also report the physical location of every kiosk to the Illinois Department of Financial and Professional Regulation, which is what makes enforcement possible at all.

Anti-fraud obligations

Four requirements sit on operators, and they are more substantive than most state kiosk laws.

The wallet-screening requirement matters more than it sounds. A great deal of kiosk fraud sends funds to addresses that are already known to analytics firms from earlier reports. Blocking those transfers at the machine stops the loss before it happens.

The designated-officer requirement matters practically: it means that when you make a refund claim, there is a named function responsible for handling it rather than a generic support queue.

The refund right

This is the provision that distinguishes Illinois from most states, and it is worth quoting the structure precisely because the details determine whether a claim succeeds.

Operators are required to issue refunds for fraudulent transactions at the request of a new customer within the new customer period.

• New customers are entitled to full refunds for up to three fraudulent transactions within their first week or first three transactions with that operator.
• Established customers may recover fees under similar conditions.
• The victim must contact the operator within 30 days to report the fraud.
• The victim must submit a police or government report to the operator within 60 days.

Registration, bonds and net worth

The Act creates a registration regime administered by IDFPR.

• Registration with the Department is mandatory for kiosk operators, with provisions covering renewal and refusal of registration.
• Location reporting. Operators must report the physical location of every kiosk they run in the state.
• Surety bond requirements apply to registrants.
• Tangible net worth requirements apply to registrants.

The bond and net worth conditions are the parts of the Act that shape the market rather than individual transactions. They raise the cost of operating a small or thinly capitalised network in Illinois, which is a deliberate policy choice — and one that becomes more pointed in light of Bitcoin Depot's Chapter 11 filing in May 2026, which deactivated roughly 9,000 machines nationally with no notice to customers holding balances.

Registration sits alongside the broader Digital Assets and Consumer Protection Act framework, under which digital asset businesses must be licensed by IDFPR by 1 July 2027 with penalties reaching $100,000 per day for unlicensed activity. See our licensing guide.

What the Act means for you, practically

Six things you can actually use.

1. No Illinois kiosk may charge you more than the greater of $5 or 18%. If a screen quotes more, photograph it and report the operator to IDFPR.
2. Your daily limit is $2,500 as a new customer, and handing over more identification does not change that.
3. You are entitled to see the fee and the rate before you confirm. A machine that does not show both is not complying.
4. There is a named person responsible for your complaint. Ask for the consumer protection officer.
5. If you were defrauded as a new customer, you have a statutory refund right on up to three transactions — 30 days to notify, 60 days for a police report.
6. Transfers to flagged wallets should be blocked at the machine. If a transaction is refused for this reason, that is the Act working, not a malfunction.

This page describes a statute and its published requirements. It is not legal advice, and the application of any provision to a particular set of facts is a question for an Illinois attorney.