Albuquerque's city council never debated Proof-of-Work energy intensity, block size, or Lightning channel capacity before it voted. It set a 45-day removal clock for every Bitcoin ATM inside city limits, then anchored the entire ordinance to a single number: 90% of transactions at these machines are tied to fraud.
Don't wait for the enabling ordinance text to ask the obvious question. Where does 90% come from? I have spent a career pulling apart claims like this — cross-referencing Rust source against Etherscan logs during the Parity wallet freeze, simulating the TerraUSD liquidity drain in Python three days before the $40 billion unwind. This number fails the first pass of a forensic audit.
A Bitcoin ATM is not a protocol. It is a kiosk. It accepts cash, converts it to BTC or another asset, and prints a receipt. There is no reentrancy bug to exploit, no oracle to manipulate, no sequencer to censor. The only code that matters is the KYC module bolted onto the front end — and if that module is the source of the fraud, then the ban isn't about crypto at all. It is about a compliance layer that never worked.
That distinction is the story. Almost no one is reporting it.
Bitcoin ATMs have quietly become one of the most misunderstood corners of the crypto stack. As of early 2026, the United States hosts the overwhelming majority of the world's roughly 38,000 crypto kiosks. The operators are concentrated: CoinFlip, BitStop, BitAccess, and the fragments of CoinCloud after its 2023 bankruptcy. The hardware is often General Bytes or Lamassu. The software layer is proprietary, closed, and — critically — almost never independently audited.
The economics are simple and brutal. A kiosk buys BTC at spot, sells it to a walk-in customer at a 15 to 25 percent premium, and keeps the spread. At a $6,000 average ticket and, say, eight transactions a day, one machine clears roughly $7,000 to $10,000 in gross margin monthly. Compliance overhead — ID verification, transaction monitoring, SAR filing — eats directly into that margin. The rational operator, under margin pressure, skimps on compliance. That is not a conspiracy theory; it is the standard incentive structure of any low-margin, high-friction terminal business.
On paper, every US crypto kiosk operator is required to register with FinCEN as a Money Services Business. On paper, they must run KYC and AML. In practice, enforcement has been a patchwork stitched together by state regulators, and the patchwork has holes. Many machines verify only a phone number. Some verify nothing at all until the customer crosses a threshold. The 'banking the unbanked' marketing line — first pushed hard around 2019 — was always doing double duty: it described a genuine use case for remittances and cash-based users, and it provided cover for a segment of the customer base that wanted no paper trail.
Then came the clickbait numbers. In 2023, the FTC reported that crypto ATM scam losses had reached roughly $110 million. Reporting through 2024 indicated the figure had grown again. FBI IC3 data pointed at a broader 'pig butchering' ecosystem where victims are walked to a physical kiosk by a scammer on the phone. The kiosk is where the cash dies. That is the real pattern, and it is ugly.
But 'the kiosk is where the fraud completes' is not the same as '90 percent of kiosk transactions are fraud.' Those are different claims. The ordinance collapsed them into one.
Let me be precise about what the 90 percent figure can and cannot mean, because the ordinance's leverage depends entirely on it.
If 90 percent of transaction count at a typical Albuquerque kiosk is fraudulent, then the operator was — at minimum — failing basic transaction monitoring at a catastrophic rate. That scenario implies the compliance layer was either absent or actively defeated. Under FinCEN rules, that is a federal MSB violation, and the correct remedy is a federal enforcement action, not a municipal business ban.
If 90 percent of dollar volume is fraudulent, the situation is even more damning, because it means the operator's revenue model was effectively subsidized by victim cash. The FTC's own scam-loss figures do not support that concentration nationally — $110 million in 2023 losses against a multi-billion-dollar kiosk transaction volume is nowhere near 90 percent. So the 90 percent figure, if it is accurate for Albuquerque, is a local anomaly, not an industry-wide average. The ordinance generalizes from a specific measurement to a blanket ban without disclosing its methodology.
That is the first failure of the reporting. The council cited a number, the local press amplified it, and the number acquired a life of its own. I have seen this pattern before. In April 2021, when the Bored Ape Yacht Club and CryptoPunks metadata hosting started failing, I spent a week auditing IPFS gateways and 15 marketplace data-persistence strategies. The headline number — decentralized storage is fragile — was true. The specific number everyone quoted, a 12 percent failure rate, was true for the subset I measured. Context is not optional. When you strip it, the number becomes a weapon.
The second failure is structural. A Bitcoin ATM sits at the exact seam where the non-crypto world meets the crypto world. Its risk surface is not the blockchain. It is the cash rail, the KYC module, and the human at the machine. The blockchain part is trivially secure. The non-blockchain part is where every single dollar of fraud occurs. Banning the kiosk is not a crypto policy. It is a cash policy in a crypto costume.
And here is where the composability argument gets interesting. The kiosk is the lowest-composability node in the entire stack. You cannot build on it. You cannot fork it. You cannot route around it permissionlessly. It is a centralized chokepoint dressed in crypto branding. This is not a rhetorical flourish — composability isn't a philosophical trap. It is a measurable property. A Uniswap V4 hook, for all its complexity, is composable because any developer can call it. A Bitcoin kiosk is not composable because no developer can touch the firmware, the KYC gate, or the cash logistics. Decentralization theater has a home address, and it is a strip-mall storefront with a General Bytes box bolted to the counter.
This matters because the industry's reflexive defense — crypto is permissionless, you cannot ban it — is exactly wrong here. You can ban a chokepoint. Governments ban chokepoints all the time. What they cannot ban is the underlying primitive. The distinction the Albuquerque ordinance exposes, and that the crypto defense keeps blurring, is the difference between the asset and the rail. BTC survived China's mining ban in 2021 — hash rate dropped roughly 50 percent, then fully recovered within 18 months. BTC will survive Albuquerque's kiosk ban. That is not the question. The question is whether removing one of the few cash-accessible on-ramps accomplishes the stated goal, or just relocates the fraud.
Let me model the relocation, because this is where the ordinance's logic breaks. When a cash-to-crypto terminal disappears, three things happen to the customer base. The legitimate user — the unbanked or underbanked person who genuinely needs a cash rail — either stops using crypto or pays more friction to sign up at a centralized exchange that requires a bank account and a government ID. That user is de-banked from crypto, not protected by the ban. The fraud-adjacent user — the person being coached through a scam — does not stop. They get redirected by the scammer to a peer-to-peer marketplace, a Telegram OTC group, or a gift-card laundering scheme. The US Secret Service has tracked gift-card fraud for years; it is not banned and it does not require a kiosk. The scammer follows the victim, not the machine.
So the net effect of the ban on fraud volume is close to zero, and the net effect on legitimate access is strictly negative.
Now the third layer, which the ordinance avoids entirely: the federal preemption question. Crypto kiosk operators are FinCEN-registered MSBs. Federal registration creates an argument — not a slam dunk, but an argument — that the regulatory field is occupied, and that a municipal ordinance effectively prohibiting the operation of a registered MSB exceeds local authority. I have watched this play out in different forms. When Terra's algorithm started to fail in May 2022, I ran the drain-rate simulation with three developers; the mechanism was deterministic and the timeline was knowable. What was not knowable was how regulators would apportion blame. They eventually favored the highest-level authority they could reach. Crypto law is reaching for the ceiling right now. The Fifth Circuit's 2024 decision in Van Loon v. Treasury — holding that Tornado Cash's immutable smart contracts are not 'property' under IEEPA — signaled that courts will not automatically bless every regulator's preferred theory. Albuquerque just created a fresh test case.
There is also a quieter technical point that the ordinance ignores. Modern kiosk fraud is not a cryptography problem. It is a settlement-layer problem. In most documented pig-butchering flows, the victim's cash is converted at the kiosk into stablecoins — overwhelmingly USDT — and settled across a handful of centralized exchange accounts before it is washed. The kiosk is the entry point, but the money does not stay on Bitcoin rails. It moves through the stablecoin ecosystem, where Tether's reserves have still never received a truly independent audit. If regulators were serious about the fraud described in the Albuquerque council chamber, the enforcement target would not be a hardware terminal. It would be the downstream settlement infrastructure where the dirty USDT actually pools. Ban the kiosk and the USDT keeps flowing.
But here is the contrarian beat that the industry press is missing entirely. If the 90 percent figure is even directionally true, then what the Albuquerque ordinance actually documents is not a fraud problem. It documents a compliance collapse that everyone — the operator, the state regulator, the FinCEN examiner — let happen for years. The 45-day removal order is a confession, not a solution.
And the confession is being misread. The story being told is: crypto is dangerous, so we banned the ATMs. The story that is true is: cash-to-crypto terminals were never properly supervised, so we banned the terminals and called the supervision problem solved.
The correct response — the one nobody is proposing — is not a ban. It is a hardware and software standard. Mandatory ID verification on every transaction above a low threshold. On-chain taint screening before cash-out, using the same chain-analytics tooling that exchanges and custodians already run. Real-time transaction monitoring with mandatory SAR filing and a public compliance scorecard. If that standard is met, the kiosk operates inside the regulated perimeter. If it is not met, the kiosk is illegal by statute, not by post-hoc ordinance. Kill the bad actors, not the rail. That is the difference between a policy and a press release.
The uncomfortable precedent risk here is worth stating plainly. Albuquerque did not need a crypto-specific law to act. It used general municipal authority over public nuisance and consumer protection, cited a fraud statistic, and shut a business model down in 45 days. Any city with a police power and a sympathetic statistic can now do the same to any crypto business — a mining farm, an NFT marketplace kiosk, a custodial wallet service. The 90 percent number is a template. It travels.
Watch three things. First, the operator lawsuit. If one is filed within the 45-day window, it will determine whether a mid-sized American city can unilaterally shut down a federally registered MSB, and the answer will echo across every state regulator in the country. Second, whether New York, Chicago, or San Francisco replicate the Albuquerque model — because if they do, the 90 percent framing travels with them, and no operator's audit will save it. Third, and this is the one that matters, watch whether FinCEN responds with a hard KYC floor for kiosk transactions before more cities act. The federal regulator has the tooling to set that floor today. Whether it has the will is the whole question.
The assumption nobody in this debate wants to test: if the cash-to-crypto on-ramp is structurally fraud-prone because it is a chokepoint, and cash-to-crypto is the rail we built for the unbanked, what does that say about the banking-the-unbanked thesis? You cannot protect a population by deleting its access. You can only protect it by building the access correctly. Albuquerque chose deletion. The next city should choose the standard — or admit it never believed the access narrative in the first place.
