House committee reviews Senate changes to H137 that add consumer protections for cryptocurrency kiosks

The Vermont House Committee on Commerce and Economic Development on May 6 reviewed amendments the Senate made to H137 that add consumer-protection requirements for virtual currency (cryptocurrency) kiosks and extend the existing moratorium on new kiosks for another year.

Maria Royal, legislative counsel, told the committee the Senate-passed version of H137 keeps many of the disclosure and receipt requirements the committee previously considered and adds or modifies several items, including a broadened definition of “new customer,” expanded refund and reporting timelines, and higher per-day transaction limits. "New customer ... means somebody who has only been transacting for not more than 30 days," Royal said. She summarized that the bill would increase the daily transaction limit to $2,000 for new customers and $5,000 for existing customers, require retainable receipts and photographs taken at the kiosk, and require operators to retain a third party that performs blockchain analytics to assist anti-fraud efforts.

Why it matters: The changes would apply only to operators that existed before the moratorium (Royal said she believed two kiosks currently operate in Vermont) and would set statewide consumer-protection standards covering disclosures, receipts, identification and fraud controls.

Key provisions and discussion

Definitions and disclosures: Royal said the bill retains earlier disclosure rules (pre-transaction disclosures, per-transaction disclosures and post-transaction receipts) and expands the categories of required disclosures for new account holders, such as the operator’s privacy, refund and change-of-policy practices.

Receipts and records: The kiosk receipt must be in a retainable form, Royal said, and transaction value must be expressed in U.S. currency. The bill also requires kiosks to capture a photograph of the customer at the kiosk and retain it in a retainable format; Royal said the bill contains no detailed language about how long the photograph must be held or who may access it.

Refunds and reporting windows: Under the Senate language Royal described, a “new customer” is someone who has been transacting for 30 days or less. The bill gives customers up to 90 days to report suspected fraud to both the kiosk operator and law enforcement; Royal said the 90-day reporting window applies to new and existing customers for purposes of seeking refunds for fraudulently induced transactions.

Transaction limits and fees: Royal said the Senate proposal raises the daily transaction limit to $2,000 for new customers and $5,000 for existing customers. The bill retains a cap on transaction fees; Royal said the previously considered cap remains at 15 percent (or $5, whichever is greater in the draft the committee had reviewed).

Anti-fraud and compliance controls: Royal said the bill requires operators to retain an established third-party provider for blockchain analytics, adopt procedures to detect wallets affiliated with fraud, maintain compliance and due-diligence policies, and staff a compliance officer and a consumer-protection officer as full-time employees. The bill also authorizes the commissioner to adopt rules defining fraudulent or fraudulently induced transactions.

Privacy and record-retention questions: Committee members pressed witnesses on the photograph and identification requirements. Aaron Ference, deputy commissioner for the Department of Financial Regulation (DFR), told the committee DFR privacy regulations apply and that institutions subject to the bill would also qualify for protections under the Gramm-Leach-Bliley Act (GLBA). "The financial privacy component ... is covered by DFR's privacy regulation. I believe they would also qualify under GLBA protections," Ference said.

Larry (identified in transcript only by first name), a kiosk operator representative, told the committee federal rules also drive retention for identification records: "We're required to keep that information for 5 years under federal law because that's part of the KYC know your customer information and anti-money laundering information that we have to keep," he said, referring to recordkeeping under the Bank Secrecy Act.

Data sharing and third parties: Witnesses said operators use blockchain analytics to monitor transactions; Larry said his company uses Elliptic and that analytics can show whether an address is associated with criminal activity even if wallet addresses change. He said kiosk transactions in Vermont so far have been a small fraction of total crypto activity and that kiosks primarily accept cash. "We do do blockchain analytics on every single transaction so that we know that that wallet address is not associated with criminal activity or fraud or money laundering," Larry said.

Unresolved privacy details and next steps: Committee members asked for more detail about photograph retention, notice to customers that photos are taken, and data-sharing specifics; Maria Royal said the draft contains only a general disclosure about data sharing and no specific photo-retention language. The committee did not take a vote; the chair said the committee would return at 1:00 p.m. for a deeper discussion of kiosks and additional testimony from DFR.

Ending

Committee members asked operators for additional transaction data; witnesses said some metrics—such as discrete wallet ownership over time—are not directly observable from public blockchain data and that transaction counts and totals could be supplied after the hearing. The committee paused further action and scheduled a deeper kiosk discussion for the afternoon session.