34 states fined Coinme $2.5M and ordered its crypto kiosks shut over AML failures

On October 7, 2026, a Settlement Agreement and Consent Order coordinated through the Conference of State Bank Supervisors and the Money Transmitter Regulators Association took effect: 34 state regulators — including DC and Puerto Rico — fined the Seattle crypto firm Coinme $2.5 million and ordered its virtual currency kiosks closed in every participating jurisdiction by January 1, 2027.

Examiners covering March 31, 2023 to March 31, 2025 found the company "did not maintain an effective BSA/AML program," with deficiencies in transaction monitoring, KYC, SAR policies, enhanced due diligence and recordkeeping. Those gaps, combined with insufficient responses to earlier examinations, "left it vulnerable to exploitation by criminal actors," the order found.

The money has teeth: $2.2 million of penalty is split among the states by transaction volume, seven investigating states share $300,000 in costs, and if kiosks still operate in any participating state on January 1, 2027, another $4 million falls due at $117,647 per jurisdiction. Coinme must also engage an independent consultant within 60 days, take an assessment report within six months, and complete a corrective action plan within 12 months; it neither admitted nor denied the findings.

The order also cleared the change-of-control notice for Polygon Labs' acquisition of Coinme Holdings — announced in January 2026 at more than $250 million including wallet developer Sequence — so the enforcement landed mid-acquisition. The backdrop regulators pointed to: the FBI logged more than 13,400 complaints and over $388 million in losses involving crypto kiosks in 2025.

$2.5M penalty ($2.2M fine + $300K costs), kiosk operations banned in 34 jurisdictions by Jan 1, 2027, plus $4M more if they continue

The kiosk business ran for years on transaction monitoring, KYC, SAR, EDD and recordkeeping controls that the multistate examination found ineffective.

Deficiencies flagged in earlier examinations drew insufficient responses, so problems compounded instead of being fixed.

Weak controls on machines that convert cash to crypto are exactly what scams and criminal actors exploit, which is what regulators found.

The company kept the kiosk channel as its consumer-facing core even as the program meant to police it failed its own examinations.

Compliance you delegate to nobody is compliance you don't have. In money transmission, an AML program that fails its examination can cost you the whole channel.

Coinme must exit the kiosk business in all 34 participating jurisdictions by January 1, 2027 or owe a further $4 million, and operates under an independent consultant's assessment and a corrective action plan over the following year. The consent order simultaneously cleared the change-of-control notice for Polygon Labs' $250M-plus acquisition to proceed. The order records that Coinme has already made material enhancements to its BSA/AML program, which it neither admitted nor denied needing.