KRS 286.13-095: Prevention of fraud and money laundering -- Use of blockchain

analytics -- Verifying identity of user -- Refunds -- Communications line --

Cooperation with investigations -- Chief compliance officer. (Effective April

30, 2027)

(1) As used in this section:

(a) "Blockchain analytics" means the analysis of data from blockchains or

publicly distributed ledgers, including associated transaction information;

(b) "Blockchain analytics and tracing software" means a software service that

uses blockchain analytics data to provide:

1. Risk-specific information;

2. Tracing of virtual currency wallet addresses; and

3. Other information and services; and

(c) "Virtual currency wallet" and "virtual currency wallet address" have the same

meanings as in KRS 286.13-090.

(2) (a) Each virtual currency kiosk operator shall take reasonable steps to detect and

prevent fraud and money laundering associated with its virtual currency kiosk

business in this state.

(b) The reasonable steps required under paragraph (a) of this subsection shall

include establishing, implementing, maintaining, and enforcing:

1. An anti-fraud and anti-money laundering policy that, at a minimum:

a. Identifies and assesses fraud-related and money laundering-related

risk areas;

b. Establishes procedures and controls to protect against identified

risks;

c. Allocates responsibility for monitoring risks;

d. Establishes procedures for the periodic evaluation and revision of

the policy's procedures, controls, and monitoring mechanisms; and

e. Requires compliance with the federal Bank Secrecy Act, codified

at 31 U.S.C. sec. 5311 et seq.;

2. An enhanced due diligence policy that, at a minimum, establishes

protocols to identify individuals who are at risk of fraud based on age or

mental capacity; and

3. Policies that address:

a. Cybersecurity, the privacy of personal information, and

information security; and

b. Any other subjects required by the commissioner in an

administrative regulation promulgated in accordance with KRS

Chapter 13A.

(c) The policies required under paragraph (b) of this subsection shall:

1. Be in writing;

2. Apply to all employees and agents of the virtual currency kiosk

operator; and

3. Be reviewed and approved by the virtual currency kiosk operator's board

of directors or equivalent governing body.

(3) (a) Each virtual currency kiosk operator and its agents shall use blockchain

analytics and tracing software to:

1. Assist in the prevention of sending virtual currency to a virtual curr ency

wallet known or likely to be affiliated with fraudulent activity at the

time of a virtual currency kiosk transaction; and

2. Detect virtual currency kiosk transaction patterns that are indicative of

fraud or other illicit activities.

(b) A virtual currency kiosk operator and its agents shall block a virtual currency

kiosk transaction to a virtual currency wallet that is associated with overseas

exchanges that are not accessible for virtual currency kiosk users in the United

States.

(c) The department m ay request evidence from any virtual currency kiosk

operator or agent of current use of blockchain analytics.

(4) (a) Prior to accepting payment from any virtual currency kiosk user in this state, a

virtual currency kiosk operator and its agents shall veri fy the identity of the

user.

(b) To comply with paragraph (a) of this subsection, the virtual currency kiosk

operator or agent, or an authorized delegate of the operator or agent, shall:

1. Obtain a copy of a government -issued identification card that iden tifies

the virtual currency kiosk user; and

2. Collect additional information about the virtual currency kiosk user,

including the user's:

a. Name;

b. Date of birth;

c. Telephone number;

d. Physical address; and

e. Email address.

(c) A virtual currency kiosk operator and its agents shall not allow a virtual

currency kiosk user to engage in a virtual currency kiosk transaction under or

using any name, account, or identity that is not the user's own true name,

account, or identity.

(d) A virtual currency kiosk operator and its agents shall be strictly liable for any

violation of this subsection.

(5) (a) Except as provided in paragraph (b) of this subsection, upon request of a

virtual currency kiosk user, a virtual currency kiosk operator and its agents

shall issue a refund of all virtual currency kiosk charges to the user for each

virtual currency kiosk transaction that satisfies all of the following:

1. The user was fraudulently induced to engage in the transaction;

2. The user reported the fraud within ninety (90) days of the transaction to:

a. The operator or agent; and

b. One (1) of the following:

i. The department;

ii. The Attorney General; or

iii. Any relevant state or local law enforcement agency; and

3. The user submitted proof of t he fraud to the operator or agent and the

person referenced in subparagraph 2.b. of this paragraph, which may

include one (1) of the following:

a. A police report; or

b. A sworn statement made to the department, Attorney General,

operator, or agent;

that details the fraudulent nature of the transaction.

(b) 1. In addition to any other remedies and penalties available under this

subtitle or any other statutory or common law, a virtual currency kiosk

operator and its agents shall issue a refund to a virtual c urrency kiosk

user in the full amount of any virtual currency kiosk transaction,

including all virtual currency kiosk charges, if the user submits proof,

which may be in the form of a police report or sworn statement, that the

operator or agent, or an empl oyee or other representative of the operator

or agent, defrauded, deceived, or misled the user in connection with the

transaction.

2. A virtual currency kiosk user shall submit the proof required under this

paragraph in accordance with the requirements of paragraph (a) of this

subsection, except the user shall be required to submit the proof within

any applicable statute of limitations associated with the violation or

offense, which shall not be less than one (1) year after the transaction.

(c) The refund required under paragraph (a) or (b) of this subsection shall be:

1. Paid in the originating currency; and

2. Made to a virtual currency kiosk user by the virtual currency kiosk

operator or agent within seventy -two (72) hours after the requirements

of paragraph (a) or (b) of this subsection, as applicable, are satisfied.

(6) (a) A virtual currency kiosk operator and its agents shall provide a dedicated and

frequently monitored communications line for law enforcement, the

department, and the Attorney General, via a United States telephone number

or email address posted on each virtual currency kiosk in accordance with

KRS 286.13-090, to be used by the agencies to facilitate communications with

the operator or agent in the event of a report from a virtual curren cy kiosk

user of fraud or suspected fraud.

(b) Upon request from law enforcement, the department, or the Attorney General,

a virtual currency kiosk operator and its agents shall:

1. Provide the agency with its trace findings; and

2. Grant the agency assistance with blockchain analytics to assist in any

fraud investigation.

(c) A virtual currency kiosk operator and its agents shall cooperate with law

enforcement, the department, and the Attorney General in the investigation of

fraud and other unlawful activity, which shall include without limitation:

1. Promptly complying with lawful subpoenas, court orders, and other

official requests for records or information relating to virtual currency

kiosk transactions or virtual currency kiosk users;

2. Responding in good faith to lawful requests relating to fraud involving a

virtual currency kiosk; and

3. Designating a point of contact for communication with law enforcement,

the department, and the Attorney General regarding fraud -related

matters.

(7) (a) Each virtual currency kiosk operator shall designate a qual ified natural person

to serve as the operator's chief compliance officer for virtual currency kiosk

business conducted in this state.

(b) The chief compliance officer shall be responsible for coordinating,

monitoring, and ensuring the operator's and its agents' compliance with:

1. This section; and

2. All other applicable state and federal laws, including all administrative

regulations, rules, and orders promulgated or issued thereunder.