{"data":{"id":"us-ky/krs-286.13-095","jurisdiction":"us-ky","citation":"KRS 286.13-095","heading":"Prevention of fraud and money laundering -- Use of blockchain","body":"analytics -- Verifying identity of user -- Refunds -- Communications line --\nCooperation with investigations -- Chief compliance officer.  (Effective April\n30, 2027)\n(1) As used in this section:\n(a) \"Blockchain analytics\" means the analysis of data from blockchains or\npublicly distributed ledgers, including associated transaction information;\n(b) \"Blockchain analytics and tracing software\" means a software service that\nuses blockchain analytics data to provide:\n1. Risk-specific information;\n2. Tracing of virtual currency wallet addresses; and\n3. Other information and services; and\n(c) \"Virtual currency wallet\" and \"virtual currency wallet address\" have the same\nmeanings as in KRS 286.13-090.\n(2) (a) Each virtual currency kiosk operator shall take reasonable steps to detect and\nprevent fraud and money laundering associated with its virtual currency kiosk\nbusiness in this state.\n(b) The reasonable steps required under paragraph (a) of this subsection shall\ninclude establishing, implementing, maintaining, and enforcing:\n1. An anti-fraud and anti-money laundering policy that, at a minimum:\na. Identifies and assesses fraud-related and money laundering-related\nrisk areas;\nb. Establishes procedures and controls to protect against identified\nrisks;\nc. Allocates responsibility for monitoring risks;\nd. Establishes procedures for the periodic evaluation and revision of\nthe policy's procedures, controls, and monitoring mechanisms; and\ne. Requires compliance with the federal Bank Secrecy Act, codified\nat 31 U.S.C. sec. 5311 et seq.;\n2. An enhanced due diligence policy that, at a minimum, establishes\nprotocols to identify individuals who are at risk of fraud based on age or\nmental capacity; and\n3. Policies that address:\na. Cybersecurity, the privacy of personal information, and\ninformation security; and\nb. Any other subjects required by the commissioner in an\nadministrative regulation promulgated in  accordance with KRS\nChapter 13A.\n(c) The policies required under paragraph (b) of this subsection shall:\n1. Be in writing;\n2. Apply to all employees and agents of the virtual currency kiosk\noperator; and\n3. Be reviewed and approved by the virtual currency kiosk operator's board\nof directors or equivalent governing body.\n(3) (a) Each virtual currency kiosk operator and its agents shall use blockchain\nanalytics and tracing software to:\n1. Assist in the prevention of sending virtual currency to a virtual curr ency\nwallet known or likely to be affiliated with fraudulent activity at the\ntime of a virtual currency kiosk transaction; and\n2. Detect virtual currency kiosk transaction patterns that are indicative of\nfraud or other illicit activities.\n(b) A virtual currency kiosk operator and its agents shall block a virtual currency\nkiosk transaction to a virtual currency wallet that is associated with overseas\nexchanges that are not accessible for virtual currency kiosk users in the United\nStates.\n(c) The department m ay request evidence from any virtual currency kiosk\noperator or agent of current use of blockchain analytics.\n(4) (a) Prior to accepting payment from any virtual currency kiosk user in this state, a\nvirtual currency kiosk operator and its agents shall veri fy the identity of the\nuser.\n(b) To comply with paragraph (a) of this subsection, the virtual currency kiosk\noperator or agent, or an authorized delegate of the operator or agent, shall:\n1. Obtain a copy of a government -issued identification card that iden tifies\nthe virtual currency kiosk user; and\n2. Collect additional information about the virtual currency kiosk user,\nincluding the user's:\na. Name;\nb. Date of birth;\nc. Telephone number;\nd. Physical address; and\ne. Email address.\n(c) A virtual currency kiosk operator and its agents shall not allow a virtual\ncurrency kiosk user to engage in a virtual currency kiosk transaction under or\nusing any name, account, or identity that is not the user's own true name,\naccount, or identity.\n(d) A virtual currency kiosk operator and its agents shall be strictly liable for any\nviolation of this subsection.\n(5) (a) Except as provided in paragraph (b) of this subsection, upon request of a\nvirtual currency kiosk user, a virtual currency kiosk operator and its agents\nshall issue a refund of all virtual currency kiosk charges to the user for each\nvirtual currency kiosk transaction that satisfies all of the following:\n1. The user was fraudulently induced to engage in the transaction;\n2. The user reported the fraud within ninety (90) days of the transaction to:\na. The operator or agent; and\nb. One (1) of the following:\ni. The department;\nii. The Attorney General; or\niii. Any relevant state or local law enforcement agency; and\n3. The user submitted proof of t he fraud to the operator or agent and the\nperson referenced in subparagraph 2.b. of this paragraph, which may\ninclude one (1) of the following:\na. A police report; or\nb. A sworn statement made to the department, Attorney General,\noperator, or agent;\nthat details the fraudulent nature of the transaction.\n(b) 1. In addition to any other remedies and penalties available under this\nsubtitle or any other statutory or common law, a virtual currency kiosk\noperator and its agents shall issue a refund to a virtual c urrency kiosk\nuser in the full amount of any virtual currency kiosk transaction,\nincluding all virtual currency kiosk charges, if the user submits proof,\nwhich may be in the form of a police report or sworn statement, that the\noperator or agent, or an empl oyee or other representative of the operator\nor agent, defrauded, deceived, or misled the user in connection with the\ntransaction.\n2. A virtual currency kiosk user shall submit the proof required under this\nparagraph in accordance with the requirements of paragraph (a) of this\nsubsection, except the user shall be required to submit the proof within\nany applicable statute of limitations associated with the violation or\noffense, which shall not be less than one (1) year after the transaction.\n(c) The refund required under paragraph (a) or (b) of this subsection shall be:\n1. Paid in the originating currency; and\n2. Made to a virtual currency kiosk user by the virtual currency kiosk\noperator or agent within seventy -two (72) hours after the requirements\nof paragraph (a) or (b) of this subsection, as applicable, are satisfied.\n(6) (a) A virtual currency kiosk operator and its agents shall provide a dedicated and\nfrequently monitored communications line for law enforcement, the\ndepartment, and the Attorney General, via a United States telephone number\nor email address posted on each virtual currency kiosk in accordance with\nKRS 286.13-090, to be used by the agencies to facilitate communications with\nthe operator or agent in the event of a report from a virtual curren cy kiosk\nuser of fraud or suspected fraud.\n(b) Upon request from law enforcement, the department, or the Attorney General,\na virtual currency kiosk operator and its agents shall:\n1. Provide the agency with its trace findings; and\n2. Grant the agency assistance with blockchain analytics to assist in any\nfraud investigation.\n(c) A virtual currency kiosk operator and its agents shall cooperate with law\nenforcement, the department, and the Attorney General in the investigation of\nfraud and other unlawful activity, which shall include without limitation:\n1. Promptly complying with lawful subpoenas, court orders, and other\nofficial requests for records or information relating to virtual currency\nkiosk transactions or virtual currency kiosk users;\n2. Responding in good faith to lawful requests relating to fraud  involving a\nvirtual currency kiosk; and\n3. Designating a point of contact for communication with law enforcement,\nthe department, and the Attorney General regarding fraud -related\nmatters.\n(7) (a) Each virtual currency kiosk operator shall designate a qual ified natural person\nto serve as the operator's chief compliance officer for virtual currency kiosk\nbusiness conducted in this state.\n(b) The chief compliance officer shall be responsible for coordinating,\nmonitoring, and ensuring the operator's and its agents' compliance with:\n1. This section; and\n2. All other applicable state and federal laws, including all administrative\nregulations, rules, and orders promulgated or issued thereunder.","path":[],"source_url":"https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=58294","current_through":"Includes enactments through the 2026 Regular Session","vintage":"09/05/2026","retrieved_at":"2026-09-05T20:57:16Z","sha256":"c3e447dc3aa5b9ed5de7658ef00206e1f0886baa442863e7de912cd77da7c057","source_id":"us-ky","stale":false,"prev":"us-ky/krs-286.13-090","next":"us-ky/krs-286.13-100"},"notice":"GroundRules: Original legal text. Not legal advice."}