United States — Alabama US-AL

Alabama enacted two distinct pieces of crypto-facing legislation in the 2026 session, and both bear directly on financial-integrity exposure even though neither is framed as an AML statute in its own right. HB259, the Financial Innovation and Market Expansion Act, was signed into law on 9 April 2026 and creates the Alabama qualified payment stablecoin issuer license, administered by the Alabama Securities Commission, as the states implementation pathway for the federal GENIUS Act. The substantive requirements are significant from a financial-crime-control perspective: licensed issuers must hold one-to-one reserve backing in high-quality liquid assets, must provide monthly independent CPA attestations verifying that backing, and must comply fully with applicable anti-money laundering, sanctions, and consumer-protection standards. This is a case where a states market-access framework for a financial-innovation product is inseparable from its AML architecture, because the GENIUS Act compliance language is written directly into the licensing statute rather than left to a separate AML title.

The second measure, the Cryptocurrency Kiosk Fraud Prevention Act (HB303), addresses a narrower but well-evidenced typology: fraud conducted through physical cryptocurrency kiosks, the machines that let consumers convert cash into crypto assets, often under pressure from a remote scammer. The Alabama Securities Commission tied this legislation to documented losses exceeding eight hundred thousand dollars in Hoover, Alabama alone, and the law responds with daily transaction limits for first-time kiosk customers, mandatory fraud warnings at the point of transaction, and a sixty-day window in which a defrauded customer can seek a refund. HB303 takes effect on 1 October 2026. Read together with HB259, these two statutes represent a state legislature treating crypto-adjacent financial crime as a live, evidenced risk rather than a hypothetical one, addressing both the institutional-issuer side (stablecoins) and the retail-fraud side (kiosks) of the same broader digital-asset perimeter in a single session.

Both measures sit on top of, rather than replace, Alabamas pre-existing Monetary Transmission Act (Title 8, Chapter 7A), which has defined monetary value to include virtual currency since well before this cycle and already subjects money-transmitter-type crypto activity, including exchange and custody, to state licensing. The financial-integrity reading of this cycle is therefore one of architectural layering: a general AML-adjacent money-transmission perimeter, a new sector-specific stablecoin-issuer compliance track with GENIUS Act obligations built in, and a targeted consumer-fraud control regime for kiosk operators, all operating concurrently and all administered by the same regulator, the Alabama Securities Commission.

Outlook

The most consequential near-term marker is the Alabama Securities Commissions rollout of stablecoin issuer licensing under HB259, expected in Q4 2026 as scheduled, at which point the AML, sanctions, and attestation obligations move from statutory text to an operating supervisory function. Because the regime is newly enacted, there is no multi-cycle track record yet of how rigorously the Commission will test issuer compliance with the sanctions and AML language embedded in the statute. A second, more distant marker is the 2028 prohibition on offering or selling a payment stablecoin not issued through a permitted issuer, which gives the market a multi-year window to seek licensure before non-compliant activity becomes explicitly unlawful; how enforcement posture develops in the intervening period, particularly whether the Commission treats the interim period as permissive or begins signaling toward the 2028 deadline earlier, is a variable worth tracking. In the more immediate term, the 1 October 2026 effective date for the kiosk fraud-prevention measure will be the first practical test of whether Alabamas layered approach - a long-standing money-transmission AML backbone, a new stablecoin-specific compliance track, and now an operational kiosk fraud control regime - functions coherently for a jurisdiction with no independent state sanctions or beneficial-ownership function of its own.