United States — Maine US-ME

Maine's crypto-integrity picture this cycle is defined by the interaction of two instruments and one enforcement outcome. The Money Transmission Modernization Act (32 M.R.S. c.79-A), effective August 9, 2024, brought virtual-currency business activity — exchange, custody, and kiosk operation — within the state's money-transmitter licensing perimeter, and it explicitly incorporates the federal Bank Secrecy Act (31 U.S.C. §5311 et seq.) as the compliance baseline for licensees. On top of that general perimeter, the Virtual Currency Kiosk Act (PL 2025, c.285), enacted as an emergency measure effective June 12, 2025, adds kiosk-specific consumer safeguards: caps on daily transmission amounts, caps on fees and exchange rates, and provisions intended to give consumers redress for kiosk-enabled fraud.

That redress mechanism has now been exercised. Bitcoin Depot, a kiosk operator, entered a $1.9 million consent agreement with the Bureau of Consumer Credit Protection over losses inflicted on Maine consumers by third-party scammers operating through its kiosk network, and agreed going forward to operate as a fully compliant licensed money transmitter. This is a state-level crypto-consumer-protection and AML-adjacent tightening addressing a kiosk-enabled fraud typology, and it is analytically distinct from sanctions-evasion or beneficial-ownership typologies that dominate FIM's typical D5 signal elsewhere; the Maine case is domestic consumer-protection enforcement layered on an AML-incorporating licensing statute, not a cross-border illicit-finance case.

The practical significance for the D5 lens is less about Bitcoin Depot specifically and more about what the sequencing demonstrates: a state legislature identified a kiosk-fraud typology, passed an emergency statute addressing it within roughly a year, and its regulator extracted a settlement applying that statute within a further six months. Few state-level crypto frameworks move that quickly from identification to enforcement. Whether Maine's kiosk-consumer-protection template becomes a model other states adopt, or remains a jurisdiction-specific response to a jurisdiction-specific problem, is not yet resolved by the evidence available this cycle — the CSBS state MTMA legislation tracker registers Maine's own enactment but does not yet show comparable kiosk-specific measures replicated elsewhere.

One open question bears directly on the durability of this finding: PL 2025 c.285 required the Superintendent of the Bureau of Consumer Credit Protection to submit a report of findings and recommendations on kiosk-customer fraud protection by February 1, 2026. That report's publication status was not located this cycle. Its contents, when available, would indicate whether the Bitcoin Depot case is illustrative of a broader kiosk-fraud pattern across Maine's licensed kiosk operators or an isolated incident that happened to reach settlement first. Until that report surfaces, the D5 finding here should be read as confirmed with respect to the Bitcoin Depot settlement and the statutory architecture, but uncertain with respect to the scale of the underlying typology across the wider kiosk sector.

A further gap worth flagging for the compliance-technology angle (ordinarily a D6 concern but directly relevant to how D5 risk is actually mitigated in practice): no Maine-specific transaction-monitoring or AI/ML standard applicable to kiosk-category money transmitters was identified this cycle. The kiosk reforms address the fraud typology and provide redress after the fact, but they do not impose a specific ex-ante monitoring-technology standard on kiosk operators, which is a lag relative to FinCEN's model-risk-management expectations for larger regulated institutions. This does not diminish the significance of the enforcement outcome, but it does mean the statutory architecture currently leans on caps and redress rather than on proactive detection.

Outlook

The February 1, 2026 Superintendent report, once its publication status is confirmed, is the single most consequential near-term data point for this domain in Maine: it will either corroborate a systemic kiosk-fraud pattern or confine the Bitcoin Depot case to an isolated finding. Separately, watch whether other small-state money-transmission regimes begin adopting Maine's kiosk-specific consumer-protection template via the CSBS legislative tracker; if adopted more widely, kiosk-consumer-protection statutes of this design could become a recognizable typology-response pattern across US state AML-adjacent regimes rather than a one-state anomaly.