Financial Integrity Monitor

United States — Iowa US-IA

Domains (D1–D6)
1
Sources
8
Role actions
8
Horizon <90d
1
Jurisdiction profile
Largely CompliantTier BRisk: IncreasingMixed

Iowa AML/CTF oversight is federally anchored: money transmitters/MSBs register with FinCEN and license under Iowa Code ch.

More533C via the Iowa Division of Banking; beneficial ownership transparency runs through the federal Corporate Transparency Act (now largely inoperative for domestic entities). Iowa layered a 2025 crypto-ATM consumer-protection statute atop this framework after aggressive Attorney General litigation against kiosk operators.

Key deficiencies
  • No independent Iowa beneficial-ownership registry; state relies entirely on the now-narrowed federal CTA/BOI regime
  • No dedicated state AML examination cadre for MSBs beyond licensing; supervisory depth depends on federal delegation
  • Crypto-ATM transaction caps enacted 2025 have not stopped elder-fraud volumes rising nationally
  • Limited independent Iowa-specific investigative/NGO coverage outside national outlets referencing Iowa AG actions
Recent developments (18m)
  • Iowa Attorney General sued Bitcoin Depot and CoinFlip (Feb. 26, 2025) alleging the majority of Iowa transactions on their kiosks were scam-related
  • Iowa enacted crypto-ATM consumer protection law (transaction/fee caps) effective summer 2025
  • FinCEN issued national CVC Kiosk Notice FIN-2025-NTC1 (Aug. 4, 2025) citing the Iowa enforcement action as a model
  • Federal CTA/BOI interim final rule (March 26, 2025) exempted domestic reporting companies — including Iowa-formed LLCs/corporations — from beneficial ownership reporting
  • Bitcoin Depot, defendant in the Iowa suit, filed for bankruptcy (May 2026) after multi-state regulatory pressure
  • FinCEN proposed sweeping AML/CFT program reform NPRM (April 2026) affecting all federally regulated Iowa financial institutions

United States federal law that applies in United States – Iowa is covered once, on the United States page. This page covers United States – Iowa’s own layer: its own law, regulators and enforcement.

Brief

Lead signal

Lead Signal

Read full brief

Lead Signal

Iowa's digital-financial-asset-kiosk statute, Iowa Code section 533C.1004, remains in force with its wallet-verification and fee-cap provisions active, but the architecture behind how violations are punished is now under legislative reconsideration. A study bill, SSB3086, would strike the statute's bespoke $10,000-per-violation civil penalty and instead treat a violation as an unlawful practice under Iowa's general consumer-fraud statute, section 714.16, exposing violators of an Attorney General-obtained injunction to penalties of up to $100,000. This is a jurisdiction-bound, subnational dispatch: it speaks to Iowa's own kiosk-consumer-protection and money-transmission perimeter, not to any global sanctions or beneficial-ownership development.

Other Developments

Kiosk operators confirmed as money transmitters. Guidance from the Iowa Division of Banking states plainly that virtual-currency kiosk operators are money transmitters under section 533C.301(1) and section 533C.102(19) and (28), absent an enumerated exemption. This closes any ambiguity about whether kiosk operators sit inside Iowa's existing Chapter 533C licensing perimeter, and it does so through the same general money-transmitter regime that governs the state's broader payments sector rather than through a bespoke digital-asset licence.

Standing AML baseline unchanged. Iowa has no dedicated state-level AML or counter-terrorist-financing statute distinct from the federal Bank Secrecy Act and FinCEN framework. AML exposure for money-transmitter licensees, including kiosk operators, runs through the general Chapter 533C regime, administered by the Iowa Division of Banking, which requires licensees to operate a BSA/AML compliance programme. This baseline did not change this cycle and is carried forward as standing context.

Cross-Monitor Connections

The kiosk-statute wallet-verification duty functions as a customer-due-diligence-equivalent control even though it is codified inside a consumer-protection provision rather than an AML statute proper, and the pending SSB3086 enforcement recast is directly relevant to how payments and crypto-monitor colleagues price compliance risk for the same underlying regulated entities. The money-transmitter classification confirmed by the Division of Banking guidance sits at the intersection of payments licensing and digital-asset oversight, meaning any development here has a natural read-across to both the payments monitor's licensing perimeter and the crypto monitor's consumer-protection tracking of the same statute.

Outlook

SSB3086's disposition is the item to watch, with an estimated but highly uncertain 2027 Q1 horizon for any resolution. If enacted, the shift from a fixed civil-penalty schedule to an open-ended injunctive-relief framework under the general consumer-fraud statute would raise the ceiling on enforcement exposure for kiosk-law violations without changing the underlying wallet-verification or fee-cap obligations themselves. Primary bill text for SSB3086 has not yet been independently retrieved, and confirmation of its progress through the Iowa General Assembly remains an open item for the next dispatch.

weekly_brief_draft · JID US-IA
Domain intelligence (D1–D6)

D1 Sanctions

Not covered

Sanctions is not yet covered for this jurisdiction in this report.

D2 Beneficial Ownership

Not covered

Beneficial Ownership is not yet covered for this jurisdiction in this report.

D3 Enabler Jurisdictions

Not covered

Enabler Jurisdictions is not yet covered for this jurisdiction in this report.

D4 Conflict Finance

Not covered

Conflict Finance is not yet covered for this jurisdiction in this report.

D5 Crypto / Digital Assets / Financial Innovation

Crypto / Digital Assets / Financial Innovation

Continue reading

Iowa's digital-financial-asset-kiosk regime centres on Iowa Code section 533C.1004, enforceable since 1 July 2025 and amended by SF 2296 on 6 May 2026. The statute requires kiosk operators to verify that the receiving wallet belongs to the customer for every transaction and caps daily transaction and fee amounts, functioning as a targeted anti-fraud control at the point of a kiosk transaction. Underpinning this is a broader classification question that guidance from the Iowa Division of Banking has now settled: virtual-currency kiosk operators are money transmitters under section 533C.301(1) and section 533C.102(19) and (28), absent an enumerated exemption. That places kiosk operators inside Iowa's general Chapter 533C money-transmission licensing perimeter rather than leaving them in a regulatory grey zone, and it is the clearest statement to date of how the state's existing financial-services licensing architecture extends to digital-asset infrastructure.

The more consequential development for the innovation and enforcement-design angle is a pending study bill, SSB3086, which would restructure how a section 533C.1004 violation is punished. Currently, the statute carries its own bespoke civil penalty of $10,000 per violation. SSB3086 would strike that bespoke schedule and instead fold enforcement into Iowa's general consumer-fraud statute, section 714.16, under which violating an Attorney General-obtained injunction carries penalties of up to $100,000. This is a study bill at the pre-enactment stage, and its primary text has not been independently retrieved this cycle; the description here rests on secondary bill-tracking coverage.

Read architecturally rather than as an isolated incident, this pairing — a settled money-transmitter classification alongside an open question about enforcement design — describes a state regulator and legislature treating digital-asset kiosks as a distinct financial-innovation surface requiring bespoke rules, even while routing licensing itself through the pre-existing general money-transmission framework rather than creating a parallel crypto-specific licence. That is a structurally significant choice: Iowa is not building new licensing infrastructure for digital assets, but it is willing to legislate bespoke substantive protections and, potentially, bespoke enforcement mechanics on top of the general licence.

Outlook

The primary open question is whether SSB3086 advances past the study-bill stage, with an estimated but wide-uncertainty-band horizon of 2027 Q1. Its enactment would not alter the underlying wallet-verification or fee-cap duties, which remain fixed obligations regardless of enforcement mechanics, but it would materially raise the ceiling on penalty exposure for a violation from a fixed $10,000 figure to an injunction-backed framework capable of reaching $100,000. Confirmation of primary bill text and tracking of the bill's progress through the Iowa General Assembly are the two items most likely to resolve this uncertainty in a future cycle.

D6 Compliance Technology & Active Defence

Not covered

Compliance Technology & Active Defence is not yet covered for this jurisdiction in this report.

D7 AML/CTF Regime

Not covered

AML/CTF Regime is not yet covered for this jurisdiction in this report.

D8 Commercial Activity

Not covered

Commercial Activity is not yet covered for this jurisdiction in this report.

Regulatory horizon
Proposed2027-Q1 · ±year

SSB3086 — recast digital-asset kiosk enforcement under general consumer-fraud statute

Enforcement vector for kiosk-law violations would move from a capped civil-penalty schedule to the state's general unfair-practices statute with injunction-backed penalties up to $100,000.
1 dated · 4 pending date · baseline fim-2026-07-05
Role action cards
MLRO

Iowa's kiosk-law enforcement mechanism may shift from a fixed civil penalty to an injunction-backed consumer-fraud framework under pending SSB3086.

For MLRO oversight of any Iowa-licensed money-transmitter operating digital-asset kiosks, the underlying BSA/AML programme obligation under Chapter 533C is unaffected, but the penalty exposure for kiosk-statute violations specifically would change if SSB3086 is enacted, raising the ceiling from $10,000 to a potential $100,000 injunction-violation penalty.

2 evidence refs
Compliance

IDOB guidance confirms virtual-currency kiosk operators are money transmitters under Chapter 533C absent an exemption.

Compliance functions overseeing Iowa-facing kiosk operations should treat the money-transmitter licensing obligation as confirmed and settled, while tracking SSB3086 as a live item that would change the kiosk statute's enforcement mechanics but not its substantive wallet-verification or fee-cap requirements.

2 evidence refs
Legal

SSB3086 would move kiosk-law enforcement from a bespoke civil-penalty schedule into Iowa's general consumer-fraud statute, section 714.16.

Legal counsel advising Iowa-facing digital-asset kiosk operators should note that SSB3086 remains a pre-enactment study bill, and its primary text has not been independently retrieved; the legal exposure change it would introduce, if enacted, is a shift to injunction-backed penalties reaching $100,000 rather than a fixed $10,000 figure.

1 evidence refs
Board

No material change this cycle.

No material change for this persona this cycle

CTO

Wallet-ownership verification remains a live technical control requirement for Iowa digital-asset kiosk infrastructure.

Technical teams supporting kiosk infrastructure touching Iowa customers should note that the wallet-verification duty under the kiosk statute is confirmed and in force; no technical architecture change is required by SSB3086 itself, since that bill addresses enforcement mechanics rather than the underlying technical control.

1 evidence refs
Risk

Iowa's kiosk-statute penalty exposure could rise materially if SSB3086 is enacted.

Risk functions modelling regulatory exposure for Iowa digital-asset kiosk operations should flag SSB3086 as a pending change that would raise the penalty ceiling for statutory violations from a fixed $10,000 figure to an injunction-backed framework reaching $100,000, while the underlying probability of enactment remains uncertain given the bill's pre-enactment stage.

1 evidence refs
Operations

No material change this cycle.

No material change for this persona this cycle

Audit

Iowa money-transmitter licensees remain required to operate a BSA/AML compliance programme under the general Chapter 533C framework.

Internal audit scoping control-testing for Iowa-licensed money transmitters, including digital-asset kiosk operators, should confirm the BSA/AML programme requirement is current and unaffected by SSB3086, which addresses a separate, kiosk-specific consumer-protection enforcement mechanism.

1 evidence refs
Decision lens
MLRO

Iowa's kiosk-law enforcement mechanism may shift from a fixed civil penalty to an injunction-backed consumer-fraud framework under pending SSB3086.

Compliance

IDOB guidance confirms virtual-currency kiosk operators are money transmitters under Chapter 533C absent an exemption.

Legal

SSB3086 would move kiosk-law enforcement from a bespoke civil-penalty schedule into Iowa's general consumer-fraud statute, section 714.16.

Board

No material change this cycle.

CTO

Wallet-ownership verification remains a live technical control requirement for Iowa digital-asset kiosk infrastructure.

Risk

Iowa's kiosk-statute penalty exposure could rise materially if SSB3086 is enacted.

Operations

No material change this cycle.

Audit

Iowa money-transmitter licensees remain required to operate a BSA/AML compliance programme under the general Chapter 533C framework.

Shared evidence: 4 refs
Scenario sketches

AML Package / AMLA supervisory transition — illustrative structural sketch

Illustrative sketch: as the AMLA Regulation (Reg (EU) 2024/1620) moves cross-border obliged entities toward direct or indirect EU-level supervision, alongside the directly-applicable AMLR (Reg 2024/1624) and per-state 6AMLD transposition, the evasion landscape could shift toward jurisdictions and entity types that remain outside AMLA's direct-supervision perimeter, testing the boundary between EU-level and national-level oversight. This is architecture-over-incident framing about a structural transition, not a description of any observed event in Iowa or elsewhere this cycle.

Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact.

Standing trackers (T1–T6)
TrackerStatusNote
T1 · Russian Sanctions-Evasion Architectureno_changeNo US-IA-specific material found this cycle.
T2 · EU AML Package / AMLAno_changeNot applicable at US-IA subnational level.
T3 · FATF Grey Listno_changeNot applicable at US-IA subnational level.
T4 · Beneficial-Ownership Register Statusno_changeUS federal CTA/BO regime governs; no Iowa-specific BO registry change found.
T5 · Crypto & Digital-Asset Integritymaterial_changeIowa's kiosk statute (533C.1004) enforcement mechanism is being amended via SSB3086; wallet-verification duty active since 1 July 2025.
T6 · Sanctions Regime Divergenceno_changeNot applicable at US-IA subnational level.
Registers

Enforcement actions

  • Iowa AG filed suit alleging Bitcoin Depot's kiosks in the state were instruments of massive fraud, with an analysis of Iowa transactions between October 2021 and July 2024 suggesting more than half involved scams, costing Iowans over $20 million. 26 Feb 2025
  • Iowa AG sued CoinFlip alleging roughly 90% of transactions examined on its Iowa ATM network were scam-related and that all of its top 20 Iowa users were scam victims, calling the firm a 'willfully blind participant' in victimizing Iowans. 26 Feb 2025
  • FinCEN issued Notice FIN-2025-NTC1, a national advisory on illicit finance risks at crypto ATMs, explicitly citing the Iowa Attorney General's February 2025 lawsuits as evidence of the scale of kiosk-enabled fraud and setting AML/CFT red-flag expectations for financial institutions. 4 Aug 2025
  • OFAC designated facilitators of DPRK government-orchestrated IT worker fraud schemes that generated nearly $800 million in 2024 for DPRK weapons programs, including 21 cryptocurrency addresses; the scheme systematically targets US businesses nationwide, creating exposure for Iowa-based employers of contracted remote IT labor. 12 Mar 2026

Sanctions changes

  • OFAC designated six individuals and two entities, including Vietnam- and China-based currency converters and a DPRK IT-management company (Amnokgang Technology Development Company), for facilitating DPRK IT-worker fraud schemes funding WMD/ballistic missile programs, with 21 crypto addresses listed. 12 Mar 2026
  • US Treasury delisted the Tornado Cash mixer in March 2025, following a US court ruling that OFAC lacked authority to sanction the immutable smart-contract protocol, reversing the original 2022 designation. 1 Mar 2025
  • OFAC, jointly with FinCEN and in coordination with the UK's FCDO, designated the Prince Group Transnational Criminal Organization and 146 associated targets (including Chen Zhi) for operating massive 'pig butchering' scam and money-laundering operations — the same laundering-network typology into which US crypto-ATM (including Iowa) scam proceeds are shown to flow. 14 Oct 2025

Regulatory horizon (register)

  • Resolution of Iowa AG litigation vs. CoinFlip/Bitcoin Depot
  • FinCEN AML/CFT Program reform NPRM comment deadline
  • Investment Adviser AML Rule new effective date
  • US FATF 8th Enhanced Follow-up Report (BO access gaps)

Active schemes

  • [HIGH] Crypto-ATM elder-fraud cash-to-crypto laundering pipeline
  • [CRITICAL] DPRK IT-worker fraudulent-employment revenue scheme
  • [HIGH] Post-CTA-rollback shell-entity beneficial-ownership opacity
  • Foreign farmland-ownership opacity in Iowa's agricultural sector
Sources
  1. Financial Crimes Enforcement Network (FinCEN)
  2. Office of Foreign Assets Control (OFAC) / State of Iowa
  3. International Consortium of Investigative Journalists (ICIJ)
  4. Financial Action Task Force (FATF)
  5. Financial Crimes Enforcement Network (FinCEN)
  6. Chainalysis
  7. Bloomberg
  8. Bloomberg
Coverage gaps
Iowa has no independent state AML examination cadre for lice…
Iowa has no independent state AML examination cadre for licensed money-services businesses beyond registration/licensing under Iowa Code ch. 533C; supervisory depth for BSA compliance depends on federal delegation (FinCEN/federal banking agencies), leaving state-level supervisory capacity thin relative to the scale of MSB/crypto-ATM activity within the state.
The March 2025 federal CTA/BOI interim final rule exempted a…
The March 2025 federal CTA/BOI interim final rule exempted all US-formed entities, including Iowa LLCs and corporations, from beneficial ownership reporting to FinCEN, restoring a beneficial-ownership opacity gap that Iowa has no independent state-level registry to fill.
Despite Iowa's 2025 crypto-ATM transaction-cap and fee-cap s…
Despite Iowa's 2025 crypto-ATM transaction-cap and fee-cap statute, national FBI IC3 data show crypto-ATM fraud complaints and losses continuing to rise sharply (99% complaint increase in 2024, losses projected to exceed $380 million in 2025), indicating state-level transactional caps alone have not closed the underlying enforcement/detection gap.
Independent Iowa-specific investigative/NGO reporting (OCCRP…
Independent Iowa-specific investigative/NGO reporting (OCCRP, Global Witness, ICIJ standalone Iowa-focused pieces) is sparse; available Iowa-specific findings largely surface as secondary references within national crypto-ATM and CTA coverage rather than dedicated Iowa-focused investigations, and no direct Iowa.gov primary URL for the AG's press release was independently verified in this research pass.

Evidence

Confidence-tiered claims

OCC interpretive letter (Int. No. 1192, May 12 2026) concludes a national trust bank's crypto custody/trade-execution activity is not contingent on Iowa MTL permission; this bears on the AML-relevant question of which entities fall under Iowa's money-transmitter AML/CFT program requirements. SRC-fim-US-IA-001
Confirmed · 1 source