United States — North Carolina US-NC

Lead Signal

North Carolina has enacted a dedicated licensing regime for virtual currency kiosks, closing a supervisory gap that had left a cash-to-crypto conversion channel outside direct state oversight. Signed into law on 8 July 2026 as the Virtual Currency Kiosk Consumer Protection Act (Session Law 2026-45, House Bill 920), the statute deems any kiosk operator who owns, operates, solicits, markets, advertises, or facilitates virtual currency kiosks in the state to be engaged in money transmission, bringing them within the licensing perimeter of the state Money Transmitters Act (Chapter 53, Article 16B) from 1 January 2027. This is a structural extension of an existing licensing architecture rather than a freestanding crypto statute: the kiosk operator is folded into the same compliance framework that already governs money transmitters generally, which requires licensees to maintain full compliance under the Article.

The legislative move is matched by an enforcement signal of lower evidentiary weight but genuine analytical relevance. A news report citing the state Department of Justice indicates that the Attorney General's office has confirmed it is looking into crypto-ATM kiosk operators, following a reported case involving loss of life savings through an impersonation scam that used a kiosk deposit. No charges, settlement, or formal filing has been identified, and the finding rests on a single secondary report rather than a primary regulatory or prosecutorial document. Taken together, the statutory enactment and the reported inquiry describe a state moving from an unregulated channel toward active supervisory and investigative attention, with the legal instrument preceding the enforcement posture it will eventually support.

Other Developments

An existing licensee signals early alignment. Legal commentary reports that at least one kiosk operator, CoinFlip, already holds a North Carolina money-transmitter license under the general framework and has stated it will adopt the new kiosk-specific requirements when they take effect on 1 January 2027. This suggests a degree of pre-positioning within the regulated population ahead of the compliance deadline, though it describes a single operator's stated intention rather than a sector-wide pattern.

Implementing detail remains outstanding. Whether the state Commissioner of Banks will issue implementing rules or supervisory guidance specific to virtual currency kiosks ahead of the 1 January 2027 effective date has not been established. The statute itself sets the licensing obligation; the operational detail of how it will be supervised in practice is not yet visible in the record.

Cross-Monitor Connections

The kiosk statute sits at the intersection of state-level money-transmission law and the consumer-facing fraud typology that crypto-ATMs have become associated with nationally, where elder-targeted impersonation scams use kiosk deposits as a cash-out mechanism. The reported Department of Justice inquiry, if it develops into a formal action, would be a natural point of connection to any broader federal or multi-state pattern of crypto-ATM fraud enforcement, since the underlying typology (impersonation scams directing victims to kiosks) is not unique to North Carolina. The statute's structure, treating kiosk operation as money transmission by definition, is also a model other states may reference as they consider their own kiosk-specific gaps, though no evidence of such replication has been identified.

Outlook

The period between now and 1 January 2027 is the operative window to watch. Two things could clarify the regime's practical weight before it takes effect: whether the Commissioner of Banks publishes implementing guidance, and whether the reported Department of Justice inquiry produces a formal action. Absent either development, the statute stands as an enacted but not-yet-effective instrument, and the state's posture toward the kiosk channel is best read as tightening in direction even though full supervisory weight has not yet landed.

Lead Signal

North Carolina has moved its virtual-currency kiosk sector from an unregulated gap into a defined licensing perimeter. Session Law 2026-45, the Virtual Currency Kiosk Consumer Protection Act, was signed on 8 July 2026 and deems any operator who owns, operates, solicits, markets, advertises or facilitates a virtual-currency kiosk in the state to be engaged in money transmission. From 1 January 2027, kiosk operators must hold a license under Article 16B of the North Carolina Money Transmitters Act and will sit under the supervision of the Commissioner of Banks, subject to fee caps, transaction limits for new customers, fraud warnings and a 30-day scam-refund window. The architecture is significant on its own terms: it closes a channel that had operated for years outside money-transmission licensing in the state, and it does so through the general money-transmission statute rather than a crypto-specific carve-out, which is itself a structural choice with implications for how the regime will be enforced and interpreted.

The second half of the signal is that enforcement attention has arrived before the licensing regime itself takes effect. A North Carolina Department of Justice spokesperson has confirmed that the Department is looking into crypto kiosk companies following reported elder-targeted scam losses. This is reported through a single news outlet and has not yet been corroborated by a formal Department of Justice filing or press release, so it should be read as probable rather than confirmed. Taken together, the two developments describe a jurisdiction moving from enablement toward enforcement in the same cycle: the legal architecture exists but has not yet commenced, while the conduct the architecture is designed to address is already visible enough to draw investigative interest.

Other Developments

The licensing mechanism itself is comprehensive rather than narrow. Article 26 of Chapter 53, as inserted by the new law, ties kiosk-operator status directly to the existing Money Transmitters Act licensing framework under Article 16B, rather than creating a freestanding kiosk-specific license. Operators already licensed as money transmitters avoid a duplicate licensing track, but they still take on obligations specific to the kiosk context: fee caps, limits on transaction size for customers new to a given kiosk network, mandatory fraud warnings displayed to users, and a 30-day window within which a customer who reports a scam-induced transaction can seek a refund. Each of these elements targets a different point in the typical kiosk-fraud sequence, from the point of transaction through the window in which a victim might realise and report the loss.

The lag between enactment and effect is itself consequential. The Act was signed in July 2026 but does not take effect until 1 January 2027, leaving a window of close to six months during which kiosk operators continue to function without the fee caps, transaction limits or mandatory refund mechanism that will eventually apply to them. Reported industry practice suggests at least one major operator is already moving toward compliance with the fraud-warning and refund elements ahead of the formal commencement date, which, if accurate, would mean voluntary adoption is running ahead of the legal requirement in at least part of the sector. This gap between a signed instrument and its legal effective date is the kind of structural detail that is easy to overlook against the headline of enactment, but it is the period in which the harms the Act was designed to address remain addressable only through existing, more general money-transmission or consumer-protection authority.

Cross-Monitor Connections

The kiosk-licensing architecture and the reported investigative interest in kiosk operators sit squarely in the crypto and digital-asset space, but the underlying typology, instrument-enabled retail fraud, routed through a physical point-of-conversion device, has a natural read-across into payments-infrastructure monitoring, where the same kiosks are assessed from a licensing and market-access perspective rather than a financial-crime one. The elder-targeted scam pattern referenced in the investigative-interest reporting is also the kind of signal that a broader state-capture or consumer-harm tracker would want visibility into, even though North Carolina's instrument here is a conventional consumer-protection and licensing statute rather than anything touching sanctions or conflict finance. No sanctions, beneficial-ownership, enabler-jurisdiction or conflict-finance signal was present in the material reviewed for this jurisdiction, so no connection is drawn to those typologies here.

Outlook

The period between now and 1 January 2027, when the licensing regime takes legal effect, is the window to watch. Three things are worth tracking as scheduled: whether the Commissioner of Banks issues implementing guidance or a license-application process ahead of the effective date; whether the reported Department of Justice inquiry into kiosk operators produces a public filing, settlement or charging decision that would upgrade the current probable-confidence reporting to a confirmed one; and whether other kiosk operators follow the reported pattern of voluntary early adoption of the fraud-warning and refund provisions. Because the investigative interest is currently sourced to a single news report of a spokesperson statement, any firmer public confirmation from the Department of Justice or the Attorney General's office would materially change the confidence picture here.

Lead Signal

North Carolina has enacted a kiosk-specific money-transmission licensing perimeter for virtual-currency conversion points, closing a gap that had left physical crypto kiosks outside dedicated state oversight. The Virtual Currency Kiosk Consumer Protection Act, signed 7 July 2026 and taking effect 1 January 2027, deems any person who owns, operates, solicits, markets, advertises or facilitates a virtual-currency kiosk in the state to be engaged in money transmission, requiring licensure under the states existing Money Transmitters Act framework. The states Office of the Commissioner of Banks opened a public-comment rulemaking on implementing rules on 15 September 2026, running through 15 November 2026, confirming the statute is moving from enactment into active supervisory build-out rather than sitting dormant on the books.

The structural significance here is that the new Article 26 explicitly ties the Commissioners supervisory authority to broader federal obligations, with the statute confirming the Commissioner may request evidence of compliance with the Act or any rule adopted under it, and other applicable law including the Bank Secrecy Act and the United States PATRIOT Act. This is a state-level AML-adjacent variance layered onto, not separate from, the federal Bank Secrecy Act baseline that already governs money-services businesses nationally. North Carolina is using an existing supervisory gateway rather than building a parallel compliance regime, which is architecturally significant for how other states might close the same kiosk-specific gap.

Other Developments

Implementing-rule comment window now active. The Commissioner of Banks opened its public-comment period on 15 September 2026, a concrete step confirming regulatory follow-through on the enacted statute rather than a stalled legislative text awaiting administrative action.

Supervisory authority expressly reaches federal AML obligations. The statutes supervision provision names the Bank Secrecy Act and the USA PATRIOT Act directly, giving the Commissioner an explicit hook to request compliance evidence tied to federal AML/CTF obligations alongside the state licensing requirement, rather than relying solely on federal examiners for that layer of oversight.

Cross-Monitor Connections

This development sits squarely at the intersection of state money-transmission licensing and digital-asset conversion-channel oversight, and the underlying statute and rulemaking record will be of direct interest to readers tracking payment-instrument and digital-money regulatory perimeters, since the same kiosk operators now face both the money-transmission licensing trigger and the sector-specific consumer-facing obligations flowing from the same enacted text. The explicit BSA/PATRIOT Act tie-in also underscores how a conversion channel can be drawn into AML-adjacent supervision through licensing mechanics rather than through a bespoke anti-money-laundering statute.

Outlook

The implementing-rule comment period runs through 15 November 2026, with the underlying licensing obligation itself scheduled to take effect on 1 January 2027. Whether the finalized rules add further supervisory detail beyond the enacted session-law text remains to be seen as the comment period concludes and the Commissioner moves toward finalization ahead of the January 2027 effective date.

Lead Signal

The dominant North Carolina signal this cycle is commercial rather than enforcement-driven: the take-private acquisition of AvidXchange Holdings, Inc. by TPG and Corpay closed, concluding a process that began with the deal announcement on 6 May 2025 and ran through shareholder approval on 16 September 2025 to completion on 15 October 2025. The transaction, disclosed at an enterprise value of approximately 2.2 billion US dollars, sees TPG take the majority position while Corpay holds a 34 percent stake valued at roughly 550 million US dollars. AvidXchange is a regtech-and-accounts-payable automation vendor headquartered in North Carolina, and its shift from a publicly accountable structure to private ownership under a financial sponsor and a payments-sector strategic partner is the kind of structural ownership change that financial integrity monitoring tracks even absent any enforcement predicate, because changed ownership changes who controls the compliance posture of a vendor embedded in client payment workflows.

No sanctions, enforcement or supervisory action attaches to this transaction on the present record. The significance is architectural: a payments-adjacent compliance technology and accounts-payable vendor domiciled in North Carolina has moved from public-market ownership to control by a private equity sponsor and a payments conglomerate, a reconfiguration of accountability lines worth tracking as the new owners integrate the platform.

Other Developments

Deal structure and disclosure. The completed transaction carries disclosed consideration and a clear timeline from announcement to close, consistent with standard take-private mechanics; the company's own closing announcement is the primary record of the event, corroborated by the acquiring parties' investor-facing disclosures.

Sector classification. AvidXchange sits in the regtech-and-AML-adjacent vendor category by virtue of its accounts-payable automation and payment-processing function for commercial clients, which is why a change-of-control event of this kind registers on a financial integrity monitor even though it carries no enforcement or sanctions content of its own.

Cross-Monitor Connections

A payments-technology vendor changing hands into private equity and strategic-payments ownership is the kind of event that World Payments Monitor tracking would also flag from its own angle, concerning consolidation in commercial payment-processing infrastructure; this brief does not extend into that territory and confines itself to the financial-integrity commercial-activity reading of the same underlying event. No conflict-finance, sanctions-evasion or state-capture nexus is indicated by the present record, and none is asserted.

Outlook

As the TPG/Corpay ownership structure beds in following the 15 October 2025 close, the relevant forward question for financial integrity purposes is whether AvidXchange's compliance posture, client-onboarding controls and payment-screening integration change under new ownership; the present record contains no indication either way, and none is asserted here. No further NC-specific commercial-activity development is indicated on the current record.

Lead Signal

The standing AML/CTF architecture governing virtual-currency activity in North Carolina held steady this cycle, but a pending state bill signals the beginning of a possible structural bifurcation. The North Carolina Office of the Commissioner of Banks confirms that any company operating a virtual-currency kiosk in the state must hold a money-transmitter licence, and North Carolina money transmitters, including virtual-currency businesses, are generally expected to register with the Financial Crimes Enforcement Network as a money services business, running a written Bank Secrecy Act program covering currency transaction reports and suspicious activity reports. This is not new this cycle; it is the confirmed baseline against which a proposed instrument, the North Carolina Digital Asset and Stablecoin Act, must now be read.

That proposed Act, recommended by the House Select Committee on Blockchain and Digital Assets and referred to committee on 22 April 2026, would enact a new Article 26 to General Statute Chapter 53, establishing a distinct licensing, subcustody, and recordkeeping framework for digital-asset custody and stablecoin issuance. Among its features is a five-business-day notice requirement to the Commissioner of any federal enforcement action taken against a licensee. The bill has not been enacted, and its status beyond the April committee referral was not established this cycle.

Other Developments

A distinct custody and stablecoin lane, if enacted, would sit alongside rather than replace the general money-transmitter regime. The proposed Article 26 framework is structurally significant less for what it currently changes, which is nothing while it remains unenacted, than for the direction it signals: a jurisdiction that today folds all virtual-currency kiosk and transmission activity into its general money-transmitter licensing statute is considering carving out a purpose-built lane for custody and stablecoin issuance specifically. Whether that lane, if enacted, would exempt compliant licensees from the general money-transmitter licensure requirement, and what AML/CTF obligations would attach to the new licence class specifically, remain open questions this cycle.

Cross-Monitor Connections

This development sits squarely at the intersection of financial-integrity and crypto-monitor interests: the same Article 26 proposal that the crypto monitor's stablecoin_regime module tracks as a licensing-and-issuance question is, from the financial-integrity vantage, an AML/CTF architecture question, specifically whether a new custody/issuance licence class would carry BSA-equivalent obligations distinct from, lighter than, or identical to the general money-transmitter regime's existing FinCEN MSB registration and CTR/SAR program requirements. The world-payments monitor's parallel tracking of the same underlying budget act (SB257) touches an entirely separate product question, sports-wagering and prediction-market taxation, and the two instruments should not be conflated: SB257 is the enacted budget act with the tax provisions, while the Digital Asset and Stablecoin Act is a separate, not-yet-enacted bill addressing custody and stablecoin licensing. No sanctions, beneficial-ownership, enabler-jurisdiction, or compliance-technology signal specific to North Carolina was identified this cycle to connect to the state-capture, conflict-finance, or RegTech-focused monitors.

Outlook

The central open question is whether the Digital Asset and Stablecoin Act advances beyond its 22 April 2026 committee referral, and if so, what AML/CTF obligations attach to the new custody/issuance licence class it would create. Until the bill's legislative trajectory becomes clearer, the standing baseline, general money-transmitter licensure plus FinCEN MSB registration for virtual-currency kiosk operators, remains the operative regime for digital-asset businesses in North Carolina.

Lead Signal

North Carolina has enacted a comprehensive licensure regime for virtual currency kiosks, closing what had been an unregulated cash-conversion vector implicated in elder-fraud typologies. Governor Josh Stein signed House Bill 920 into law on July 8, 2026, creating the Virtual Currency Kiosk Consumer Protection Act as new Article 26 of Chapter 53 of the General Statutes. The Act requires kiosk operators to obtain a license under the state's existing money transmitter law and subjects them to examination, reporting, and ongoing supervision by the Commissioner of Banks, effective January 1, 2027. The legislative driver is explicit and well documented: bill sponsors cited more than 4,300 fraud complaints and $257 million in losses suffered by North Carolina seniors in 2025 to crypto-ATM-facilitated scams. Prior to this Act, kiosk operators already fell within the general definition of money transmission under the state's Money Transmitters Act, but the regime lacked kiosk-specific rules or dedicated supervisory attention, leaving a coverage gap that the new Article 26 closes directly. The Act's supervisory architecture mirrors the state's existing approach to licensed money transmitters generally, extending examination, reporting, and ongoing supervision by the Commissioner of Banks to a category of financial-services provider that had previously operated under only the general money-transmission definition, without kiosk-specific obligations attached to it. This is best read as a structural development rather than an episodic enforcement action: the state has moved in a single legislative cycle from an unregulated enabler channel to comprehensive money-transmitter-based licensure, a shift in architecture rather than a one-off intervention against a bad actor.

Other Developments

FinCEN's BSA/AML modernization rulemaking continues to progress at the federal level: on April 7, 2026, FinCEN issued a notice of proposed rulemaking to modernize Bank Secrecy Act programs and implement outstanding provisions of the AML Act of 2020, superseding the agency's prior 2024 proposed rule. The NPRM proposes to streamline and modernize BSA program requirements for banks and other covered financial institutions, and its supersession of the 2024 proposal signals that the rulemaking track initiated under the AML Act of 2020 remains active. This is a federal, chain-parent-level development that binds North Carolina-chartered institutions as part of the national AML/CTF architecture; no North Carolina-specific variance from the federal baseline was identified this cycle. A national enforcement data point worth carrying as standing AML/CTF context: the OCC entered a consent order against Community Federal Savings Bank, a New York-chartered institution, over BSA/AML compliance program deficiencies. While this action has no North Carolina nexus, it belongs in the same federal enforcement architecture that governs North Carolina-chartered banks and is retained here as context for the compliance environment those institutions operate within.

Cross-Monitor Connections

The kiosk-licensure development sits squarely at the intersection of financial-crime architecture and payments regulation. The same North Carolina statute that closes the AML-relevant enabler gap for crypto kiosks also extends the state's money-transmitter licensing perimeter and imposes new consumer-facing conduct obligations, a dual character that the World Payments Monitor's own coverage of this cycle addresses from the licensing and consumer-protection side. Where this brief treats the Act as a financial-integrity architecture question, closing an enabler channel implicated in elder-fraud typologies, the payments lens treats the identical statute as a licensing and market-access event. Analysts tracking financial-integrity typologies in enabler jurisdictions should note that this closure moves North Carolina from a coverage-gap posture to an explicit BSA-adjacent licensure posture, the same direction of travel that a payments-focused reading would describe as licensing-perimeter tightening. Both readings trace to the same underlying legislative fact and are mutually reinforcing rather than contradictory.

Outlook

The Act's effective date of January 1, 2027 is the operative marker to track: kiosk operators must have licensure, examination readiness, and the statute's consumer-protection features in place by that date. A material gap remains in this cycle's evidentiary base: the full statutory text of SL2026-45 was not independently retrieved and verified against a primary session-law source this cycle, with current confidence resting on law-firm alerts and news coverage rather than the ncleg.gov text itself; closing that gap would strengthen confidence in the exact scope of the licensure and supervision requirements. Because the rate and scope details of the kiosk regime were reported secondhand this cycle, any divergence between the enacted text and the reporting relied upon here should be treated as a priority verification item for the coming cycle. At the federal level, FinCEN's BSA modernization NPRM remains in its comment and rulemaking process; its eventual final form will set the federal baseline against which North Carolina-chartered institutions' BSA programs are measured, and any material divergence at the state level would be a signal to watch for in future cycles.

Lead Signal

This cycle's dominant signal is a dual-track sanctions escalation spanning two distinct geographies: the European Union's 20th sanctions package, adopted April 23, 2026, expanded the Russia shadow-fleet tanker listing to 632 vessels, and the United Kingdom independently boarded the tanker Smyrtos on June 14, 2026, while separately the US Treasury's Office of Foreign Assets Control designated Cambodian casino-network figure Kok An and 29 associated targets for laundering scam-compound proceeds through casinos in Poipet and Sihanoukville. The concurrence of these two sanctions actions — one targeting a state-sponsored evasion architecture, the other targeting a private criminal-enablement network operating with apparent state tolerance — illustrates the breadth of the sanctions tool this cycle. The same window also saw FATF's June 2026 plenary flag abuse of online gaming as an emerging typology for future guidance, alongside its routine grey-list amendments adding Iraq and Bosnia and Herzegovina and removing Algeria and Namibia, underscoring how enforcement-architecture attention continues to broaden even as individual grey-list membership shifts.

Other Developments

A beneficial-ownership-transparency regression in the United States. The Government Accountability Office's May 2026 report confirms that FinCEN's March 2025 interim final rule, which eliminated domestic beneficial-ownership-information reporting, now exempts more than 99 percent of entities that were previously reportable under the Corporate Transparency Act. This is a structural regression in US beneficial-ownership transparency architecture rather than an isolated policy adjustment, and it moves in the opposite direction from the European Union's own beneficial-ownership track, where the AML Regulation, the sixth AML Directive, and the AMLA Regulation continue to advance toward staggered 2026 and 2027 implementation dates.

Cambodia's enforcement-enablement gap persists alongside its own crackdown. Amnesty International's investigation found that more than 70 percent of 86 identified scam compounds were bypassed by Cambodia's publicized crackdown, with state intervention documented at only 24 sites, even as Cambodia's own gaming regulator continues to license casino operators connected to those compounds. Read alongside the OFAC designation of the Kok An network, this pattern is consistent with a state-capture-adjacent enabler dynamic rather than genuine dismantlement of the scam-compound ecosystem.

A standing Mexico-adjacent typology remains active. FinCEN's advisory on Chinese Money Laundering Networks identifies mirror transactions, money mules, and trade-based money laundering as the core mechanisms moving Sinaloa and other cartel proceeds through Chinese underground banking networks, a typology that continues to anchor the enabler-jurisdiction picture for Mexico this cycle even without a fresh 2026-specific enforcement action.

North Carolina closes a payment-channel gap while a supervisory-standard window remains open. North Carolina's HB920, now Session Law 2026-45, creates a new Article 26 supervisory framework for virtual-currency kiosk operators under the Commissioner of Banks, with Bank Secrecy Act and USA PATRIOT Act references, wallet risk-rating, and daily transaction limits of 2,000 and 7,500 dollars, effective January 1, 2027. A companion measure, SB595 (Session Law 2026-31), gives bank tellers authority to refuse suspicious transactions and notify trusted contacts. Both are prospective, with no enforcement track record yet, and the Commissioner's fraud-determination procedure is not due until December 1, 2026, leaving a nine-month window of statutory-but-unenforced coverage.

MiCA's transitional window closes. The European Union's Markets in Crypto-Assets Regulation transitional-authorisation period for crypto-asset service providers expired July 1, 2026; unauthorised CASPs operating past that date now do so illegally, a structural deadline that sits alongside North Carolina's own new kiosk-oversight framework as two independent moves tightening crypto-adjacent payment-channel supervision on different continents in the same window.

Cross-Monitor Connections

The Cambodia enabler pattern documented this cycle connects directly to state-capture themes tracked elsewhere: a gaming regulator continuing to license scam-linked compounds during its own publicized crackdown is the kind of enforcement-versus-enablement divergence that other monitors tracking state-capture dynamics would treat as a primary indicator rather than a secondary one. The Russia shadow-fleet expansion likewise connects to conflict-finance monitoring, since the tanker network's oil-revenue function continues to finance the broader war economy even though no dedicated new conflict-finance-specific finding beyond the shadow-fleet cross-reference was sourced this cycle. The North Carolina crypto-kiosk framework and the MiCA CASP deadline both sit at a boundary relevant to any monitor tracking digital-asset infrastructure risk, since both instruments determine which crypto-facing payment access points operate under a compliance perimeter and which do not.

Outlook

The nine-month gap between HB920's enactment and North Carolina's Commissioner-of-Banks fraud-determination procedure, due December 1, 2026, is the clearest near-term item to track: its content will determine how much of the current statutory-but-unenforced window closes before the Act's obligations become fully operative on January 1, 2027. On the beneficial-ownership track, the scale of the US domestic BOI exemption stands as this cycle's most consequential transparency regression, and its trajectory should be weighed against the European Union's own beneficial-ownership timeline, where 6AMLD transposition and AMLA's RTS/ITS submissions are both due July 10, 2026. Cambodia's enforcement-enablement gap remains a structural watch item rather than a resolved one, given the scale of compounds documented as bypassed by the state's own crackdown, and FATF's flagging of online gaming as an emerging typology bears watching for whether it eventually incorporates casino-laundering patterns of the kind evidenced in Cambodia.