Three layers of regulation, not one
The most common misconception about crypto regulation in Arizona — and it leads people into real trouble — is that there is a single authority to check with. There are at least three, they cover different things, and a business can be perfectly compliant with one while being unlawful under another.
The federal layer governs anti-money-laundering: registration as a money services business with FinCEN, customer identification, record-keeping and suspicious activity reporting under the Bank Secrecy Act. The state layer governs money transmission: licensing through the Arizona Department of Insurance and Financial Institutions, with capital, bonding and reporting requirements. And a product-specific layer now governs crypto kiosks, enforced by the Attorney General.
A fourth appears whenever something is sold as an investment. Then you are in securities territory and the Arizona Corporation Commission's Securities Division has jurisdiction, regardless of whether the thing being sold calls itself a token, a mining contract or a yield programme.
For an ordinary buyer, the practical upshot is simple: a legitimate platform serving you in Arizona should be able to point at a FinCEN registration and a state licence covering Arizona residents. If it cannot, that is not a technicality.
The federal layer: FinCEN and the BSA
FinCEN — the Financial Crimes Enforcement Network, part of the Treasury — treats businesses that exchange or transmit virtual currency as money services businesses. That brings a set of obligations that explains most of the friction you encounter as a customer.
Registration with FinCEN is mandatory and searchable, which is why the registrant list is the first place to check a platform. Beyond registration, a money services business must maintain a written anti-money-laundering programme, identify its customers, keep transaction records, and file currency transaction and suspicious activity reports at defined thresholds.
When a kiosk asks for your phone number and then your ID as amounts climb, or an exchange asks about source of funds on a large deposit, that is this layer at work. It is not the operator being obstructive; it is a federal obligation carrying real penalties for failure. A service advertising that it requires no identification at all is advertising non-compliance.
Where to look
The FinCEN MSB registrant search lets you check a business by name and state, and FinCEN's guidance library publishes the interpretive material that defines how these rules apply to virtual currency.
The state layer: DIFI money transmission
Arizona regulates money transmission through the Department of Insurance and Financial Institutions. Money transmission, in the statutory definition, means selling or issuing payment instruments or stored value to a person located in Arizona, or receiving money for transmission from a person located in Arizona. A business doing any of that needs a DIFI licence, or must operate as the authorised delegate of somebody who holds one.
The bar is substantive rather than nominal. An applicant must be a corporation or LLC in good standing and authorised to do business in Arizona. Tangible net worth must be the greater of $100,000 or a tiered slice of total assets — three percent of the first hundred million, two percent from there to a billion, and half a percent above that. A money transmission surety bond is required at the greater of $25,000 or a hundred percent of average daily money transmission liability, capped at $500,000. And licensees and their authorised delegates must file all reports required under federal currency reporting, recordkeeping and suspicious activity rules.
The important structural point for crypto specifically: Arizona has not created a separate virtual currency licence. It applies the money-transmission framework it already had. That is a deliberate choice and it makes Arizona meaningfully easier to serve than states that built bespoke regimes — but it also means you check a crypto platform's licensing in the same place you would check a remittance company's. Applications and licensee information run through NMLS.
The kiosk layer: HB2387 in detail
This is the most consequential recent development in Arizona crypto law and the one that most directly affects ordinary users.
House Bill 2387 — the Cryptocurrency Kiosk Fraud Prevention law — took effect on September 26, 2025, amending the state's money transmission statutes to add a licensing, disclosure and refund regime specifically for cryptocurrency kiosk operators. Enforcement sits with the Arizona Attorney General. In summary, an operator running a machine in this state must:
- Disclose all relevant terms and conditions clearly, conspicuously and in the customer's chosen language, in type contrasting with its background, and obtain the customer's acceptance before executing a transaction.
- Display on-screen fraud warnings the customer must acknowledge before proceeding.
- Provide a receipt carrying the operator's contact details, the transaction specifics, the exchange rate applied, the refund policy and relevant law-enforcement information.
- Observe daily transaction ceilings of $2,000 for new customers — those who have used the operator for fewer than 10 days — and $10,500 for established customers.
- Employ blockchain analytics software to block transfers to wallet addresses known to be affiliated with fraud, and maintain written anti-fraud policies.
- Comply with federal know-your-customer and anti-money-laundering requirements.
- Make live customer support available continuously, with a toll-free number displayed prominently on the kiosk.
- Refund a defrauded new customer in full, including fees, where the customer notifies both the operator and the Attorney General or another law-enforcement agency within 30 days and provides an official report finding fraudulent inducement.
It is worth noting how the bill changed as it moved: committee amendments raised the established-customer ceiling from $5,000 to $10,500 and extended the new-customer definition from three days to 10 days — strengthening the protective window rather than loosening it.
In the period since it took effect, $171,332 has been returned to 35 Arizonans under the refund provision. We set out exactly how to file on the scams and refunds page, and what it means for machine pricing on the kiosk page. Primary text: the bill and the legislative fact sheet.
ARS 44-7061 — blockchain in Arizona statute
Arizona was early here, and it still matters commercially. Under Arizona Revised Statutes section 44-7061, three things are settled in law.
A signature secured through blockchain technology is an electronic signature. A record or contract secured through blockchain technology is an electronic record. And a contract relating to a transaction may not be denied legal effect, validity or enforceability solely because it contains a smart-contract term. The statute additionally preserves a person's ownership rights in information they secure using blockchain.
The practical effect is that a blockchain-recorded agreement is not a legal curiosity in Arizona — it has the same standing as any other electronic record. That is a meaningful advantage for businesses structuring anything on-chain here, and it is the reason Arizona is frequently cited alongside Wyoming in surveys of state blockchain law.
The digital-asset and blockchain sandbox
Arizona operates a regulatory sandbox under Arizona Revised Statutes sections 41-5601 to 41-5612, administered by the Attorney General's office. It allows a participant limited access to the Arizona market to test an innovative financial product or service without first obtaining the full state licensure that would otherwise be required.
Relevantly for this market, the programme has been retitled as the Financial Technology, Digital Assets and Blockchain Sandbox Program, with the definition of "innovation" modified to include digital assets. That is not a loophole — participation is conditional, supervised and time-limited — but it is a genuine on-ramp for a startup that could not carry full licensing on day one. Details at azag.gov/sandbox.
HB2749 and the state's own crypto holdings
Worth knowing because it gets widely misreported. Arizona did not appropriate taxpayer money to buy Bitcoin.
What happened is that House Bill 2749, signed in May 2025, integrated digital assets into Arizona's unclaimed-property framework. The state may take ownership of abandoned digital assets where the owner fails to respond over the statutory period, custodians may stake those assets or receive airdrops on them, and the proceeds may be deposited into what the state has termed a Bitcoin and Digital Asset Reserve Fund. No taxpayer funds or general-fund dollars are used.
A separate proposal — Senate Bill 1373, which would have established a strategic reserve using legislative appropriations and seized assets — was vetoed, with the governor citing cryptocurrency volatility as a poor fit for general-fund dollars. The distinction between the two bills is the whole story, and it is routinely collapsed in coverage.
How to verify a platform's claims yourself
Ten minutes, four steps, and it is the single most useful thing this page can give you.
- Find the legal entity. Not the brand. It will be in the terms of service or on a legal page. If you cannot find it, stop there.
- Search NMLS Consumer Access. Look the entity up at nmlsconsumeraccess.org and read which licences it holds, in which states, and their status.
- Check the FinCEN registrant list. Confirm the same entity appears as a registered money services business.
- Confirm Arizona is covered. Licensing is state by state, so a licence somewhere else does not cover you. Cross-check with DIFI.
As a worked example of what good disclosure looks like: CEX.IO Corp publishes a US legal page naming the entity, giving NMLS ID 1804170, and listing its state licences individually with licence numbers and issuing agencies — including the caveats where a particular state's licence does not extend to virtual currency. Whether or not you use that platform, that is the standard of transparency worth demanding before you deposit anywhere. Compare against the field on the exchange reviews.
If you're starting a crypto business here
This is not legal advice and you will need an Arizona attorney, but the shape of the problem is worth knowing before you spend money finding it out.
Determine first whether what you are building constitutes money transmission under the Arizona definition. A pure self-custody wallet that never takes possession of customer funds generally does not — you are not transmitting anything, the user is. The moment you hold, exchange or move customer value, you are almost certainly in scope, and that means DIFI licensing plus FinCEN registration plus a real anti-money-laundering programme with a designated compliance officer.
Budget for the capital and bonding requirements described above rather than assuming they can be phased in. If you are running kiosks, layer the entire HB2387 regime on top — including the blockchain analytics obligation and the continuously staffed support line, both of which are operating costs rather than one-off compliance items. And if any part of your model looks like an investment offering, involve securities counsel before you market anything, because the Corporation Commission's Securities Division does not wait to be asked.
The sandbox is genuinely worth investigating for an early-stage product, and it is the piece most founders overlook.
What Arizona has not done
Three omissions matter, and being clear about them is part of being accurate about the rest.
No fee cap on kiosks. HB2387 made pricing visible and did not make it cheaper. There is no statutory ceiling on what an Arizona crypto kiosk may charge, which is why the ten-to-twenty percent range persists and why comparison shopping between machines is worth real money.
No standalone virtual currency licence. This is mostly a feature — less friction, fewer bespoke rules — but it does mean the framework was designed for remittance businesses and gets applied to crypto by analogy. Edge cases genuinely are unclear, and reasonable lawyers disagree.
No state-level protection for platform balances. Nothing in Arizona law makes your crypto safer if a platform fails. Balances are not FDIC-insured and not SIPC-protected anywhere, licensing notwithstanding. That gap is why self-custody remains the answer for long-term holdings, and it is not something any regulator is currently proposing to close.
On the tax side, Arizona's treatment is unusually favourable — a flat 2.5% with a 25% long-term deduction and an airdrop exemption — which we cover on the tax page.