Crypto ATMs: Fraud, Money Laundering & EU MiCAR Risks

In our recent article in the professional journal Compliance, Ethics & Sustainability (“From inadequate oversight to effective regulation?”), we emphasized how the crypto industry is gradually maturing under the influence of European regulation. At the same time, risks related to money laundering, fraud, and sanctions evasion persist.

A concrete example of these risks are crypto ATMs. In the journal, we already highlighted the risk of sanctions evasion via crypto ATMs. To summarize: Poland currently hosts more than 280 machines, many strategically located near the borders with Belarus and Russia. Here, cash can be easily converted into crypto, carried across the border via a mobile wallet or paper voucher, and liquidated elsewhere. This process can occur entirely outside traditional financial channels and sanctions oversight.

In this article, we take a closer look at how these machines operate, the risks they pose, and the role regulation and enforcement play in mitigating abuse.

From Cash to Crypto – Beyond the Banks

Crypto ATMs provide users with a direct and familiar gateway to convert cash into crypto-assets and vice versa, without requiring an account at a (crypto) exchange. The process is straightforward: users select buy or sell, enter an amount, and verify their identity which, depending on the local regulation, is through an ID, phone number, or another simplified form of KYC. The machine then dispenses crypto or cash.

For individuals in regions with limited banking infrastructure or for less digitally skilled users, these terminals may seem like an ideal solution. Yet it is precisely the combination of accessibility and anonymity that makes crypto ATMs attractive for criminal misuse.[1]

A Magnet for Fraud and Money Laundering

Supervisors worldwide are increasingly reporting abuse of crypto ATMs for money laundering and fraud. The classic laundering process (placement, layering, and integration) can easily be executed through ATMs: cash is inserted, split across multiple terminals, converted into crypto, and later exchanged back into cash.[2]

In 2025, the U.S. Financial Crimes Enforcement Network (FinCEN) reported that victims lost over $247 million through crypto ATMs, with a notable concentration among people over 60.[3] Victims are often pressured over the phone by fraudsters impersonating bank employees or government officials, instructing them to deposit large sums via ATMs.

Some machines accept up to €15,000 (or $25,000) per day without strict identity verification.[4] Transaction fees are significantly higher than those of regulated exchanges (>5% vs. <1%). Certain terminals even print paper vouchers functioning as anonymous bearer instruments.

International Regulatory Differences

Regulation of crypto ATMs varies widely across jurisdictions. New Zealand, for example, banned the machines entirely,[5] while Australia applies a risk-based model with transaction limits and stricter KYC.[6] In the United States, warnings are paired with prosecutions of unregistered operators.[7]

Within the EU, greater clarity is provided through the Markets in Crypto-Assets Regulation (MiCAR). Crypto ATMs are classified as “Crypto-Asset Service Providers” (CASPs). They are not prohibited, but operators must meet licensing requirements, comply with KYC/AML obligations, conduct transaction monitoring, and apply risk-based customer due diligence.[8] Despite the expiration of MiCAR’s transitional regime in the Netherlands, we observed that several crypto ATMs remained active beyond the deadline.

Regulation alone is not enough. Effective enforcement is essential—as underlined by recent Dutch case law.[9]

Dutch Case Law: Crypto ATMs as Money-Laundering Vehicles

In a recent ruling, the Arnhem-Leeuwarden Court of Appeal (ECLI:NL:GHARL:2025:237) convicted an operator of crypto ATMs who repeatedly and deliberately violated the Dutch Anti-Money Laundering and Anti-Terrorist Financing Act (Wwft).[10]

Evidence showed that the ATMs were repeatedly used for transactions linked to criminal proceeds, including drug trafficking. Investigations revealed that the operator had deliberately designed the process to minimize traceability: no identity checks were performed for transactions below €10,000, deposits were often spread across multiple ATMs to avoid detection, and even for higher amounts, KYC checks were superficial and the ultimate beneficial owners of wallets were not verified.

The court ruled that this amounted to knowingly facilitating money laundering. The operator was sentenced to multiple years in prison, and the equipment was confiscated. This case demonstrates that Dutch courts treat crypto ATM violations as serious criminal offenses and highlights the critical role of national enforcement alongside EU regulation.

The Athena Bitcoin Inc. Case – A Wake-Up Call

In February 2025, the Attorney General of the District of Columbia filed a lawsuit against Athena Bitcoin Inc., one of the largest U.S. crypto ATM operators. Investigations revealed that during the first five months of operations in Washington D.C., as much as 93% of all transactions were fraudulent, with average losses of $8,000 per transaction and victims having a median age of 71. Victims were pressured to repeatedly send funds to the same, well-known scam wallets.[11]

Athena is accused of deliberately profiting from these practices by charging hidden fees of up to 26%, without clearly disclosing them to customers. The company systematically refused to compensate victims, even when transactions were visibly routed to previously abused wallets. In some cases, Athena demanded liability waivers from victims who attempted to recover part of their losses.

This case illustrates that poorly regulated crypto ATMs not only endanger the integrity of the financial system but also pose a structural threat to financially vulnerable groups, especially the elderly.

From Signal to Structural Action

The introduction of MiCAR provides a necessary framework, but regulation without consistent enforcement remains toothless. Crypto ATMs operate at the intersection of financial inclusion and financial crime. A collective and decisive response is essential. As long as operators profit from opaque fee structures and criminals exploit the gaps, crypto ATMs will remain more of a getaway car for criminals than a bridge for financial inclusion.

What must happen?

Operators must provide full transparency on fees and limits, implement structural transaction monitoring, and actively block suspicious wallets.
Supervisors must move beyond registration requirements and invest in effective monitoring and enforcement.
Financial institutions must stay alert to unusual cash flows that may disappear through crypto ATMs and act on them with a risk-based approach.
Consumers must be better protected through education, warnings, and accessible reporting channels.
CASPs are legally obliged to monitor transactions. Illicit flows—originating from crypto ATMs as well as darknet markets—are often detected through tools such as Cense, Chainalysis, TRM Labs, and Elliptic. CASPs are expected not only to conduct active monitoring but also to report suspicious activity.

Together with our partner Cense, we will soon publish a follow-up article exploring in more depth how blockchain analytics tools can strengthen organizations’ detection and control capabilities.

Conclusion

At Compliance Champs, we follow these developments with a critical lens. We support organizations in aligning their processes and controls with MiCAR, the Wwft, and international standards. Through knowledge sharing, training, and tailored advice, we help professionals identify risks in time, implement mitigating measures, and embed sustainable compliance. Only through joint efforts by operators, supervisors, financial institutions, and technology partners can the balance between innovation and integrity truly be restored.

Do you seek support and assistance in enhancing your Crypto Compliance Framework?

Please reach out to us on: info@compliancechamps.com

Crypto ATMs: A Bridge Between Two Worlds or a Getaway Car for Criminals?

From Cash to Crypto – Beyond the Banks

A Magnet for Fraud and Money Laundering

International Regulatory Differences

Dutch Case Law: Crypto ATMs as Money-Laundering Vehicles

The Athena Bitcoin Inc. Case – A Wake-Up Call

From Signal to Structural Action

What must happen?

Conclusion

Contact details

COOLS Urban Office Lofts

Over Compliance Champs

Services