United States – Arizona

Licensing, Authorisation & Market Access

Arizona's money-transmission licensing framework was fundamentally rebuilt by SB 1580, which repealed the state's prior money-transmitter statute and replaced it wholesale with the CSBS Model Money Transmission Modernization Act, effective August 28, 2022. The Act aligned Arizona's licensing, net-worth, surety-bond, and reporting standards with the multistate NMLS framework used across a growing number of US states, and it governs any business, including crypto exchange and custody operations, that engages in money transmission within the state. There is no separate licence category for crypto or digital-asset businesses in Arizona; they are licensed and supervised as money transmitters under this general regime.

A structural feature of SB 1580 relevant to market access is Section 4's grant of authority to the Director of the Department of Insurance and Financial Institutions to participate in multistate supervisory processes for licensees operating in Arizona and other states. This supports NMLS-based multistate supervision, meaning a licensee already approved in aligned states faces a materially smoother path to Arizona licensure than under the prior, state-siloed statute. This is the durable structural backbone of the state's licensing regime and the framework against which any subsequent product-specific overlay is layered.

The most recent such overlay is the Cryptocurrency Kiosk License Fraud Prevention Law (HB 2387), effective September 26, 2025, which amended the money-transmission statutes specifically for crypto-ATM operators. HB 2387 does not create a new licence category; rather, it adds disclosure, transaction-limit, and refund obligations onto existing money-transmitter licensure for any operator running kiosk-based crypto services. This distinction matters for market access: a prospective kiosk operator's path into Arizona runs through the general SB 1580 money-transmitter licensing process, with HB 2387's additional conduct obligations attaching once licensed, rather than through any separate crypto-specific authorisation track.

Outlook

Whether the Department of Insurance and Financial Institutions opens rulemaking under SB 1580's periodic-review provisions remains an open question for the next cycle; no source located this cycle confirms activity on that front. Absent such rulemaking, the licensing baseline established in 2022 and the 2025 kiosk overlay together represent the complete and stable statutory architecture governing market access for both traditional and crypto-adjacent money-transmission businesses in Arizona.

Licensing, Authorisation & Market Access

Arizona's current money-transmission licensing framework rests on Senate Bill 1580, which repealed the state's prior money transmitter statute and adopted the CSBS Model Money Transmission Modernization Act, effective August 28, 2022. The most notable substantive change effected by this adoption was the elimination of Arizona's unique requirement to collect transaction identification for transfers of $1,000 or more, a state-specific compliance burden that had distinguished Arizona from the multistate norm. The Arizona Department of Insurance and Financial Institutions, DIFI, retains licensing authority under the modernized statute, and licensees may operate through authorized delegates pursuant to Arizona Revised Statutes Sections 6-1201 and 6-1202, a structure that accommodates the common non-bank payment-institution model of using third-party agents for cash-in/cash-out and distribution functions.

The practical significance of the CSBS Model Act adoption for a non-bank payment institution or e-money institution evaluating Arizona market entry is that the state's licensing regime is now materially aligned with the multistate norm coordinated through the Nationwide Multistate Licensing System, reducing the state-specific compliance divergence that previously existed. This is a bank-versus-non-bank-relevant distinction: the modernization primarily affects non-bank money transmitters and payment institutions operating under DIFI licensure, since bank-chartered entities engaging in payments activity in Arizona operate under a separate prudential framework outside DIFI's money-transmitter licensing regime. For a non-bank PI or EMI, DIFI licensure with authorized-delegate flexibility remains the operative market-access pathway, and the 2022 modernization continues to define the terms of that pathway as the current framework in force.

Outlook

No indication has surfaced this cycle of further amendment to Arizona's money-transmission statute or to DIFI's licensing authority. The CSBS Model Act framework, now in its fourth year of operation, should be read as the stable baseline for any new non-bank PI or EMI entrant assessing Arizona market access, with NMLS-coordinated multistate licensing continuing to be the practical mechanism through which such entrants engage DIFI.

Licensing, Authorisation & Market Access

Arizona's money-transmission licensing perimeter, administered by the Department of Insurance and Financial Institutions under A.R.S. §§6-1201/6-1202 pursuant to the CSBS Model Act as adopted via SB1580, requires a money transmitter license or authorized-delegate status for money transmission generally. This baseline is unchanged and stable this cycle. What has changed, effective January 1, 2026, is the extension of licensing coverage to cryptocurrency kiosk operators specifically, who must now obtain a license under Arizona's money-transmission statute as amended by HB2387. This is a nonbank payment-institution licensing development: kiosk operators are treated as payment-service-provider entities within DIFI's existing nonbank supervisory framework rather than as bank-chartered entities or a wholly separate crypto-licensing category. The practical effect is that crypto kiosks, previously operating in Arizona without a bespoke licensing requirement, are now brought inside the same authorized-delegate and licensure logic that governs other nonbank money-transmission businesses in the state, with crypto-specific consumer-protection obligations layered on top. No changes to the general A.R.S. §§6-1201/6-1202 money-transmitter licensing baseline, or to the authorized-delegate framework applicable to non-crypto nonbank payment-service providers, were identified this cycle; the development is confined to the crypto-kiosk category specifically.

Outlook

Watch for DIFI enforcement or examination activity specifically targeting unlicensed kiosk operation now that the license requirement has been in force for several months, which would test whether the expanded perimeter is being actively supervised rather than merely codified.

Licensing, Authorisation & Market Access

Arizona regulates payment-instrument sale and issuance, money transmission, payment-instrument exchange, and bill-payment receipt as licensed activity under Arizona Revised Statutes Title 6, Chapter 12, with the Department of Insurance and Financial Institutions as the issuing and supervisory authority. A money transmitter license, or authorized-delegate status under an existing licensee, is required to conduct these activities, and this licensing perimeter applies to nonbank money-transmission activity in the state. The framework was substantially modernized by Senate Bill 1580 of the 55th Arizona Legislature, which repealed and replaced the prior money-transmission chapter and adopted the Conference of State Bank Supervisors' Model Money Transmission Modernization Act. That adoption positions DIFI to participate in multistate supervisory processes through the Nationwide Multistate Licensing System, and DIFI has publicly stated the modernization is intended to protect the public from financial crime while standardizing licensing requirements across participating states.

Virtual-currency exchangers and administrators are not addressed by an Arizona-specific carve-out statute; instead, they are treated under the same general money-transmitter licensing regime applied to conventional nonbank payment activity, a characterization distinct from states such as New York that have enacted dedicated virtual-currency licensing categories. This characterization currently rests on secondary legal commentary rather than a directly retrieved primary Arizona statute.

Outlook

Arizona's money-transmission licensing baseline is administratively stable following the SB1580 modernization, and no further legislative change to the licensing statute itself was identified this cycle. The open question for market-access planning is whether virtual-currency businesses will continue to be licensed solely under the general money-transmitter regime or whether Arizona will move toward a dedicated crypto licensing category, a question that intersects with the pending federal GENIUS Act stablecoin-oversight determination.

Consumer Protection & APP Fraud

Arizona strengthened a consumer-protection safeguard against fraud in money transmission this cycle. SB1034 requires that consumer fraud warnings be communicated to the consumer by the money transmitter before money is transmitted, rather than leaving the timing of that warning unspecified. The practical effect is to ensure the consumer receives fraud-risk information at the point where it can still influence their decision to proceed with the transfer, rather than only after funds have already left their control. This sits squarely in the authorised-push-payment-fraud-adjacent space that this module tracks: a warning delivered before transmission is a meaningfully different consumer-protection mechanism from one delivered concurrently with or after the transaction, since it preserves the consumer's opportunity to reconsider or verify the transaction's legitimacy before loss occurs.

Alongside the timing change, SB1034 removes a prior font-size requirement for the fraud-warning notice. Read together, the amendment substitutes a substantive protection (timing that preserves consumer decision-making opportunity) for a purely formal one (minimum print size), which on its face represents a shift toward protection that is more likely to be functionally effective for consumers, though no data on real-world fraud-prevention outcomes from this specific change has been identified this cycle.

This obligation attaches to the full population of DIFI-licensed money transmitters in Arizona, which includes crypto exchange and custody businesses operating under the state's general-purpose money-transmission licence, meaning the consumer-protection benefit extends to fraud scenarios involving crypto-asset transfers processed through licensed transmitters, not solely traditional fiat remittance.

Outlook

Watch for whether DIFI publishes consumer-facing guidance or a model fraud-warning notice reflecting the new pre-transaction timing requirement, and whether any consumer complaint or enforcement data emerges in subsequent cycles indicating whether the timing change measurably affects fraud-loss outcomes for Arizona money-transmission customers.

Consumer Protection & APP Fraud

Arizona's Cryptocurrency Kiosk License Fraud Prevention Law (HB 2387) has now produced a concrete, measured consumer-redress outcome in its first year of operation. Attorney General Kris Mayes announced that thirty-five full refunds totaling $171,332, an average of roughly $4,895 per victim, had been recovered for crypto-ATM fraud victims as of August 12, 2026. This is the first tallied result of the law's refund mechanism, and it demonstrates that the statute is functioning operationally rather than remaining a purely aspirational consumer protection.

The eligibility mechanics underpinning that outcome are specific and now tested in practice: a victim must report the fraud to both the kiosk operator and a law-enforcement authority within thirty days of the incident to qualify for a refund. The law defines a "new customer", the class of victim eligible for refund under the primary mechanism, as someone who has used a given kiosk operator for fewer than ten days. This structural design targets the refund mechanism specifically at first-encounter fraud, the pattern most associated with scam-induced kiosk deposits, rather than establishing a general open-ended refund right for all kiosk users regardless of tenure.

Enforcement of the statute sits with the Attorney General, who may pursue violations of HB 2387 as unfair-or-deceptive acts under the Arizona Consumer Fraud Act. This gives the disclosure, transaction-cap, and refund obligations a civil-enforcement backbone independent of the money-transmitter licensing regime under which kiosk operators are otherwise supervised, meaning a kiosk operator faces exposure under consumer-fraud law in addition to any licensing-based supervisory action for the same underlying conduct.

Outlook

The operative question for the next cycle is whether refund volume continues to grow beyond the thirty-five victims recovered so far, which would further establish the mechanism as a durable and scalable consumer-protection control rather than a first-year clearing of an initial complaint backlog. The demonstrated functioning of the refund and enforcement mechanism in practice is a meaningful data point for any assessment of APP-fraud exposure specific to the crypto-kiosk channel in this jurisdiction.

Consumer Protection & APP Fraud

HB2387's consumer-protection provisions for Arizona cryptocurrency kiosk operators, in force since September 26, 2025, impose concrete and specific obligations distinct from general money-transmission conduct rules. Daily transaction limits are set at $2,000 for new customers and $10,500 for existing customers, a tiered structure recognizing that new customers carry materially higher fraud risk than established ones. Kiosks must display mandatory on-screen fraud warnings and obtain customer acknowledgment before a transaction can complete, a point-of-transaction friction mechanism designed to interrupt scam-driven kiosk deposits before funds are irrecoverably transferred. Operators must also issue full refunds, including fees, to new customers who report fraud to law enforcement or the Arizona Attorney General and to the operator itself within 30 days of the transaction.

The Arizona Attorney General enforces violations of these provisions as unfair or deceptive acts under the state's Consumer Fraud Act, giving the regime a concrete enforcement backstop. The scale of harm cited in support of these measures, an estimated $177 million lost to cryptocurrency scams in Arizona in the prior year across roughly 600 statewide kiosks, indicates this is a response to a measured and significant consumer-harm pattern rather than a precautionary regulatory intervention. This is a full, in-force consumer-protection regime specific to the kiosk channel, distinct from and more prescriptive than general money-transmission consumer-conduct expectations.

Outlook

Watch for the first Attorney General enforcement actions under the Consumer Fraud Act specifically targeting kiosk operators found in violation of the transaction limits, warning, or refund-mandate provisions, and for whether updated loss-estimate data shows a measurable reduction in kiosk-related fraud losses relative to the $177 million prior-year baseline.