Most compliance content in this niche is either outdated or written to scare you into buying something. This page is what independent ATM operators in the United States are actually required to deal with in 2026 — with sources.
✓ Last fact-checked: August 2026Let's kill the most persistent myth first: as of 2026, no US state caps the surcharge on a traditional cash-dispensing ATM. Surcharge amounts are set by market competition and your venue agreement, not by state government.
What federal law does require: Regulation E mandates fee disclosure — the ATM must show an on-screen notice of the surcharge before the transaction completes, and the fee must appear on the receipt. Disclose properly and you can price your surcharge to your market.
Generally, no. Under FinCEN guidance (2007, reaffirmed in a 2022 statement), a nonbank ATM owner-operator that provides customers no services other than remote access to their own accounts — i.e., cash dispensing and balance inquiries — is generally not a money transmitter and does not need to register as a Money Services Business.
The moment that changes: if you add services — check cashing, bill payment, money transmission, money orders — MSB registration (FinCEN Form 107) becomes required within 180 days, along with an AML/BSA program. Keep the business pure ATM dispensing and this burden doesn't apply.
Most states exempt pure cash-dispensing ATM operators from money transmitter licensing. Requirements vary state by state, and crypto ATM kiosks are a different, much stricter category — many states have expanded licensing and fee-cap rules specifically for them. If you operate standard ATMs dispensing from cardholders' bank accounts, you are not in that category. The CSBS Money Transmission Modernization Act, adopted by 31+ states, has also streamlined multi-state licensing where it does apply.
The 2010 ADA Standards for Accessible Design apply to ATMs:
Modern retail machines from the major manufacturers ship ADA-compliant; your job is compliant installation — height, clearance, and signage.
This is the part almost every beginner guide misses, and non-compliance is where operators quietly bleed money:
| Requirement | Deadline | Status |
|---|---|---|
| PCI DSS 4.0 full compliance | March 31, 2025 | Mandatory now |
| TR-31 key block encryption | January 1, 2025 | Mandatory now |
| TR-34 key exchange | January 1, 2025 | Mandatory now |
| PCI PTS 5.x+ encrypting PIN pads | Ongoing | Required for new/upgraded ATMs |
| Visa PED sunset (older PCI 4.x devices) | April 30, 2026 | Expired devices must be replaced |
| Windows 11 transition for ATM OS | Late 2026 | Upcoming |
Non-compliance fines run $5,000–$100,000 per month, and the EMV liability shift puts fraud losses on non-compliant operators. When you buy a machine — especially used — verify its PIN pad generation and encryption support before paying. This is a core checklist item in the Blueprint.
Dispensaries are the highest-volume ATM locations in the country (often 1,500+ transactions/month), and placing a traditional cash-dispensing ATM in a licensed dispensary is legal in states with licensed cannabis retail — the ATM dispenses cash from the cardholder's own bank account. What is not safe is the "cashless ATM" workaround that processes card transactions as pseudo-cash deposits: it drew enforcement actions and a nationwide processing disruption in early 2026. Traditional machines are the compliant path; pair them with a smart safe plan for the high-cash environment.
FinCEN MSB-ATM guidance & 2022 statement (fincen.gov) · Regulation E (CFPB) · CU Times on Iowa surcharge ban ruling (2002) · SC State House H.3239 · Louisiana Act 751 coverage (FOX8, AGG) · Access Board ADA Standards · PCI Security Standards Council · ATM Marketplace TR-31/TR-34 coverage · ChooseATM & ATM Trader compliance guides · CannaCPA cashless-ATM compliance playbook (2026).