Connecticut Suspends Bitcoin Depot’s License Over Fee Cap Breaches as SEC Notice Flags Control Gaps

Connecticut just forced a hard stop on Bitcoin Depot’s in‑state operations, suspending the company’s money‑transmitter license after finding repeated fee‑cap breaches, incomplete scam refunds, and disclosure failures at its Bitcoin ATMs. The order compels an immediate shutdown and kiosk deactivation, and it seeks restitution, disgorgement, and civil penalties while leaving open a potential revocation or nonrenewal.

Regulators said more than 1,000 transactions exceeded the state’s 15% fee ceiling, extracting roughly $150,000 in excess fees from over 500 customers. They also alleged the company didn’t fully reimburse certain fraud victims and fell short on mandated disclosures and compliance controls. Citing public safety and welfare, the state framed the move as an emergency action.

The pivot point: fee governance is now product Bitcoin Depot’s situation highlights a simple reality for cash-to-crypto kiosks: pricing, disclosures, and refund logic can’t be treated as static policy—they have to be engineered into the stack and monitored like core risk systems. State-by-state fee caps demand a rules engine that is geofenced, version‑controlled, and auditable in real time. Disclosures and scam warnings need to be sequenced in the kiosk flow so consumers actually read and understand them before committing funds. And when scams do occur—because crypto is a non-reversible rail—refund workflows require clear evidence standards and rapid adjudication, or regulators will fill the gap.

This is not just compliance box‑ticking. For a business that historically leaned on high spreads to offset cash logistics, fraud risk, and volatility, fee caps plus mandated refunds compress economics fast. Analysts flagged the same stress. Tiger Research’s Ryan Yoon characterized the action as a structural hit, pointing to pervasive overcharges and gaps in customer identification data—signals that a high‑margin model can falter once every control is tested. Zeus Research’s Dominick John took a more measured stance, framing the episode as fixable operational and reputational setbacks, while noting that state scrutiny on crypto kiosks is here to stay and likely to intensify across operators who lag on compliance.

Financial strain is already visible The timing collides with mixed fundamentals. For 2025, Bitcoin Depot reported revenue of about $615 million, up from roughly $575 million a year earlier. The latest quarter, however, slipped to around $116 million from about $137 million year over year, with a net loss near $25 million. CEO Scott Buchanan attributed the decline primarily to newly enacted state rules that introduced transaction size caps and, to a lesser extent, to tighter compliance measures that dampened near‑term activity—changes he still framed as constructive for the industry’s long‑run credibility.

Public‑market pressure compounds the challenge. Shares traded near $4 on Tuesday and had already been sliding before Connecticut’s order—down roughly 39% over the past month and about 55% year to date, per Google Finance. Separately, in a late SEC notice, the company said it expects to report unremediated “material weaknesses” in internal controls when it files its annual report, while emphasizing the issues did not cause material errors in prior financials and aren’t expected to change the reported numbers.

Where the industry goes from here The message to Bitcoin ATM operators is straightforward: the money‑transmission license is the business. Losing it in any state shuts down that on‑ramp immediately. Survival hinges on turning compliance into a competitive moat—automated fee engines aligned with local statutes, kiosk UX that centers consumer protection, robust KYC/AML and customer‑ID data hygiene, and proactive refund protocols that stand up under audit.

That shift will trim near‑term volume and margin for some, but it can also reset trust in a channel that many consumers view as their most accessible fiat‑to‑crypto gateway. Connecticut’s move signals regulators intend to test not just the letter of fee caps and disclosures, but the rigor of the systems enforcing them. Operators who treat controls as a product feature—not an afterthought—will be the ones still standing when the next review lands.

Bitcoin Depot, founded in 2016 and the first U.S. Bitcoin ATM operator to go public in 2023, did not immediately respond to a request for comment.