The Kiosk at the Back of the Shop: Britain's Unregistered Cash-to-Crypto Circuit

On a high street in the Midlands, a machine the size of a vending machine sits beside a fridge of energy drinks. It looks like an ATM, but it does not dispense banknotes. A customer feeds in cash, scans a QR code and watches bitcoin arrive in a wallet. The operator's sign says the service is fast, simple and private. For a compliance officer, the more important word is unregistered.

Crypto ATMs — machines that exchange cash for cryptoassets and, less commonly, the reverse — have been on the FCA's radar for years. The regulator has been clear that operating one without registration is a criminal offence under the Money Laundering Regulations. Yet the machines have not disappeared. They have migrated to convenience stores, barbers, vape shops and back rooms, often run by small companies or sole traders who may not understand that they are running a regulated business. The result is one of the UK's most exposed cash-to-crypto channels: a physical point of conversion where cash leaves the banking system and pseudonymous value takes its place.

A regime designed for exchanges, not kiosks

The UK's AML regime for cryptoasset businesses is a registration regime, not a full authorisation regime. Firms that exchange cryptoassets for money must register with the FCA for money laundering supervision. Registration is not a badge of prudential soundness, and it does not mean the FCA has approved the business model. It means the firm has passed an AML gateway.

The FCA has warned that crypto ATMs require registration and has taken enforcement action with police against unregistered operators. But the register has not shown a significant cohort of ATM operators. The gap between the rule and the high street is the story. A machine can be installed in days. A registration application can take months. Host businesses may receive rent or commission and assume the operator has done the paperwork. In practice, the machine is not the regulated entity; the operator is. If the operator is an offshore company or a newly formed UK limited company with nominee directors, the supervisory trail can end before it begins.

The cash-in, wallet-out data gap

The transaction is simple, and that is the problem. Cash goes in. Crypto goes out to a wallet address. There is no bank account in the customer's name on the crypto leg, and often no meaningful identity check on the cash leg. Operators set their own limits. Some advertise no ID for small amounts; others ask for a phone number and a selfie. The result is a patchwork of controls that depends on the diligence of a business that may have no compliance function.

On-chain analysis can follow the bitcoin, but it cannot automatically identify the person who fed cash into the machine. The Travel Rule, which requires cryptoasset businesses to share originator and beneficiary information on transfers, has improved the data picture between regulated firms. It has not solved the ATM problem, because the customer's wallet is often self-hosted and the machine may not capture the beneficiary's identity. The data gap is the supervision gap.

Red flags that should reach the MLRO

Compliance teams in banks, payment firms and crypto businesses should treat cash-to-crypto kiosks as a higher-risk channel, not a peripheral one. The following patterns warrant escalation:

• Repeated cash deposits just below the operator's ID threshold, or across several machines, consistent with structuring.
• Customers using fresh wallets, multiple wallets or wallets linked to mixers, privacy coins or high-risk exchanges.
• A kiosk hosted inside a cash-intensive business with weak records, or an operator that cannot produce an FCA registration number.
• Transactions that begin with cash and end with a transfer to a sanctioned jurisdiction, a darknet market or a fraud-linked address.
• Reluctance to explain source of funds, or a story that changes between transactions.
• Commission payments from the kiosk operator to the host that are not declared or are paid in cash.

These are not proof of money laundering. They are indicators that require a considered response: enhanced due diligence, transaction monitoring, a SAR to the National Crime Agency where suspicion arises, and, where appropriate, exit. A SAR is not a substitute for risk management, but it is a signal that the firm has seen the risk.

The enforcement question for 2026

The FCA has limited supervisory resources and a large perimeter. Unregistered crypto ATMs are a physical, visible problem, which makes them an attractive enforcement target. But enforcement against individual machines can become a game of whack-a-mole. The more effective response may be to pursue hosts, payment processors and operators who profit from the machines, and to make registration status a condition of hosting. That would shift the incentive from the regulator to the high street.

For now, the loophole is not that crypto ATMs are legal. It is that the registration regime has not matched the reality of the machines. A customer can turn cash into bitcoin in minutes. A supervisor may take months to establish who is responsible. In the gap between those two speeds, dirty money can move.