Legal & Compliance

Are Bitcoin ATMs Legal in Colorado? Regulations Explained

Bitcoin ATMs are fully legal in Colorado. Here is the complete regulatory framework and what it means for operators and host businesses.

Yes, Bitcoin ATMs are legal in Colorado

Bitcoin ATMs operate as licensed money services businesses under both federal and Colorado state law. There is a clear, established regulatory framework governing their operation. As of 2025, there are hundreds of legally operating Bitcoin ATMs across Colorado, with the Denver metro area being the most densely served region in the state.

Federal regulation: FinCEN and the Bank Secrecy Act

At the federal level, Bitcoin ATM operators are regulated by the Financial Crimes Enforcement Network (FinCEN), a bureau of the U.S. Department of the Treasury. FinCEN issued guidance in 2013 and subsequent updates classifying cryptocurrency ATM operators as money transmitters under the Bank Secrecy Act (BSA).

Federal requirements for Bitcoin ATM operators include:

• MSB Registration: Operators must register with FinCEN as money services businesses before operating any machine.
• AML Program: Written Anti-Money Laundering program covering policies, procedures, internal controls, and employee training.
• KYC Procedures: Identity verification at defined transaction thresholds (see our ID requirements guide).
• Currency Transaction Reports (CTRs): Filed with FinCEN for cash transactions of $10,000 or more.
• Suspicious Activity Reports (SARs): Filed for transactions above $2,000 that appear suspicious.
• Record Keeping: Transaction records including name, address, and ID for transactions above $3,000 must be retained for 5 years.
• Independent AML Audit: Annual independent audit of the AML program.
• OFAC Compliance: Screening customers and wallets against the Office of Foreign Assets Control sanctions list.

Colorado state regulation

Colorado regulates money transmitters at the state level through the Colorado Division of Banking (now part of the Colorado Division of Financial Services). Bitcoin ATM operators must obtain a Colorado money transmitter license if they meet the state's definition of money transmission, which most operators do.

Colorado's money transmitter licensing requirements include a net worth requirement, surety bond, background checks for principals, and ongoing annual reporting. The state has generally taken a technology-neutral approach to cryptocurrency regulation, applying existing money transmission laws rather than creating separate cryptocurrency-specific statutes.

What host businesses need to know about compliance liability

Host businesses — the gas stations, convenience stores, and retail locations where machines are placed — are not regulated as money transmitters. The host provides floor space under a commercial agreement. Regulatory responsibility sits entirely with the licensed operator.

A well-drafted host agreement includes a hold-harmless clause that protects the host from liability for transactions processed at the machine. The host is not a party to any cryptocurrency transaction, does not handle any Bitcoin, and does not have access to transaction data beyond their own earnings reports.

Are there any prohibitions on Bitcoin ATMs in Colorado?

There are no Colorado laws or regulations that prohibit Bitcoin ATMs. Some municipalities have general business licensing requirements that apply to any machine-based business service, but there are no Denver or Colorado metro area ordinances specifically restricting Bitcoin ATM placement as of 2025. Operators are responsible for ensuring their placements comply with local zoning and business licensing where applicable.

The regulatory trend

Federal and state regulators have generally moved toward stricter enforcement of existing money transmission laws against Bitcoin ATM operators rather than creating new prohibitions. The primary regulatory concern is AML compliance — specifically preventing the machines from being used for money laundering or sanctions evasion. Operators with robust compliance programs face minimal regulatory risk. Poorly compliant operators have faced FinCEN enforcement actions and state license revocations in other states, which is why compliance infrastructure is a core part of responsible ATM operation.