Prevention of fraud and money laundering -- Use of blockchain analytics -- Verifying identity of user -- Refunds -- Communications line -- Cooperation with investigations -- Chief compliance officer. (Effective April 30, 2027)

analytics -- Verifying identity of user -- Refunds -- Communications line -- Cooperation with investigations -- Chief compliance officer. (Effective April 30, 2027) (1) As used in this section: (a) "Blockchain analytics" means the analysis of data from blockchains or publicly distributed ledgers, including associated transaction information; (b) "Blockchain analytics and tracing software" means a software service that uses blockchain analytics data to provide: 1. Risk-specific information; 2. Tracing of virtual currency wallet addresses; and 3. Other information and services; and (c) "Virtual currency wallet" and "virtual currency wallet address" have the same meanings as in KRS 286.13-090. (2) (a) Each virtual currency kiosk operator shall take reasonable steps to detect and prevent fraud and money laundering associated with its virtual currency kiosk business in this state. (b) The reasonable steps required under paragraph (a) of this subsection shall include establishing, implementing, maintaining, and enforcing: 1. An anti-fraud and anti-money laundering policy that, at a minimum: a. Identifies and assesses fraud-related and money laundering-related risk areas; b. Establishes procedures and controls to protect against identified risks; c. Allocates responsibility for monitoring risks; d. Establishes procedures for the periodic evaluation and revision of the policy's procedures, controls, and monitoring mechanisms; and e. Requires compliance with the federal Bank Secrecy Act, codified at 31 U.S.C. sec. 5311 et seq.; 2. An enhanced due diligence policy that, at a minimum, establishes protocols to identify individuals who are at risk of fraud based on age or mental capacity; and 3. Policies that address: a. Cybersecurity, the privacy of personal information, and information security; and b. Any other subjects required by the commissioner in an administrative regulation promulgated in accordance with KRS Chapter 13A. (c) The policies required under paragraph (b) of this subsection shall: 1. Be in writing; 2. Apply to all employees and agents of the virtual currency kiosk  operator; and 3. Be reviewed and approved by the virtual currency kiosk operator's board of directors or equivalent governing body. (3) (a) Each virtual currency kiosk operator and its agents shall use blockchain analytics and tracing software to: 1. Assist in the prevention of sending virtual currency to a virtual currency wallet known or likely to be affiliated with fraudulent activity at the time of a virtual currency kiosk transaction; and 2. Detect virtual currency kiosk transaction patterns that are indicative of fraud or other illicit activities. (b) A virtual currency kiosk operator and its agents shall block a virtual currency kiosk transaction to a virtual currency wallet that is associated with overseas exchanges that are not accessible for virtual currency kiosk users in the United States. (c) The department may request evidence from any virtual currency kiosk operator or agent of current use of blockchain analytics. (4) (a) Prior to accepting payment from any virtual currency kiosk user in this state, a virtual currency kiosk operator and its agents shall verify the identity of the user. (b) To comply with paragraph (a) of this subsection, the virtual currency kiosk operator or agent, or an authorized delegate of the operator or agent, shall: 1. Obtain a copy of a government-issued identification card that identifies the virtual currency kiosk user; and 2. Collect additional information about the virtual currency kiosk user, including the user's: a. Name; b. Date of birth; c. Telephone number; d. Physical address; and e. Email address. (c) A virtual currency kiosk operator and its agents shall not allow a virtual currency kiosk user to engage in a virtual currency kiosk transaction under or using any name, account, or identity that is not the user's own true name, account, or identity. (d) A virtual currency kiosk operator and its agents shall be strictly liable for any violation of this subsection. (5) (a) Except as provided in paragraph (b) of this subsection, upon request of a virtual currency kiosk user, a virtual currency kiosk operator and its agents shall issue a refund of all virtual currency kiosk charges to the user for each virtual currency kiosk transaction that satisfies all of the following: 1. The user was fraudulently induced to engage in the transaction; 2. The user reported the fraud within ninety (90) days of the transaction to:  a. The operator or agent; and b. One (1) of the following: i. The department; ii. The Attorney General; or iii. Any relevant state or local law enforcement agency; and 3. The user submitted proof of the fraud to the operator or agent and the person referenced in subparagraph 2.b. of this paragraph, which may include one (1) of the following: a. A police report; or b. A sworn statement made to the department, Attorney General, operator, or agent; that details the fraudulent nature of the transaction. (b) 1. In addition to any other remedies and penalties available under this subtitle or any other statutory or common law, a virtual currency kiosk operator and its agents shall issue a refund to a virtual currency kiosk user in the full amount of any virtual currency kiosk transaction, including all virtual currency kiosk charges, if the user submits proof, which may be in the form of a police report or sworn statement, that the operator or agent, or an employee or other representative of the operator or agent, defrauded, deceived, or misled the user in connection with the transaction. 2. A virtual currency kiosk user shall submit the proof required under this paragraph in accordance with the requirements of paragraph (a) of this subsection, except the user shall be required to submit the proof within any applicable statute of limitations associated with the violation or offense, which shall not be less than one (1) year after the transaction. (c) The refund required under paragraph (a) or (b) of this subsection shall be: 1. Paid in the originating currency; and 2. Made to a virtual currency kiosk user by the virtual currency kiosk operator or agent within seventy-two (72) hours after the requirements of paragraph (a) or (b) of this subsection, as applicable, are satisfied. (6) (a) A virtual currency kiosk operator and its agents shall provide a dedicated and frequently monitored communications line for law enforcement, the department, and the Attorney General, via a United States telephone number or email address posted on each virtual currency kiosk in accordance with KRS 286.13-090, to be used by the agencies to facilitate communications with the operator or agent in the event of a report from a virtual currency kiosk user of fraud or suspected fraud. (b) Upon request from law enforcement, the department, or the Attorney General, a virtual currency kiosk operator and its agents shall: 1. Provide the agency with its trace findings; and 2. Grant the agency assistance with blockchain analytics to assist in any fraud investigation.  (c) A virtual currency kiosk operator and its agents shall cooperate with law enforcement, the department, and the Attorney General in the investigation of fraud and other unlawful activity, which shall include without limitation: 1. Promptly complying with lawful subpoenas, court orders, and other official requests for records or information relating to virtual currency kiosk transactions or virtual currency kiosk users; 2. Responding in good faith to lawful requests relating to fraud involving a virtual currency kiosk; and 3. Designating a point of contact for communication with law enforcement, the department, and the Attorney General regarding fraud-related matters. (7) (a) Each virtual currency kiosk operator shall designate a qualified natural person to serve as the operator's chief compliance officer for virtual currency kiosk business conducted in this state. (b) The chief compliance officer shall be responsible for coordinating, monitoring, and ensuring the operator's and its agents' compliance with: 1. This section; and 2. All other applicable state and federal laws, including all administrative regulations, rules, and orders promulgated or issued thereunder.