Running independent ATMs in the United States means meeting compliance requirements from several federal regimes at once: fee disclosure under Regulation E, ADA accessibility design rules, Bank Secrecy Act obligations that flow through your sponsor bank, PCI DSS security standards enforced by the card networks, IRS reporting on your surcharge income, and any licensing your state adds on top. Miss any one of them and you can face statutory damages, civil penalties, criminal exposure, or loss of your processing relationship.
Fee Disclosure Under Regulation E
The Electronic Fund Transfer Act and Regulation E control how you communicate surcharges. Under 12 CFR 1005.16, if you charge a surcharge you must give the consumer notice of the fee on the screen or on paper before they are committed to the transaction.1Consumer Financial Protection Bureau. 12 CFR Part 1005 – Electronic Fund Transfer (Regulation E) – Section 1005.16 You must also post a notice in a prominent and conspicuous location on or at the machine stating that a fee will or may be imposed.2eCFR. 12 CFR Part 205 – Electronic Fund Transfers (Regulation E) The regulation does not set exact font sizes or dimensions for the physical notice; it must simply be prominent enough that a reasonable consumer would see it before starting a transaction.
Skip either step and the exposure is real. Under the EFTA’s civil liability provision, a consumer can recover statutory damages of $100 to $1,000 per individual violation plus attorney’s fees, and in a class action courts can award up to the lesser of $500,000 or one percent of the defendant’s net worth.3Office of the Law Revision Counsel. 15 USC 1693m – Civil Liability
Receipts
Every withdrawal or transfer must generate a receipt at the time the transaction is initiated. Under 15 U.S.C. § 1693d and 12 CFR 1005.9, the receipt must show the amount of the transfer (with any transaction fee broken out separately), the date, the type of transfer, an account identifier that can be truncated to four digits, and the terminal’s location or identification number. Transfers of $15 or less are exempt.4eCFR. 12 CFR 1005.9 – Receipts at Electronic Terminals
ADA Accessibility Standards
The 2010 ADA Standards for Accessible Design set physical and functional requirements you have to build into every machine. Civil penalties have been inflation-adjusted to $118,225 for a first violation and $236,451 for a subsequent one.5eCFR. 28 CFR Part 85 – Civil Monetary Penalties Inflation Adjustment
Placement and Reach
Each ATM needs a clear floor space of at least 30 inches by 48 inches for wheelchair approach. All operable parts, including the card reader, keypad, and receipt slot, must sit within an unobstructed reach range of 15 to 48 inches above the floor.6U.S. Access Board. Chapter 3 – Operable Parts If an obstruction forces the user to reach over an object deeper than 20 inches, the maximum height drops to 44 inches. Building inspectors and ADA testers check these dimensions routinely.
Speech and Input
Every ATM must be speech-enabled so visually impaired users can complete transactions independently. Under ADA Standards Section 707, all operating instructions, transaction prompts, user input verification, and error messages must be available as audible output, delivered through a mechanism such as a standard headphone jack or a built-in telephone handset.7U.S. Access Board. Chapter 7 – Communication Elements and Features – Section 707 Users must be able to repeat or interrupt audio prompts and control the volume.
Input controls have their own rules. At least one tactilely discernible control must exist for each function so a blind user can identify keys by touch. Numeric keys must follow the standard 12-key telephone layout, and the number five key must be tactilely distinct from the keys around it. The standards also require the same degree of privacy of input and output available to all individuals, which in practice means blanking the visual display during voice-guided sessions so bystanders cannot read the screen while a visually impaired user enters sensitive information.
Bank Secrecy Act Exposure
The Bank Secrecy Act at 31 U.S.C. § 5311 sets the framework for detecting money laundering through financial systems.8Office of the Law Revision Counsel. 31 USC 5311 – Declaration of Purpose A common misconception is that every independent ATM operator has to build a full anti-money laundering program. FinCEN concluded in 2007 that a nonbank ATM owner or operator is generally not a Money Services Business, provided the machine offers nothing more than balance inquiries and cash withdrawals from the customer’s own bank account. The ATM simply gives customers electronic access to their own funds, so the operator is neither a money transmitter nor a currency dealer under FinCEN’s definitions.9Financial Crimes Enforcement Network. Application of the Definition of Money Services Business to Certain Owner-Operators of Automated Teller Machines
That exemption disappears the moment a machine offers additional services. A kiosk that lets users pay bills, transfer funds to third parties, or buy cryptocurrency may qualify as a money transmitter and trigger full BSA registration and compliance obligations.10FFIEC BSA/AML InfoBase. Independent Automated Teller Machine Owners or Operators Treat this as a hard line before expanding a machine’s capabilities.
What the Sponsor Bank Will Ask
Your sponsor bank has its own BSA duties on the account behind the ATM business. Under Section 326 of the USA PATRIOT Act, it must verify the identity of the person or entity operating the machines and check government watchlists. Expect the bank to collect your Social Security number or EIN, review your background, and monitor account activity for red flags.
FinCEN has said the source of cash used to load the machine is a relevant risk factor, though the Customer Due Diligence Rule does not specifically require banks to collect this information. Operators who fund replenishment by withdrawing cash from their own account at the sponsor bank present a lower risk profile, because the bank can verify the source. Operators using cash from outside sources, such as proceeds from an unrelated retail business or funds from accounts at other banks, may face more scrutiny.11Financial Crimes Enforcement Network. Statement on Bank Secrecy Act Due Diligence for Independent ATM Owners or Operators
Criminal Penalties When BSA Applies
Where BSA obligations do attach, whether directly to a deployer running expanded-service machines or to a sponsoring bank, willful violations carry serious penalties. A basic willful violation carries fines up to $250,000 and up to five years in prison. If the violation is part of a pattern of illegal activity involving more than $100,000 in a 12-month period, the maximum rises to $500,000 and ten years.12Office of the Law Revision Counsel. 31 USC 5322 – Criminal Penalties Courts can also order forfeiture of profits gained through the violation.
PCI DSS and Card Network Rules
Payment card networks require compliance with PCI DSS, the Payment Card Industry Data Security Standard, which governs how cardholder data is handled, stored, and transmitted. PCI DSS is an industry standard rather than a federal statute, but compliance is enforced contractually through your sponsor bank and processor. Falling out of compliance can bring fines from the card networks, loss of processing privileges, and liability for the fraud losses that follow.
Hardware
Every ATM’s encrypting PIN pad must carry a valid PCI PTS approval, meaning it meets current standards for tamper resistance and cryptographic key management. Machines should also include anti-skimming mechanisms that detect or prevent the attachment of devices designed to steal card data. Where a machine lacks built-in anti-skimming technology, the deployer must inspect the card reader periodically for foreign devices.13PCI Security Standards Council. PCI ATM Security Guidelines Information Supplement Privacy shields around the keypad are also recommended.
Software
Harden the operating system to the manufacturer’s guidelines: disable unused applications, lock down USB and disc drive access, and restrict administrative privileges. Encrypt transaction data over communication links. Internal memory buffers holding card data should clear automatically when a transaction completes or the machine times out. When you decommission a machine, destroy all encryption keys, security parameters, and sensitive software before the hardware changes hands.
EMV Chip Liability
Visa, Mastercard, and other major networks enforce a liability shift for counterfeit fraud at ATMs. If a chip-enabled card is used at a terminal that only reads the magnetic stripe because it lacks a chip reader, liability for counterfeit fraud shifts to the acquirer, which in the independent ATM context means the deployer’s processing chain absorbs the loss.14Visa. Visa Core Rules and Visa Product and Service Rules The shift has been in place for most major networks since 2017. Running magnetic-stripe-only equipment now amounts to self-insuring against every counterfeit chip-card transaction that comes through.
Taxes and Recordkeeping
Surcharge revenue is business income. Solo operators typically report it on Schedule C as self-employment income, paying both income tax and self-employment tax on net profits. Deployers running through an LLC or corporation follow the reporting rules for that entity.
Processors and sponsor banks that pay surcharge revenue may be required to issue information returns. For tax year 2026 the reporting threshold for payments on Forms 1099-MISC and 1099-NEC rose to $2,000 (up from $600), with inflation adjustments starting in 2027.15Internal Revenue Service. Instructions for Forms 1099-MISC and 1099-NEC Even if your surcharges fall below that threshold, the income remains taxable and must be reported.
Keep records of all cash used to replenish machines, settlement statements from your processor, and contracts with location owners. Those records satisfy the IRS in an audit and help your sponsor bank confirm your cash loading funds come from legitimate sources.
Onboarding a New Terminal
Getting a machine from the warehouse to a live, transaction-processing terminal involves paperwork the networks and sponsor banks take seriously. Cutting corners delays activation or gets an application rejected.
Merchant Location Agreement
The first document is a Merchant Location Agreement between you and the business owner hosting the machine. The contract sets out the surcharge split, the length of the placement, who handles maintenance and cash loading, and what happens if either party ends the arrangement. Both sides should keep copies. Notarization is not universally required, but it costs only a few dollars per signature in most states and adds legal protection if the agreement is later disputed.
Sponsorship and Network Registration
You complete sponsorship forms through a bank or independent sales organization that connects you to the payment networks. These forms require personal identification for a background check, typically a driver’s license and Social Security number or EIN, along with the machine’s exact street address, anticipated monthly volume, and a voided check or bank letter for the account where surcharges and settlement funds will land.
Review usually takes five to ten business days. The sponsor runs criminal and financial background checks and verifies you are not on restricted federal agency lists. Approval triggers the issuance of a unique Terminal Identification number that ties the physical machine to the global payment network.
Key Loading and Activation
The last step before going live is loading the machine’s encryption keys, the cryptographic components that secure every transaction between the terminal and the processor. Keys are delivered through two separate secure channels so no single interception can compromise the full key. Load the keys into the machine’s management system, run a test transaction to confirm communication with the processor, and the terminal is active.
State Licensing
Federal rules are only half the picture. Some states require independent ATM operators to hold a state license or registration. Requirements and fees vary widely: some states impose no additional licensing, others charge annual fees running into the low thousands of dollars. Check with your state’s banking or financial regulation agency before placing a machine. Operating without a required state license can bring fines, forced shutdown of the terminal, or loss of your sponsor relationship.