S.F. 449 Section 1. NEW SECTION . 533C.1004 Digital financial asset 1 transaction kiosks. 2 1. Definitions. As used in this section, unless the context 3 otherwise requires: 4 a. “Charges” means any of the following: 5 (1) A fee or expense paid by a consumer. 6 (2) The difference between the current market price of a 7 digital financial asset on a licensed digital financial asset 8 exchange and the price of the digital financial asset charged 9 to a consumer. 10 b. “Consumer” means either a new consumer or an existing 11 consumer. 12 c. “Digital financial asset” means a virtual representation 13 of value or rights that can be transferred, stored, or traded 14 electronically and used for payment or investment purposes. 15 d. “Digital financial asset transaction kiosk” means an 16 electronic terminal acting as a mechanical agent of an operator 17 to enable the operator to facilitate the exchange of a digital 18 financial asset for money, bank credit, or other digital 19 financial asset, including but not limited to any of the 20 following: 21 (1) By connecting directly to a separate licensed digital 22 financial asset exchange that performs the digital financial 23 asset transaction. 24 (2) By drawing upon a digital financial asset in the 25 possession of the operator. 26 e. “Existing consumer” means an individual who is not a new 27 consumer. 28 f. “Licensed digital financial asset exchange” means a 29 digital financial asset exchange that is not an operator and 30 that has a license under section 533C.301 to engage in the 31 business of money transmission in this state. 32 g. “New consumer” means an individual who has not previously 33 engaged in a digital financial asset transaction with a 34 particular operator. An individual shall continue to be 35 -1- SF 449 (4) 91 nls/ko/mb 1/ 8

S.F. 449 considered a new consumer for a period of thirty calendar days 1 after the individual makes their first digital financial asset 2 transaction with a particular operator. 3 h. “Operator” means a person who owns, operates, or manages 4 a digital financial asset transaction kiosk in this state. 5 i. “Transaction hash” means a unique identifier made up of 6 a string of characters that act as a record of, and proof of, a 7 digital financial asset transaction being verified and added to 8 a blockchain. 9 2. Daily transactions. 10 a. An operator shall not, via a digital financial asset 11 transaction kiosk, accept from a consumer or dispense to a 12 consumer more than one thousand dollars per calendar day. 13 b. In the thirty calendar days following a new consumer’s 14 first financial asset transaction with a particular operator, 15 the operator shall not, via a digital financial asset 16 transaction kiosk, accept from the new consumer or dispense to 17 the new consumer more than ten thousand dollars. 18 3. Maximum charges. An operator shall not directly or 19 indirectly collect charges related to a digital financial asset 20 transaction from a consumer that exceed the greater of the 21 following: 22 a. Five dollars. 23 b. Fifteen percent of the United States currency equivalent 24 of the digital financial assets involved in the digital 25 financial asset transaction according to the public quoted 26 market price of the digital financial asset on a licensed 27 digital financial asset exchange at the date and time the 28 consumer initiates the digital financial asset transaction. 29 4. Required disclosure. 30 a. Prior to a digital financial asset transaction, the 31 operator shall provide a written disclosure to the consumer in 32 English, and in the primary language used by the operator to 33 advertise, solicit, or negotiate with the consumer, containing 34 the terms and conditions of the digital financial asset 35 -2- SF 449 (4) 91 nls/ko/mb 2/ 8

S.F. 449 transaction, including, at a minimum, all of the following: 1 (1) The dollar amount, in United States currency 2 equivalent, of the digital financial asset involved in the 3 transaction. 4 (2) Any charges to be collected by the operator. 5 (3) If an operator fails to provide a process to reverse or 6 refund a digital financial asset transaction, a warning that 7 all digital financial asset transactions are final. 8 (4) The following written warning against fraud: 9 WARNING: CONSUMER FRAUD OFTEN STARTS WITH CONTACT FROM A 10 STRANGER WHO IS INITIATING A DISHONEST SCHEME. CRIMINAL 11 ACTIVITY MAY APPEAR IN MANY FORMS, INCLUDING BUT NOT LIMITED 12 TO THE FOLLOWING: 13 1. Claims of a frozen bank account or credit card. 14 2. Claims of fraudulent financial transactions. 15 3. Claims of identity theft or job offers in exchange for 16 payment. 17 4. Requests for payment to government agencies or 18 companies. 19 5. Requests for disaster relief donations or loans. 20 6. Offers to purchase tickets for lotteries, sweepstakes, 21 or drawings for vehicles. 22 7. Prompts to click on desktop pop-ups, such as virus 23 warnings or communication from alleged familiar merchants. 24 8. Communication from someone impersonating a 25 representative of your bank or a law enforcement officer. 26 IF YOU BELIEVE YOU ARE BEING SCAMMED, CALL YOUR LOCAL LAW 27 ENFORCEMENT. 28 WARNING: TRANSACTIONS CONDUCTED ON THIS DIGITAL FINANCIAL ASSET 29 TRANSACTION KIOSK ARE IRREVERSIBLE. PROTECT YOURSELF FROM 30 FRAUD. NEVER SEND MONEY TO SOMEONE YOU DO NOT KNOW. 31 b. A disclosure required under paragraph “a” shall be 32 clear and conspicuous and provided separately from any other 33 disclosures or information provided by the operator. 34 c. Prior to entering into a digital financial asset 35 -3- SF 449 (4) 91 nls/ko/mb 3/ 8

S.F. 449 transaction with a consumer, an operator shall require the 1 consumer to attest to receiving the disclosure required under 2 paragraph “a” . 3 5. Required receipt. For any digital financial asset 4 transaction made at an operator’s digital financial asset 5 transaction kiosk, the operator shall provide the consumer with 6 a receipt. When possible, the receipt shall be a physical 7 receipt. The operator may provide the receipt in multiple 8 communications, if necessary. The receipt shall include, at a 9 minimum, all of the following information: 10 a. The name of the consumer. 11 b. The date and time of the digital financial asset 12 transaction, the type, value, and transaction hash of the 13 digital financial asset transaction, and each applicable 14 virtual currency address. 15 c. The legal name of the operator and the operator’s contact 16 information, including a telephone number, that may be used 17 by the consumer to get answers to questions and to register 18 complaints. 19 d. The dollar amount of the digital financial asset involved 20 in the transaction and the exchange rate of the virtual 21 currency to dollars. 22 e. (1) The dollar amount of all charges collected by 23 the operator in relation to the digital financial asset 24 transaction. 25 (2) The legal name of the licensed digital financial asset 26 exchange the operator used to calculate the charges described 27 in subsection 1, paragraph “a” , subparagraph (2). 28 f. A list of relevant state and local law enforcement and 29 regulatory agencies for reporting fraud. 30 g. A statement of the operator’s refund policy. 31 h. Any additional information the operator deems necessary. 32 i. Any additional information required by federal law. 33 6. Required report. An operator shall provide a list to 34 the division of banking of the street address locations of all 35 -4- SF 449 (4) 91 nls/ko/mb 4/ 8

S.F. 449 digital financial asset transaction kiosks that the operator 1 owns, operates, or manages in this state. An operator shall 2 provide the division with updates to the list within thirty 3 calendar days of any change to the list. The division shall 4 make each operator’s list available to the public via the 5 division’s internet site. 6 7. Operator duties. 7 a. If an operator does not engage in digital financial 8 asset transactions, but facilitates or permits another person 9 to engage in digital financial asset transactions via the 10 operator’s digital financial asset transaction kiosk, the 11 operator shall do all of the following: 12 (1) Ensure that the person engaging in digital financial 13 asset transactions has a license to engage in the business of 14 money transmission under section 533C.301. 15 (2) Ensure that charges collected from a consumer via the 16 digital financial asset transaction kiosk comply with this 17 section. 18 (3) Ensure that the person complies with this section. 19 b. An operator shall provide live customer service a minimum 20 of Monday through Friday between the hours of 8:00 a.m. and 21 10:00 p.m. The customer service toll-free telephone number 22 shall be displayed on the digital financial asset transaction 23 kiosk. 24 c. An operator, or an established third party acting on 25 behalf of the operator and that specializes in performing 26 blockchain analytics, shall use blockchain analytics software 27 to assist in the prevention of sending a purchased digital 28 financial asset from an operator to a virtual currency wallet 29 known to be affiliated with fraudulent activity at the time 30 of a digital financial asset transaction, and to detect 31 transaction patterns indicative of fraud or other illicit 32 activities. The superintendent may request evidence from an 33 operator, or of an established third party acting on behalf 34 of the operator and that specializes in performing blockchain 35 -5- SF 449 (4) 91 nls/ko/mb 5/ 8

S.F. 449 analytics of current use of blockchain analytics software. 1 d. For the purpose of facilitating law enforcement and 2 regulatory agency communications with the operator in the event 3 of a consumer report of fraud, an operator shall maintain a 4 dedicated telephone number or email address for use by law 5 enforcement and regulatory agencies. 6 8. Refunds —— new consumers. Upon the request of a new 7 consumer, an operator shall issue to the consumer a refund for 8 the full amount of all digital financial asset transactions 9 that the consumer made during the thirty-calendar-day period 10 that the consumer was a new consumer if all of the following 11 circumstances exist: 12 a. The new consumer was fraudulently induced to engage in 13 the digital financial asset transaction for which the consumer 14 is requesting a refund. 15 b. The consumer has contacted the operator and a government 16 or law enforcement agency to report the fraudulent nature of 17 the digital financial asset transaction within ninety calendar 18 days of the last digital financial asset transaction to occur 19 while the consumer was a new consumer. 20 c. The consumer has submitted proof of the fraud to the 21 operator, including but not limited to a police report or sworn 22 declaration detailing the fraudulent nature of the digital 23 financial asset transaction. 24 9. Refunds —— existing consumers. Upon the request of an 25 existing consumer, an operator shall issue to the existing 26 consumer a refund for the full amount of all digital financial 27 asset transactions that the existing consumer made if all of 28 the following circumstances exist: 29 a. The existing consumer was fraudulently induced to engage 30 in the digital financial asset transaction for which the 31 consumer is requesting a refund. 32 b. The existing consumer has contacted the operator and a 33 government or law enforcement agency to report the fraudulent 34 nature of the digital financial asset transaction within ninety 35 -6- SF 449 (4) 91 nls/ko/mb 6/ 8

S.F. 449 calendar days of the digital financial asset transaction for 1 which the consumer is requesting a refund. 2 c. The existing consumer has submitted proof of the fraud 3 to the operator, including but not limited to a police report 4 or sworn declaration detailing the fraudulent nature of the 5 digital financial asset transaction. 6 10. Enforcement —— penalties. 7 a. If the attorney general has reasonable belief that an 8 operator is in violation of this section, the attorney general 9 has the sole authority to bring civil action to provide for all 10 of the following: 11 (1) Enjoin further violations by the operator. 12 (2) Enforce compliance with this section. 13 (3) Civil penalties in an amount not more than ten thousand 14 dollars for each violation of this section. 15 (4) Other remedies permitted under law. 16 b. If the attorney general has reasonable belief that a 17 person is in violation of an injunction issued under this 18 subsection, the attorney general has the sole authority to 19 bring civil action to provide for civil penalties in an amount 20 not more than one hundred thousand dollars. 21 c. An individual that has knowledge of a violation of this 22 section may report the violation to the attorney general. 23 d. The attorney general shall establish an electronic 24 reporting system for the submission of reports pursuant to this 25 subsection. 26 11. Compliance policies. An operator shall implement, 27 maintain, and enforce written policies and procedures for 28 compliance with this section. The policies and procedures 29 shall be reviewed and approved by the operator’s board of 30 directors or an equivalent governing body of the operator. 31 12. Fraud policy. An operator shall take reasonable 32 steps to detect and prevent fraud, including establishing and 33 maintaining a written antifraud policy. The antifraud policy 34 shall, at a minimum, include all of the following: 35 -7- SF 449 (4) 91 nls/ko/mb 7/ 8

S.F. 449 a. The identification and assessment of fraud-related risk 1 areas. 2 b. Procedures and controls to protect against identified 3 risks. 4 c. Allocation of responsibility for monitoring risks. 5 d. Procedures for the periodic evaluation and revision of 6 the antifraud procedures, controls, and monitoring mechanisms. 7 13. Compliance officer. An operator shall designate and 8 employ a compliance officer who meets all of the following 9 requirements: 10 a. The individual is qualified to coordinate and monitor 11 compliance with this section and all applicable state and 12 federal laws and rules. 13 b. The individual is a full-time employee of the operator. 14 c. The individual does not own more than twenty percent of 15 the operator that employs the individual. 16 Sec. 2. EFFECTIVE DATE. This Act, being deemed of immediate 17 importance, takes effect upon enactment. 18 Sec. 3. APPLICABILITY. This Act applies on or after July 19 1, 2025, to operators. 20 -8- SF 449 (4) 91 nls/ko/mb 8/ 8