Last reviewed: October 23, 2026.
A crypto ATM looks like a cash machine, but it is not linked to your bank account: it exchanges cash for cryptocurrency and, on some models, cryptocurrency for cash. From October 28, 2026, every transaction at one of these machines in Spain requires identification and identity verification, whatever the amount. Here is where they came from, how they work, what risks they carry and what to keep if you buy at one.
From a Vancouver Coffee Shop to Thousands of Machines
The first bitcoin ATM opened on October 29, 2013, in a Waves Coffee House in downtown Vancouver, Canada. It was installed by the US company Robocoin and the Canadian firm Bitcoiniacs. According to CBC News's report that day, customers had to scan their palm and could exchange up to $3,000 a day in both directions: from cash to bitcoin and from bitcoin to cash.
Since then the sector has grown a lot, and very unevenly. The Coin ATM Radar directory, which compiles known crypto ATM locations, listed about 27,000 locations worldwide on October 23, 2026. More than 70% were in the United States (19,515), followed by Canada (3,550) and Australia (1,699). In Europe, Spain appeared with 250 locations, second only to Poland (327).
These figures are a snapshot of the directory, not an official census, and they change every week. In some countries the number has fallen because of supervisors. In the United Kingdom, for example, the Financial Conduct Authority (FCA) says the crypto ATMs advertised on Coin ATM Radar went from more than 80 in 2022 to none in 2024.
How a Crypto ATM Works
One-Way and Two-Way Machines
- One-way: they only let you buy. You insert cash and receive cryptocurrency.
- Two-way: they let you buy and also sell, that is, send cryptocurrency to the machine and withdraw cash.
Some models also accept cards, and many support several cryptocurrencies besides bitcoin.
Buying
- Choose the cryptocurrency and the operation on the screen.
- Identify yourself. In Spain this is mandatory for every transaction from October 28, 2026.
- Show the machine's reader the QR code of your wallet address, usually on your phone.
- Insert the banknotes. The machine shows the exchange rate applied and the amount you will receive.
- Confirm, and the machine sends the transaction to the blockchain. At the end you get a receipt on paper or by email.
Selling
On a two-way machine the path is reversed. The machine shows a QR code with an address belonging to the operator, you send the cryptocurrency from your wallet and, once the transaction has the confirmations the operator requires, the machine pays out the cash. Some operators give you a code to collect the money later.
Wallets and QR Codes
The QR code only represents an address. Whoever controls the wallet behind that address controls the funds. That is why it matters so much that the QR code is from your wallet and not from someone who sent it to you in a message.
Fees
Crypto ATMs charge for convenience and for handling cash. The cost is usually built into the exchange rate, as a margin over the market rate, and sometimes there is also a fixed fee and the network cost. Check the final amount you will receive on screen before confirming, and compare it with an authorized exchange.
Legitimate Uses and Risks
Many people use crypto ATMs to buy small amounts with cash without opening an exchange account, or to turn cryptocurrency into banknotes. But that same speed has made them a common channel for scams.
In September 2024 the US Federal Trade Commission (FTC) published an analysis of consumer reports: fraud losses through bitcoin ATMs grew nearly tenfold between 2020 and 2023, to more than $110 million. People aged 60 and over were more than three times as likely as younger adults to report a loss. The pattern repeats: an urgent call or message from someone posing as your bank, the police or tech support. They say your money is at risk, ask you to withdraw it in cash and deposit it at an ATM by scanning a QR code they send you. That QR code is the scammer's wallet.
In the United Kingdom, the FCA considers every crypto ATM operating there illegal, because no registered firm is approved to offer the service, and warns that people using one may be handing their money to criminals. In 2025 a court sentenced a man to four years in prison for running an unregistered crypto ATM network.
Remember: no bank, public authority or police force will ever ask you to deposit money at a crypto ATM.
What Changes in Spain with Royal Decree 813/2026
Royal Decree 813/2026 of October 7, published in Spain's Official State Gazette (BOE) on October 8, amends, among other rules, the regulation implementing Law 10/2010 on the prevention of money laundering. The new Article 4.1 adds transactions "carried out at crypto-asset ATMs" to the cases where the obliged entity must identify the customer and verify their identity in all cases. Until now the general rule for occasional transactions started at EUR 1,000. For crypto ATMs there is no longer a minimum amount.
- Entry into force: twenty days after publication, under the Fourth Final Provision, that is, October 28, 2026.
- 18-month period: the Third Transitional Provision gives eighteen months from publication, until April 2028, for two technical changes. One is identification with the digital version of the Spanish ID card (Article 6.1.a). The other is keeping information obtained through electronic identification (Article 28). This period does not delay the obligation to identify yourself at crypto ATMs.
- Record keeping: the operator must keep due diligence records for ten years after the transaction.
It is an anti-money laundering rule, not a tax rule: it creates no tax and does not change how your crypto is taxed.
The European Context: MiCA and AMLR
This reform fits into a wider European framework. Under the MiCA Regulation, anyone who professionally exchanges crypto-assets for money in the EU must be authorized as a crypto-asset service provider; you can check this in ESMA's register. And from July 10, 2027, the new EU anti-money laundering regulation will apply, banning anonymous accounts and strengthening due diligence by these providers. We explain it in our article on the AMLR and crypto.
Crypto ATMs and the Source of Funds
If you bought cryptocurrency at an ATM and later sell it on an exchange or move the money to your bank, you will probably be asked where it came from. With cash involved, the institution will want to see two things: where the cash came from and that the purchase really took place.
It is worth keeping:
- The ATM receipt, with the date, amount, cryptocurrency and destination address.
- The transaction ID (TxID), which lets anyone locate it on the blockchain.
- The source of the cash: the bank statement showing the withdrawal, a payslip, the sale of an asset or another record.
- The link to your wallet: that the destination address is yours, and where those funds went next.
Under the new rule, the ATM operator will also have a record of your identity, which makes it easier to rebuild the full trail. See more in our guide on proving the source of crypto funds to your bank.
Need to prove the source of your funds? FundsOrigin analyzes your wallet's public address and produces a report you can add to your documents; whether to accept it is always the institution's decision. Analyze your wallet and see the available options →
Sources
- Royal Decree 813/2026 of October 7 (BOE-A-2026-20915, in Spanish): Article 5 (Articles 4.1, 6.1.a and 28 of the Law 10/2010 regulation), Third Transitional Provision and Fourth Final Provision.
- Coin ATM Radar, crypto ATMs by country (accessed October 23, 2026).
- CBC News, "World's first bitcoin ATM opens in Vancouver", October 29, 2013
- FTC, "Bitcoin ATMs: A payment portal for scammers", September 2024
- FCA, "Warning on illegal crypto ATMs operating in the UK"
- FCA, sentence for running an illegal crypto ATM network (February 28, 2025)
- Regulation (EU) 2023/1114 (MiCA), EUR-Lex
This content is for information only and is not legal, tax or investment advice. Check your situation with a professional.