San Diego plans to require visible fraud warnings on cryptocurrency ATMs or within two feet of them. The proposal passed its first reading unanimously and would also make host businesses responsible for displaying a compliant sign.
San Diego City Council unanimously approved the first reading of an ordinance requiring scam warnings at cryptocurrency ATMs on October 20. Introduced by Council President Joe LaCava, the proposal covers owners and operators of machines that exchange cash for digital assets, as well as businesses hosting them. The council must approve the proposal again and the mayor must sign it before it becomes law.
The proposal appeared as item S501 on the October 20 agenda. A city staff report dated October 14 says more than 100 crypto ATMs are reported in San Diego. Scammers can direct victims over the phone to a machine in a grocery store, gas station or corner shop. They tell victims to convert cash into cryptocurrency and transfer it. The report says separate loss data for crypto ATM scams in San Diego is unavailable.
A physical warning beside the machine
The O-2027-17 ordinance text requires owners or operators to post the city-designed warning on the machine or within two feet, roughly 61 centimetres, of it. A user standing in front of the ATM must be able to see the sign. A downloaded paper printout would have to be laminated; adhesive stickers would also be permitted. The city would not pay the downloading, printing, laminating or posting costs.
The City Manager would choose the languages for the multilingual warning. At a minimum, it must warn about cryptocurrency scams and provide contact details for relevant state or city law enforcement, or a digital link to those details. A host business could not allow an ATM on its premises without a compliant sign.
The sample sign in the agenda packet is marked “Draft”. Its English and Spanish text lists warning signs: never having met the person requesting money face to face, never having used a crypto ATM before, or a caller claiming to represent law enforcement or government. It tells users to hang up and contact San Diego County Adult Protective Services.
“Cryptocurrency may be used for scams!”
The city’s draft warning sign
Operators would separately display their name, address, telephone number and the days and hours when help is available. They could post the contact details on the ATM or within two feet of it, or display them on its initial welcome screen. The fraud warning must be posted physically; the screen option for contact details does not replace the sign.
When the rules and penalties would apply
Once the council gives its second approval and the mayor signs, the ordinance would take effect on January 1, 2027, or the 30th day after final passage, whichever is later. The city could not issue citations for violations during the first 90 days after the effective date.
| Stage | Planned action |
|---|---|
| October 20, 2026 | Unanimous first reading; second approval and signature pending. |
| Effective date | January 1, 2027, or 30 days after final passage, whichever is later. |
| First 90 days | No citations for violations. |
| Written notice of violation | The recipient would have 30 days to correct the problem. |
Before taking enforcement action, the city must send written notice to the ATM owner or operator and the host business. Notices would use the operator’s address reported to California’s Department of Financial Protection and Innovation (DFPI) and the host’s address on its city business certificate. Recipients would then have 30 days to supply the missing sign or information. An unregistered operator could be reported to DFPI.
Parties properly notified could be held jointly and severally liable for administrative and civil penalties. The city could use its existing administrative and judicial remedies. The proposal sets no separate fixed fine and creates no private right of action. An ATM owner’s obligation would not remove the host shop’s responsibility.
The 03:00–03:17 segment of CBS 8 San Diego’s October 21 report explains the second approval and signature still needed after the first reading. The report also cites LaCava as saying signs could be posted from mid-November once the necessary approvals are in place. No exact November date has been announced; the mandatory requirement in the city’s text would begin no earlier than January 1, 2027.
California’s existing limits remain in place
Under DFPI’s rules for kiosk operators, cash accepted or dispensed per customer has been capped at $1,000 a day since January 1, 2024, with a receipt required for each transaction. Since January 1, 2025, combined direct and indirect charges for one transaction cannot exceed the greater of $5 or 15% of the dollar value of the digital assets involved. Before a transaction, operators must also disclose the amount, charges and, where applicable, the absence of a reversal or refund method.
LaCava’s office, AARP and the city’s Senior Affairs Advisory Board plan an education campaign for businesses about the sign requirements and scam prevention. The staff report gives no firm campaign date. The Rules Committee unanimously approved the proposal on September 16.
Phone phishing: San Diego Police advises hanging up when someone uses fear or urgency to press for payment. It recommends checking with a bank using the number on the back of the customer’s card, rather than a number supplied by the caller, and never giving an unexpected caller a password, PIN or security code.
