Illinois Enters the Crypto Regulation Game
Last August, Governor Pritzker signed two new laws establishing Illinois’ first comprehensive framework for digital asset regulation. These laws are the Digital Assets and Consumer Protection Act (DACPA) and the Digital Asset Kiosks Act (DAKA). Together, they position Illinois as an early mover in crypto regulation in the Midwest, with enforcement authority vested in the Illinois Department of Financial and Professional Regulation (IDFPR).
Crypto Regulation for Consumers
The new laws focus heavily on crypto ATMs and kiosk machines for consumers. Often located in convenience stores, crypto ATMs allow users to buy Bitcoin with cash. Daily transaction limits are capped at $2,500 for new customers and $10,500 for existing ones, and fees are capped at the greater of $5 or 18% of the transaction.
The most notable consumer protection is a fraud refund right. Operators must provide full refunds to customers who request one within 30 days of their last transaction and submit a police report within 60 days of the incident.
Crypto Regulation for Businesses
The framework of these laws is more complex for businesses. Although the formal IDFPR registration process does not launch until 2027, compliance obligations are already in effect. In October 2025, IDFPR issued a notice to the industry advising that certain provisions of DACPA and DAKA became effective upon signing. One of those immediate obligations is that kiosk operators must submit a list of all physical kiosk locations using IDFPR’s reporting template and emailing it to the Department.
Broadly, the laws impose ongoing compliance requirements. Businesses must provide clear disclosures regarding fees, risks, and refund rights, and maintain adequate financial resources. They’ll also be expected to implement written plans and procedures addressing cybersecurity, fraud, and anti-money laundering consistent with standards applicable to traditional financial services. For kiosk operators, clear disclosure of fees, risks, and refund rights must be presented at the point of transaction, and operator locations will be published on IDFPR’s website. Additional administrative rules implementing both laws are still being developed and will be posted on IDFPR’s digital assets page as they’re finalized, so the full compliance picture isn’t set yet.
Levin Ginsburg’s Assessment
Based on our review of the law, the refund-on-fraud provision is unusually consumer-friendly and will likely generate disputes over what qualifies as a covered scam, particularly where the customer’s own conduct contributed to the loss. The 2027 registration deadline provides some runway, but the underlying compliance infrastructure will take meaningful time to build, and businesses that wait for final rules may find themselves scrambling to catch up. With federal crypto legislation still unsettled, state-level regimes like DACPA and DAKA are likely to proliferate, and Illinois businesses operating in multiple states should expect a growing patchwork.
If you have questions about how these laws may affect your business, please reach out to Levin Ginsburg for assistance. Each situation is fact specific, so for questions about your specific circumstances, please contact Kevin Thompson through our website.
