Maryland Crypto Regulations: The Complete 2026 Picture

There is no single "crypto regulator" in Maryland. Four bodies matter, each with a different remit, and knowing which one to call is half the value of this page.

Federal regulators sit above all of this: FinCEN for money services business registration and anti-money-laundering obligations, the IRS for tax, the SEC and CFTC for products and markets. A platform serving Maryland customers is typically registered federally and licensed by the state.

A useful mental model: the Office of Financial Regulation cares about the plumbing — who is allowed to move money for you and on what terms. The Securities Division cares about the pitch — what someone told you the product would do. Most crypto problems fall clearly into one or the other.

This is the foundation, and it long predates cryptocurrency.

The Maryland Money Transmission Act sits at Title 12, Subtitle 4 of the Financial Institutions Article of the Maryland Code. It requires a licence for any person engaged in the business of money transmission in the state, with a carve-out for authorised delegates operating under a licensee's name. Licensing runs through the Commissioner of Financial Regulation, and applicants must post a surety bond — historically $150,000 — maintained for the life of the licence.

Crypto exchanges serving Maryland customers fall within this framework. Major digital asset businesses including Coinbase, Binance and CEX.IO hold Maryland money transmitter licences, and the licence numbers are public.

Why this matters to you rather than to lawyers: it gives you a free, fast, authoritative way to check whether a company should be taking your money.

1. Go to NMLS Consumer AccessThe Nationwide Multistate Licensing System's public lookup at nmlsconsumeraccess.org. It is free and requires no account.
2. Search the company nameNot the app name, the legal entity name if you can find it.
3. Check Maryland appearsExpand the licence list and confirm Maryland is present with an active status.
4. Note the NMLS IDCEX.IO, for example, is NMLS ID 1804170. That number should match what the company publishes.

Sixty seconds. It will not tell you whether a platform is well run, but it eliminates the entire category of businesses operating outside the law, which is where the worst outcomes live.

Maryland's most significant recent crypto legislation, and one of the more prescriptive kiosk regimes in the country.

Senate Bill 305 of the 2025 regular session, sponsored by Senator Pamela Beidle, was signed by Governor Wes Moore on 22 April 2025 and enacted as Chapter 117. It took effect on 1 July 2025, with registration mandatory from 1 January 2026. The Commissioner of Financial Regulation subsequently adopted implementing regulations at COMAR 09.03.16.

The statutory and regulatory package covers:

• Registration. Operators register through NMLS at $2,000 per operator plus $200 per kiosk. Registrations submitted by 31 December 2025 ran through 31 December 2026. Each machine must be designated as fixed-location or mobile, with NMLS records kept current.
• Transaction caps. $2,000 per person per day for a new customer; up to $10,500 per person per day for an established one.
• Fee cap. No more than the greater of $5 or 15% of the transaction amount.
• Disclosures. Minimum on-screen display durations — at least four seconds for a notice of twelve words or fewer, proportionally longer beyond that — plus mandatory fraud warnings.
• Receipts. Operator name and contact details, NMLS identifier, date, dollar amount, exchange rate, virtual currency address, transaction hash, and all fees and taxes. Provided in English and in any language the operator uses for marketing.
• Fraud process. A Notice of Fraud may be filed within 90 days; the operator must investigate and resolve within 30 calendar days; it may not require a police report; and it may not deny a fee refund on grounds of customer negligence or failure to heed warnings.
• Compliance controls. A designated chief compliance officer, blockchain analysis screening for high-risk wallets, and risk-based post-transaction monitoring.
• Reporting. Annual reports covering transaction volumes, fraud notices received, refunds granted, denials issued, and — for mobile kiosks — where fraud claims originated.
• Penalties. Civil penalties up to $1,000 for each knowing and wilful violation.
• Physical standards. ATM-style lighting and safety requirements, and signage directing consumers to the Commissioner for complaints.

The commercial effect was visible within months. Fixed compliance costs pushed small operators out of thinly served areas, particularly in western Maryland and on the Eastern Shore, while the national networks absorbed them. Our bitcoin ATM page covers what this means at the machine.

Maryland's Securities Division, within the Office of the Attorney General, regulates investment offerings and the people who sell them. It has been an active participant in national crypto enforcement.

The most consequential action for ordinary Maryland residents came on 6 June 2023, when the Maryland Securities Commissioner issued a summary order against Coinbase concerning its staking-as-a-service programme. Maryland acted alongside nine other state securities regulators in a coordinated task force led by California. The regulators' position was that the offering constituted unregistered securities.

The practical result is that staking is unavailable to Maryland residents on Coinbase, and Kraken and Crypto.com also exclude Maryland from staking and on-chain earn products. Legislation introduced in the 2026 session — the Maryland Financial Innovation Act, Senate Bill 759 and House Bill 859 — would clarify that staking-as-a-service is not the sale of an investment contract or security under the Maryland Securities Act, while preserving the Commissioner's money transmission authority and the Consumer Protection Act.

The everyday use of the Securities Division is more mundane and more valuable: checking registration. Anyone offering investment advice or selling investment products in Maryland for compensation should generally be registered, and registration status is public. Before you send money to a person or firm pitching a crypto investment, look them up. It is free, it takes two minutes, and it defeats a very large share of the fraud described on our scam page.

Stripping away the machinery, here is the position for an individual.

Legal and unrestricted: buying cryptocurrency, holding it, selling it, transferring it between wallets you control, using self-custody hardware, accepting crypto as payment for goods or services you sell, and giving it away.

Legal but regulated: using a virtual currency kiosk (subject to daily caps, fee caps and identity collection), using an exchange (which must hold a state licence to serve you), and running a business that touches crypto payments (which may create money transmission questions of its own).

Not available: staking through a major US exchange, and most consumer yield or earn products.

Not permitted: operating an unlicensed money transmission business — which includes buying and selling crypto for others as a business without a licence. This catches more people than you would expect, particularly those who start "helping friends" for a fee and scale up.

Also worth knowing: Maryland does not accept cryptocurrency for state or local tax payments. There is no Maryland central bank digital currency. No Maryland county or municipality has passed its own crypto ordinance — everything comes from Annapolis.

Regulators act on patterns, and patterns are built from individual reports. Filing takes twenty minutes and it matters even when your own case is unlikely to be resolved.

For a kiosk problem — fees, receipts, refusal to refund, an unregistered machine: the Maryland Office of Financial Regulation. Registered kiosks are required to display signage telling you how to reach the Commissioner. Where fraud is involved, file a Notice of Fraud with the operator first, within 90 days.

For an exchange problem — frozen withdrawals, licensing, unfair terms: the Office of Financial Regulation, and the Consumer Protection Division if the conduct was deceptive.

For an investment scam — a fake platform, a bogus adviser, a token scheme, an affinity-fraud pitch: the Securities Division at the Office of the Attorney General.

For a crime: your county police or sheriff for the local report, plus the FBI's Internet Crime Complaint Center. The IC3 filing feeds national pattern analysis and is worth doing even when you doubt your individual case will be pursued.

If you are in Montgomery County, the county operates its own Office of Consumer Protection in Rockville, giving you an additional route alongside the state agencies.

What to bring: the receipt (with the transaction hash), screenshots of any communications, the wallet addresses involved, dates and amounts, and the name of the operator or platform. The transaction hash is the single most useful item — it identifies the exact on-chain transfer.