ATM compliance gets sold as a cliff edge. It mostly isn’t. Here is what EMV, TR-31, the ADA, and Reg E actually require, what happens if a machine falls short, and how to check one in ten minutes.
Four rules cover a retail ATM: EMV chip cards, the TR-31 key-block standard for the PIN pad, the ADA accessibility standards, and the Reg E fee notice. A new machine from Genmega or Hyosung already meets all four. Only one of them can actually stop a machine from processing, and even that one arrived years late and without a single shutdown day.
If you have heard that ATM compliance is a minefield, you have mostly heard it from people selling upgrades. This guide explains what each rule actually requires, what really happens if a machine falls short, and how to check a specific machine yourself. None of it is legal advice. It is the practical picture from operating machines.
No. EMV is not a law and not a network mandate. It is a liability shift. Since October 2016 for Mastercard and October 2017 for Visa, if a chip card is used at an ATM that can only read the magnetic stripe and the transaction turns out to be counterfeit fraud, the ATM owner pays the chargeback instead of the card’s bank. A non-EMV machine still processes normally.
The card networks chose this approach on purpose. Rather than a deadline with shutdowns, they gave operators a risk-based choice: upgrade and hand fraud liability back to the issuer, or don’t and carry it yourself.
What that risk looks like depends on the site. Counterfeit-card fraud clusters at unattended, high-traffic, easy-to-reach machines. An ATM inside a salon, where staff are on the floor all day and regulars make up the customer base, sees little of it. Plenty of older mag-stripe machines are still processing at locations like that.
The honest caveat is that the exposure only runs one direction, and one fraud ring working a machine can erase months of surcharges. That is why the practical answer is to buy EMV on anything new — it is standard on every current retail machine anyway — and to weigh the risk on an existing mag-stripe machine by its location rather than by a sales pitch.
TR-31 is a standard for how the encryption keys in your PIN pad are packaged when they are loaded. The PCI PIN security rules required ATMs to use it from January 1, 2025. It is the one requirement that can stop a machine, because a processor can decline to key a PIN pad that does not support it — but it is enforced processor by processor, on no single cutoff date.
The deadline itself has moved more than once. When the PCI Security Standards Council introduced key blocks in 2014, it phased them in, and the phase covering ATMs was originally due June 1, 2023. In August 2020, citing the COVID-19 pandemic among other factors, it pushed that phase back to January 1, 2025, and the network-connection phase before it from June 2021 to January 2023.
When January 2025 arrived, machines did not go dark across the country. Processors have been working non-compliant machines off their networks on their own schedules, and many allowed them to keep transacting while owners upgraded. That window is narrower now than it was on the deadline, and it will not stay open forever. The practical move is to ask your processor where your specific machine stands, instead of assuming either extreme.
For most machines built in the last decade, the fix is small. On a Genmega with an EPP-B3 or EPP-B5 PIN pad, it is a software update. On older pads it is a keypad replacement. Hyosung’s path runs through the EPP 8000R or EPP X1 PIN pad at current firmware. The machines that genuinely aged out are the old platforms — the basic Hantle 1700 and older 4000-series machines, the Hyosung NH and MB series — which most operators had already retired.
| Requirement | What it means in hardware | In force since | If a machine falls short | How to check | |
|---|---|---|---|---|---|
| EMV chip | A chip-capable card reader and EMV-certified software | Oct 2016 (Mastercard), Oct 2017 (Visa) | Still processes; you carry counterfeit-fraud chargebacks | Chip slot on the reader; EMV enabled in the operator menu | |
| TR-31 key blocks | An encrypting PIN pad revision and software that support key blocks | Jan 1, 2025 (moved from June 2023) | Your processor may decline to key or keep processing it | EPP model and firmware in the diagnostics menu; ask your processor | |
| ADA accessibility | Headphone jack with speech output, tactile keypad, Braille speech instructions | March 15, 2012 | Still processes; complaint and lawsuit exposure | Plug in headphones and run a transaction; measure the mounting height | |
| Reg E fee notice | Nothing physical — an on-screen or printed fee notice | On-screen notice long-standing; placard dropped Dec 2012 | A surcharge collected without notice is not permitted | Start a withdrawal and confirm the fee screen appears with a cancel option |
Under section 707 of the 2010 ADA Standards, in force since March 15, 2012, an ATM must let a blind or low-vision customer complete a transaction without help: speech output through a standard headphone jack, a tactile keypad, and Braille instructions for starting speech mode. It must also sit where a wheelchair user can reach it. Current retail machines are built for the first part.
In more detail, the speech output has to cover instructions, prompts, error messages, and everything on screen needed to finish the transaction, with privacy — which is why it goes through headphones rather than a speaker. Braille is narrower than most people assume: it is required for the instructions on starting speech mode, not for full transaction menus.
The part the machine cannot handle for you is placement. The reach range for the controls is between 15 and 48 inches above the floor for an unobstructed approach, and the customer needs clear floor space of at least 30 by 48 inches in front of the machine. A lobby ATM tucked behind a display rack or wedged into a corner can fail on placement even though the machine itself is fully compliant.
Nobody comes around to inspect retail ATMs. Enforcement is driven by complaints and lawsuits, and those tend to target things that are visibly broken, such as a dead headphone jack or a machine nobody in a wheelchair can reach. California is the one place worth extra care, because its Unruh Act adds statutory damages of $4,000 per occasion on top of federal law. The practical defense is simple: place the machine sensibly and test the headphone jack when you service it.
No. The physical fee placard was eliminated by an act of Congress signed December 20, 2012, and the CFPB conformed Regulation E to it on March 26, 2013. What 12 CFR 1005.16 still requires is a notice on the screen or on paper, shown before the customer commits, stating the fee and letting them cancel without charge. Your ATM’s software does this.
The one thing you control is that the surcharge programmed into the machine matches what you intend to charge. If you change your surcharge, confirm the new amount appears on the fee screen before the next customer uses it.
Most of the risk in ATM compliance sits in used machines, and almost all of it can be ruled out in about ten minutes before money changes hands:
A machine that passes all seven is ready to work. One that fails step 3 or 4 is not necessarily scrap — it may need only a keypad — but price the fix into the offer. How Much Does an ATM Machine Cost? covers what used machines typically sell for, and Genmega vs. Hyosung covers which revisions each brand needs.
Less than most guides claim. There is no federal ATM operator license, and the frequently repeated claim that an owner must register with FinCEN as a money services business does not apply to a machine that only dispenses cash drawn from the customer’s own account. The ATM Business Setup Checklist covers the actual paperwork: the processing agreement, the location agreement, and ordinary business registration.
The ongoing obligations are the ones in the table above, and for a new machine they are handled at the factory. If you have a specific machine and want a straight answer on whether it can be put into service, send us the model and we will tell you plainly.
It keeps processing. EMV is a liability shift, not a shutdown: if a chip card is used at a mag-stripe-only machine and the transaction turns out to be counterfeit fraud, the ATM owner pays the chargeback instead of the card’s bank. At a staffed, low-fraud location that risk can be modest, but it only runs one direction, so buy EMV on anything new.
Not all at once. The requirement took effect January 1, 2025, after being pushed back from June 2023, but enforcement happens processor by processor. Many processors let non-compliant machines keep transacting while owners upgraded. That window is narrowing, so ask your own processor where your machine stands rather than assuming either extreme.
Often very little. Many Genmega machines with EPP-B3 or EPP-B5 PIN pads need only a software update, and Hyosung machines with the EPP 8000R or EPP X1 need current firmware. Older PIN pads need a keypad replacement. Only the oldest platforms, most of them long retired, are genuinely not worth upgrading.
No. Congress eliminated the physical fee placard in December 2012 and the CFPB updated Regulation E in March 2013. What is required is an on-screen or printed notice, shown before the customer commits, stating the fee and letting them cancel at no charge. Current ATM software provides it; you only need to make sure the programmed fee is right.
Potentially both. Under the ADA, the owner, operator, and the business leasing the space can each be responsible, and a placement agreement does not automatically move that risk. In practice, the machine handles most of the requirements; the parts people get wrong are placement — reach range and clear floor space — and broken headphone jacks.