Just to clarify - let's say someone wants to setup a cash>BTC ATM machine. Ignoring the state requirements for a moment - what constitutes compliance at the Federal level? I see many of these machines simply asking for a. fingerprints b. IDs or c. cellphone numbers alone to enable transactions. Would these methods suffice to KYC at the federal level? I know the states can make things vastly more complex but again, ignoring the states for a moment.
I believe you are correct. The ATMs I have visited in the U.S. require some "proof" of identity by scanning an ID and/or the other things you mentioned. The business just has to demonstrate that it is trying to keep out money laundering, and that they have tried to determine the identity of the user. The reason the government can insist is because the transaction involves their money. Remember, you CAN NOT own dollars.