A card holder can withdraw funds at an ATM only if the card product associated with their card supports it.
To block ATM withdrawals, ensure the config.poi.atm field of your card product is set to FALSE.
For more information, see Card Products in the Core API Reference.