There are three ways the currency dealer could be making money providing the foreign exchange (forex) conversion:
1) Spread markups: the difference between the bid/ask price (i.e. the rate where you can buy and the rate you can sell), compared to the underlying spot rate (not the bank rate which is already marked-up from the real interbank spot price. In other words, the rate banks offer consumers are usually not indicative of the real underlying interbank spot price, as they will add a spread. So if the mid-point between the Euro for example against the Turkish Lira, also known as the EUR/TRY pair was trading at 6.20714 TRY for every 1 euro, the underlying interbank spot rate might be 6.20707/6.20721, but the price offered by a bank or local kiosk (at airport etc..) could be far worse such as 5.4100/7.1200, and therefore both the bank and local provider are earning considerable spread compared to the true spot rate.
2) Commission: many services might add a fixed commission rate which could be expressed as a percentage of the base currency (Euro, in above example) or counter currency (Turkish Lira, in above example), depending on whether you are buying or selling. Or there could be other commission models, such as in the interbank markets commissions could be $10 per 10,000 (i.e. $100 per 100,0000) or might not scale, such as $10 regardless of size up to a certain limit.
3) Market-maker risk: In terms of avoiding/dealing with currency fluctuations, the dealer is either acting as an agency broker which means it is earning from the commission only and not the spread, as the trade is executed through a 3rd party the dealer uses, although I should note how that third party could rebate a portion of the spread back to the dealer. However, the dealer would have no market-maker risk in this setup as an agency broker, as that risk would be mitigated. If however, the dealer was taking the risk on the other side of each trade, they would need to be able to offset and manage that risk through a combination of hedging and settling their exposure (such as if it reaches a certain Value at Risk (VaR) threshold). If the dealer handles other currencies this risk management becomes more complex and would be akin to how online forex brokers manage their risk. The Global FX Code are new standards that banks and interdealer brokers are adapting in terms of best practices, and in some cases, these practices are trickling down to the smaller banks and local dealers to help bring more integrity to the market and avoid price gouging: https://www.globalfxc.org/docs/fx_global.pdf)
And since the dealer is handling physical currency, there is likely a delay between how the risk is managed and when an exchange is made, unless it is managed in real-time when providing the service to the client (which would require an electronic trading platform or voice-broking system). Given the rise of financial technology payment's application, it would be pretty easy for the dealer to manage such risk with the right system in place, otherwise, they could have substantial end-of-day risk if they handled a sufficient number of transactions and if the market moved against them adversely (or profit if it moved in their favor).