On November 4, 2026, the DFPI announced a consent order resolving its investigation of a crypto ATM operator’s compliance with the Digital Financial Assets Law, the California Consumer Financial Protection Law, and federal AML requirements. The order requires the operator to pay at least $4,811,483 in restitution to 20 California consumers and $351,530 in disgorgement to the DFPI. The operator neither admits nor denies the order’s findings and conclusions.
The DFPI’s findings address alleged violations involving transaction limits, fees, disclosures, and receipts, as well as deficiencies in anti-money laundering controls. Specifically, the findings state that the operator:
- Exceeded daily transaction limits. On multiple occasions since January 1, 2024, its kiosks accepted more than $1,000 from a customer in one day, contrary to the Digital Financial Assets Law.
- Charged fees above the legal limit. Since January 1, 2025, the operator processed transactions with charges exceeding the greater of $5 or 15 percent of the transaction’s dollar value.
- Failed to provide required disclosures. The operator processed transactions without giving customers required pre-transaction written information, including fees and asset prices.
- Issued incomplete receipts. Its kiosk receipts omitted information required by the Digital Financial Assets Law, including details about the spread and the exchange used to calculate it.
- Had anti-money laundering control deficiencies. The DFPI identified deficiencies in customer due diligence, transaction monitoring, and risk management.
Putting It Into Practice: States remain active in crypto kiosk supervision (previously discussed here). These actions reflect state regulators’ continued focus on consumer protection in the crypto kiosk market. Operators should review transaction limits, fee calculations, disclosures, receipts, customer due diligence, and transaction monitoring, and monitor state enforcement and rulemaking for compliance developments.