California DFPI Consent Order Targets Digital Asset Kiosk Operator

California DFPI imposes a consent order on a digital asset kiosk operator, enforcing caps, disclosures, and AML controls, with a $1M penalty.

Rich by Coin

2026-01-29

On January 16, the DFPI entered into a consent order with a digital financial asset kiosk operator, based on DFPI’s allegations that the operator violated the Digital Financial Assets Law (DFAL), the California Consumer Financial Protection Law (CCFPL), and the Bank Secrecy Act (BSA). According to the consent order, the kiosk operator: Processed transactions above the daily dollar cap. The kiosks accepted more than $1,000 from a customer in a single day, in violation of the DFAL and the CCFPL. Charged fees above the permitted limits. Transactions included charges that exceeded the applicable fee cap, in violation of the DFAL and the CCFPL.

Completed transactions without required pre-transaction disclosures. Customers did not receive required written disclosures before certain transactions, including required fee and pricing information. Printed receipts missing spread transparency information. Receipts omitted the spread amount and the exchange used to calculate the spread. Maintained an AML program DFPI viewed as insufficient for kiosk risks. The operator did not maintain an effective anti-money laundering program with controls commensurate with its kiosk activity, including customer identification related controls, in violation of the Bank Secrecy Act. Under the consent order, the operator agreed to stop engaging in digital financial asset business activity with California residents within 30 calendar days unless and until it obtains a license from DFPI.

The order also imposes a $1,000,000 administrative penalty that becomes due and payable if the operator fails to comply with the consent order’s requirements. Putting It Into Practice: DFPI’s crypto kiosk enforcement posture continues to emphasize transaction caps, fee limits, and transaction-level disclosures for cash-to-crypto activity. Kiosk operators should validate California-specific controls for daily limit logic, fee and spread calculations, disclosure delivery at the point of sale, receipt fields, and escalation processes for suspected fraud, including scams affecting older adults.