SEC crypto enforcement fell 60% year-over-year in 2025, with monetary penalties against digital-asset participants dropping to $142 million — less than 3% of 2024's total. The agency dismissed seven active enforcement cases in early 2025, including actions against Coinbase, Binance, and Consensys...
"This enforcement action should send a strong message to kiosk operators that California means business when it requires digital asset companies to follow the rules that help prevent scammers from taking advantage of unsuspecting Californians." — KC Mohseni, Commissioner, California Department of Financial Protection and Innovation
SEC crypto enforcement fell 60% year-over-year in 2025, with monetary penalties against digital-asset participants dropping to $142 million — less than 3% of 2024's total. The agency dismissed seven active enforcement cases in early 2025, including actions against Coinbase, Binance, and Consensys, and requested a 17% staffing cut for its Enforcement Division in FY 2026. Total SEC enforcement actions hit a 16-year low in the first half of FY 2026, with just 92 new filings versus a historical average of 225.
The result is an accelerating shift of regulatory authority to state capitals. California's Digital Financial Assets Law (DFAL) took effect July 1, 2026, imposing $100,000-per-day penalties on unlicensed crypto operators serving the state's 39 million residents. New York is considering the CRYPTO Act, which would criminalize unlicensed crypto activity with felony charges carrying 5-to-15-year prison terms. Eighteen states now classify unlicensed cryptocurrency transactions as criminal offenses, and 49 of 50 states require money transmitter licenses for crypto businesses.
This comparative analysis examines the emerging state enforcement patchwork, the compliance costs it imposes, and what it means for an industry that has operated under the assumption that federal rules would eventually provide a single framework.
The SEC reported 456 total enforcement actions in fiscal year 2025, the lowest count in at least 20 years and a 22% decline from the prior year. The agency's own leadership characterized the shift as a "course correction" away from registration-based enforcement toward fraud and market manipulation cases. In practice, this translated to a near-complete withdrawal from crypto-specific regulatory enforcement.
Seven enforcement actions brought against crypto firms were dismissed beginning in February 2025: SEC v. Coinbase, SEC v. Cumberland DRW, SEC v. Consensys Software, SEC v. Payward (Kraken), SEC v. Dragonchain, SEC v. Balina, and SEC v. Binance Holdings. The Enforcement Division's requested headcount for FY 2026 dropped to 1,178 full-time equivalents, down from 1,424 in FY 2024 — a 17% reduction.
In the first half of FY 2026, total new enforcement actions fell to 92, roughly 60% below the five-year historical average of 225 for the same period. According to analysis by Gibson Dunn, SEC Chair Paul Atkins's approach favors "tailored rules" and safe harbors over the enforcement-as-regulation strategy pursued by his predecessor.
State regulators read this as an invitation.
California's Digital Financial Assets Law — signed by Governor Gavin Newsom on October 13, 2023, and enforced beginning July 1, 2026 — creates a standalone licensing regime administered by the Department of Financial Protection and Innovation (DFPI). The law covers exchanges, custodians, stablecoin issuers, transfer services, and Bitcoin ATM operators.
Scope: Any entity conducting "digital financial asset business activity" with or on behalf of a California resident must hold a DFAL license, regardless of licensing status in other states. California's population of 39 million residents and its status as the world's fifth-largest economy by GDP make the DFAL's jurisdictional reach significant.
Penalties: Unlicensed operation carries civil penalties of up to $100,000 per day. This is in addition to cease-and-desist authority and the power to order consumer restitution.
Application window: The DFPI began accepting applications through the Nationwide Multistate Licensing System (NMLS) on March 9, 2026 — giving firms approximately 16 weeks to file before the July 1 deadline. A complete application was required by the deadline; placeholder filings did not satisfy the requirement.
Exemptions: Traditional banks, credit unions, SEC-registered securities firms, CFTC-registered entities, and merchants accepting crypto solely as payment for goods and services are exempt. Entities with annual California activity under $50,000 are also excluded.
Crypto kiosk rules: The DFAL imposes a $1,000 per-customer-per-day transaction limit on kiosk operators and caps fees at the greater of $5 or 15% of the transaction amount.
First enforcement action: On June 25, 2025, the DFPI entered a consent order with Coinme, Inc., a Seattle-based Bitcoin ATM operator, marking the first DFAL enforcement case. Coinme paid a $300,000 penalty — including $51,700 in restitution to an elderly California resident who was scammed into making deposits through the company's kiosks. Violations included exceeding the $1,000 daily transaction limit and failing to provide required disclosures on customer receipts.
Second enforcement action: In January 2026, the DFPI reached a $500,000 settlement with Nexo Capital for operating a crypto-backed lending program without state licensing. According to the consent order, Nexo's unlicensed activity affected 5,456 California residents over a four-year period from July 2018 through December 2022.
New York's BitLicense, established in 2015 by the Department of Financial Services, remains the most established state-level crypto licensing framework. Approximately 40 BitLicenses have been issued since the program's inception. Notable 2026 approvals include Mastercard Transaction Services, Galaxy (GalaxyOne Prime), and Strike (Zap Solutions).
The BitLicense framework has long been criticized for its compliance burden. When it launched in 2015, multiple crypto firms exited the state — an event widely described as the "Great Bitcoin Exodus."
Now, New York is escalating. On January 15, 2026, Manhattan District Attorney Alvin Bragg and State Senator Zellnor Myrie introduced the CRYPTO Act (Cryptocurrency Regulation Yields Protections, Trust, and Oversight Act). The bill would amend New York Financial Services Law to impose criminal penalties on unlicensed virtual currency business operators:
If passed, New York would become the 19th state to explicitly criminalize unlicensed crypto transactions. As of mid-2026, the CRYPTO Act has not advanced out of committee, and industry groups have objected to what they describe as vague, overbroad definitions. The bill's future remains uncertain.
The gap between California's civil-penalty model ($100,000/day fines) and New York's proposed criminal-penalty model (prison terms) illustrates the emerging divergence in state-level approaches.
The enforcement vacuum is not limited to California and New York. According to Whiteford, Taylor & Preston LLP, as of January 2026:
Texas passed S.B. 1705 in 2026, establishing licensing, transaction reporting, and fraud prevention requirements for virtual currency kiosks, mirroring California's DFAL kiosk provisions.
The state-level pattern is consistent: as federal agencies deprioritize registration enforcement, state regulators are expanding their own authority, building new licensing frameworks, and increasing penalties.
The multi-state licensing burden is substantial. According to data compiled from regulatory filings and legal analyses:
| Requirement | Range | |---|---| | Application fees | $375 – $15,000 per state | | Surety bonds | $10,000 – $7,000,000 per state | | Processing timelines | 3 – 24 months per state | | Minimum capital/liquidity (DFAL) | Set by DFPI on case-by-case basis | | Minimum surety bond (DFAL) | $500,000 or trust account equivalent | | Record retention | 5 years (DFAL) |
For a crypto firm operating nationally, the cost of obtaining and maintaining licenses across 49 states, each with its own fee schedules, bond requirements, examination cycles, and supervisory assessments, can run into millions of dollars annually. Holding a license in one state — including New York's BitLicense — does not satisfy another state's requirements. California's DFAL is explicitly a standalone regime; even existing California money transmitter licensees must apply separately.
This cost structure creates a structural advantage for large, well-capitalized firms — established exchanges, banks, and payment companies — over smaller startups and DeFi protocols.
The Conference of State Bank Supervisors (CSBS) has pushed the Money Transmission Modernization Act (MTMA) as a partial solution to regulatory fragmentation. As of mid-2026, 31 states have adopted the MTMA in full or in part, with legislation pending in Alaska, Louisiana, Maryland, Michigan, and Oklahoma.
The MTMA establishes uniform standards for net worth, surety bonds, and permissible investments. According to CSBS data, money transmitters licensed in at least one MTMA-adopting state collectively account for 99% of reported money transmission activity — suggesting broad industry coverage even without universal adoption.
However, the MTMA does not address crypto-specific licensing like California's DFAL or New York's BitLicense. It modernizes money transmitter rules but does not replace the bespoke crypto frameworks that states are now building independently. The result is a layered compliance environment: federal MSB registration (FinCEN), state MTL requirements (49 states), and state-specific digital asset licensing (California, New York, and increasingly others).
The state enforcement shift carries three measurable consequences:
1. Market consolidation. Compliance costs favor scaled incumbents. Coinbase, which holds licenses in all 50 states plus territories, can absorb the incremental cost of DFAL compliance. A seed-stage DeFi startup cannot. The licensing burden reinforces the trend toward market concentration already visible in the exchange and custody sectors.
2. Geographic arbitrage pressure. Just as the BitLicense triggered the 2015 "Great Bitcoin Exodus" from New York, the DFAL may push some operators to geo-fence California. However, California's economic weight — fifth-largest economy globally — makes exit more costly than it was for New York.
3. Federal preemption dynamics. The growing patchwork strengthens the argument for federal legislation. The SEC's three proposed crypto rules — targeting offerings, broker-dealer requirements, and market structure — are on the July 2026 agenda for Notice of Proposed Rulemaking. The GENIUS Act (stablecoin framework) and CLARITY Act (market structure) are both in legislative limbo. Until federal rules arrive, the state patchwork expands.
The 30% U.S. adult crypto ownership rate reported in 2026 — up from 27% in 2024 — means the population affected by this regulatory fragmentation is growing. Every new state framework adds compliance cost that is ultimately passed to consumers through fees, reduced service availability, or both.
The data shows a clear pattern: federal crypto enforcement is contracting while state enforcement is expanding. The SEC's withdrawal from registration-based actions has not produced a regulatory vacuum — it has produced 50 separate regulatory responses, each with its own scope, penalties, and compliance requirements.
California's DFAL is the most consequential new entrant, combining the jurisdictional reach of the world's fifth-largest economy with penalties severe enough to compel compliance. New York's proposed criminalization of unlicensed activity, if enacted, would add prison time to the enforcement toolkit. Texas continues building its administrative enforcement apparatus.
For the crypto industry, the economic calculus is straightforward: the cost of multi-state compliance is rising, the penalty for non-compliance is rising faster, and the prospect of a single federal framework that would preempt state rules remains speculative. Companies that can absorb these costs will consolidate market share. Companies that cannot will shrink their geographic footprint or exit.
The question is no longer whether crypto will be regulated. It is how many separate regulators will do it.