California's Digital Financial Assets Law (DFAL) took full effect on July 1, 2026, imposing the most expansive state-level crypto licensing regime in the United States. Every exchange, custodian, stablecoin issuer, and Bitcoin ATM operator serving California residents must now hold a valid licens...
"This enforcement action should send a strong message to kiosk operators that California means business when it requires digital asset companies to follow the rules that help prevent scammers from taking advantage of unsuspecting Californians." — KC Mohseni, Commissioner, California Department of Financial Protection and Innovation
California's Digital Financial Assets Law (DFAL) took full effect on July 1, 2026, imposing the most expansive state-level crypto licensing regime in the United States. Every exchange, custodian, stablecoin issuer, and Bitcoin ATM operator serving California residents must now hold a valid license from the Department of Financial Protection and Innovation (DFPI) — or have filed a complete application through the Nationwide Multistate Licensing System (NMLS) — or face civil penalties of up to $100,000 per day.
The law covers a state that is home to approximately 25% of U.S. blockchain firms and constitutes the world's fourth-largest economy. The regulatory apparatus includes a $7,500 application fee, a minimum tangible net worth requirement of $100,000, a surety bond starting at $500,000, and mandatory compliance with NIST Cybersecurity Framework 2.0 standards. Over 5,000 crypto kiosks operate in California, all now subject to a $1,000-per-customer-per-day transaction limit and a fee cap of $5 or 15% per transaction, whichever is greater. The DFPI has already executed its first enforcement action under the law — a $300,000 consent order against kiosk operator Coinme Inc. — and the broader regulatory pressure has contributed to the Chapter 11 bankruptcy of Bitcoin Depot, once North America's largest Bitcoin ATM network with 9,276 kiosks.
Governor Gavin Newsom signed the Digital Financial Assets Law (AB 39 and SB 401) on October 13, 2023. Assembly Bill 1934, signed on September 29, 2024, extended the licensing deadline from July 1, 2025 to July 1, 2026. The DFPI began accepting applications through the NMLS on March 9, 2026, giving firms a roughly 16-week window to file.
DFAL's covered activities are deliberately broad:
The law defines "digital financial assets" as digital representations of value that function as a medium of exchange, unit of account, or store of value. Bitcoin ATM kiosk operation falls squarely within scope.
The residency definition is similarly expansive. A "California resident" includes any person domiciled in the state, physically present for 183 or more days annually, operating a business in California, or acting as a legal representative of a California domiciliary. This effectively requires any platform with U.S. exposure to either geo-fence California or comply.
Exemptions apply to FDIC-insured banks and credit unions, SEC-registered broker-dealers acting in a regulated capacity, pure technology providers, government entities, and individuals or merchants conducting personal crypto transactions. Transactions under $50,000 annually also qualify for exemption.
The DFAL licensing regime imposes costs that are material for smaller operators:
| Requirement | Amount / Standard | |---|---| | Application fee | $7,500 + DFPI review costs | | Minimum tangible net worth | $100,000 (adjustable by risk profile) | | Surety bond | $500,000 (adjustable by volume and asset mix) | | AML/CFT program | BSA-aligned, with designated AML officer | | Cybersecurity standard | NIST Cybersecurity Framework 2.0 | | Record retention | 5 years minimum (KYC, transactions, complaints) | | Independent audit | Required for AML/BSA compliance |
The DFPI has signaled that tangible net worth and surety bond amounts may be adjusted upward based on the applicant's risk profile, activity volume, and the types of digital assets handled.
Stablecoin issuers face additional requirements. Under DFAL, licensees can only exchange, transfer, or store a stablecoin if the issuer is either licensed under DFAL or is a regulated bank or trust company, and the issuer fully backs the stablecoin with eligible securities whose aggregate market value equals or exceeds the total outstanding issuance at all times. This effectively bars any unlicensed, under-collateralized stablecoin from the California market.
SB 401, the kiosk-specific component of DFAL, took partial effect on January 1, 2024, well before the full licensing deadline. Two provisions became immediately operative:
These provisions were enacted in direct response to surging fraud losses. According to the FBI's Internet Crime Complaint Center, cryptocurrency kiosks were used in scams that produced over $388 million in reported losses in 2025, with more than 13,400 complaints filed. Among victims whose age was recorded, individuals aged 60 and older accounted for 86% of dollar losses, with over $302 million attributed to that demographic.
California's legislature has cited the $1,000 daily limit as a model for national consumer protections. Commissioner KC Mohseni, appointed by Governor Newsom on February 7, 2025 as the DFPI's third commissioner, noted in a December 2025 address to the California Lawyers Association that crypto kiosk oversight is a top priority. According to DFPI data, over 5,000 crypto kiosks operate in California, primarily in convenience stores and grocery stores.
In 2026, the regulatory pressure extended beyond California. Indiana became the first U.S. state to ban crypto ATMs entirely. Massachusetts and Iowa attorneys general have filed lawsuits against major kiosk operators.
The DFPI's first enforcement action under DFAL targeted Coinme Inc., a kiosk operator with machines in grocery and convenience stores across the state. On June 25, 2025, the DFPI entered a consent order after finding that Coinme had:
The order imposed a $300,000 penalty, including $51,700 in restitution to California residents — specifically an elderly consumer who was a scam victim, according to reporting by ABC7 News. Coinme waived its rights to hearings and appeals under the consent order.
The DFPI also penalized Nexo for risky crypto-backed lending practices, levying a separate $500,000 fine. Together, these actions establish a clear precedent: the DFPI intends to use its enforcement authority actively, not passively.
The penalty structure for unlicensed operation — up to $100,000 per day — is designed to be coercive. The DFPI can also freeze operations, pursue restitution, and shut down platforms that fail to comply.
The regulatory crackdown's most visible casualty is Bitcoin Depot Inc. (NASDAQ: BTM), which on May 18, 2026 filed for Chapter 11 bankruptcy protection in the U.S. Bankruptcy Court for the Southern District of Texas. The company immediately deactivated its entire fleet of more than 9,000 machines across the U.S., Canada, and Australia.
At its peak, Bitcoin Depot operated 9,276 kiosks, making it North America's largest Bitcoin ATM network. Its financial trajectory in the quarters leading to bankruptcy was steep:
The company attributed its collapse to "increasingly stringent state regulations and enforcement" that made its business model unsustainable. It also faces lawsuits from the attorneys general of Massachusetts and Iowa alleging facilitation of crypto scams.
Bitcoin Depot's bankruptcy filing cited the wind-down as an "orderly, court-supervised process" to sell assets. The deactivation of nearly 10,000 kiosks overnight represents the single largest contraction in the U.S. crypto ATM industry's history.
DFAL operates in an uncertain federal environment. The GENIUS Act, signed into law in September 2025, provides federal preemption of state licensing for two categories of stablecoin issuers: federal qualified payment issuers and subsidiaries of insured depository institutions. However, it does not provide blanket preemption of state licensing for state-qualified issuers. According to reporting by DL News and analysis from Paul Hastings LLP, 22 states are challenging aspects of the GENIUS Act in court, arguing it infringes on state sovereignty.
The CLARITY Act, which would preempt state digital commodity registration requirements, was advanced by the Senate Banking Committee on May 14, 2026 by a 15-9 vote and placed on the Senate Legislative Calendar on June 1, 2026. If enacted, it could limit DFAL's applicability to digital assets classified as commodities. However, the bill still requires a 60-vote floor vote, reconciliation with the House version, and presidential signature.
The DFPI has signaled awareness of federal preemption risk. Commissioner Mohseni stated in December 2025 that the agency is "tracking federal enforcement downsizing and preemption risks" while maintaining confidence in its independent authority to protect California consumers.
For now, DFAL and federal law coexist. Firms operating in California must comply with both regimes simultaneously. Holding a license from another state — including New York's BitLicense — does not satisfy DFAL requirements.
The closest regulatory precedent is New York's BitLicense, introduced in 2015 by the New York Department of Financial Services. That regime triggered what the New York Business Journal called "the Great Bitcoin Exodus," as major platforms including Kraken and Bitfinex ceased operations in New York rather than comply.
California's DFAL differs in scope and timing. The state hosts roughly 25% of U.S. blockchain firms, making an exodus economically costlier for operators than leaving New York. According to Joe Ciccolo of the California Blockchain Advocacy Coalition, "Companies wanting California access may standardize compliance nationally rather than operate state-by-state." However, Ciccolo also warned that "marginal or under-resourced players may choose to exit California" and cautioned against "overly aggressive" enforcement that could push activity offshore.
The DFAL may also function as a de facto national standard. If a firm has invested in the compliance infrastructure required by California — BSA-aligned AML programs, NIST cybersecurity audits, surety bonds, and independent reviews — it is likely already positioned to meet or exceed most other state requirements. This creates a consolidation dynamic: large, well-capitalized operators absorb the compliance costs, while smaller firms are priced out.
DFAL is now live. As of July 1, 2026, any entity conducting digital asset business activity with California residents must be licensed or have an active application on file with the DFPI. Penalties for noncompliance reach $100,000 per day.
Over 5,000 crypto kiosks in California face the $1,000-per-day transaction limit and disclosure requirements. The DFPI's $300,000 consent order against Coinme sets the enforcement tone.
Bitcoin Depot's Chapter 11 filing removed nearly 10,000 kiosks from the market overnight. Revenue collapsed 49% year-over-year, and the company cited state regulation as the primary cause.
FBI data shows $388 million in crypto ATM scam losses in 2025 alone, with 86% of dollar losses borne by individuals aged 60 and older. These figures underpin the legislative rationale for DFAL's kiosk restrictions.
Federal preemption remains uncertain. The GENIUS Act preempts state law for certain stablecoin issuers, but the CLARITY Act has not yet passed. DFAL will remain in force unless explicitly overridden by federal legislation.
Compliance costs are non-trivial. The combination of a $7,500 application fee, $100,000 minimum net worth, $500,000 surety bond, and mandatory NIST cybersecurity audits creates a barrier to entry that favors established, well-capitalized operators.
California's DFAL represents the most aggressive state-level attempt to regulate the digital asset industry since New York's BitLicense. The law's breadth — covering exchanges, custodians, stablecoin issuers, and kiosk operators — combined with its enforcement teeth (up to $100,000 per day in penalties) sets a new baseline for state crypto regulation.
The immediate impact is measurable. Bitcoin Depot's bankruptcy has removed nearly 10,000 kiosks from the market. The Coinme consent order demonstrates the DFPI's willingness to enforce. The compliance requirements create structural advantages for large, institutionally backed operators over smaller firms.
Whether DFAL triggers a California exodus or becomes a national compliance standard depends on two variables: the pace of federal preemption through the CLARITY Act, and the DFPI's enforcement posture in the coming quarters. The economic incentives to remain in California — access to 25% of U.S. blockchain firms and the world's fourth-largest economy — are substantial. But for operators without the capital to absorb DFAL's compliance costs, those incentives may not be enough.