California Orders Crypto ATM Operator CoinFlip to Repay More Than $4.8 Million to Scam Victims

California's Department of Financial Protection and Innovation (DFPI) has ordered CoinFlip, one of the largest cryptocurrency ATM operators in the state, to pay more than $4.8 million to California victims of fraud carried out through its kiosks. The regulator announced the order on 4 November 2026 and described it as an enforcement action that secures full compensation for the victims.

The same order requires CoinFlip to pay the DFPI more than $350,000 in fees that the regulator says were illegally charged to California consumers, and to immediately stop all unlawful, unfair, deceptive or abusive acts or practices. The DFPI said the company broke California's Digital Financial Assets Law (DFAL), the California Consumer Financial Protection Law (CCFPL) and federal anti-money laundering laws.

What the DFPI Found

According to the DFPI, CoinFlip describes itself as the world's largest network of cryptocurrency ATMs by transaction volume and runs roughly 500 kiosks across California. The machines are typically placed in grocery stores, gas stations and convenience stores and let customers buy cryptocurrency such as Bitcoin with cash. The regulator noted that these transactions are immediate, cannot be reversed and are hard for consumers to trace, which it said makes crypto ATMs prime tools for scammers, particularly when the targets are older adults.

The DFPI said its investigation found that, since 2021, CoinFlip failed to properly identify who was using its products and services, and failed to detect, prevent, report and mitigate suspicious activity in its systems. In the regulator's words, this enabled scammers to exploit kiosk users and drain their assets.

The department listed four specific breaches of the rules that apply to digital financial asset kiosks in California: accepting more than $1,000 in a single day from kiosk customers, charging excessive fees, failing to give consumers the required written disclosures before a transaction, and issuing kiosk receipts that lacked legally required information.

DFPI Commissioner KC Mohseni said the order was a notice to the crypto industry that protecting consumers is not optional and that robust anti-fraud and consumer-protection practices are a requirement of doing business in California. Business and Consumer Services Secretary Rohit Chopra said that, with no federal consumer protection in this area, California is stepping up to hold companies accountable.

The Kiosk Rules Behind the Order

The kiosk obligations come from Chapter 9 of the Digital Financial Assets Law, which is Division 1.25 of the California Financial Code. The law was enacted in October 2023 through Assembly Bill 39 and Senate Bill 401. Section 3902 states that an operator shall not accept or dispense more than $1,000 in a day from or to a customer via a digital financial asset transaction kiosk. According to the DFPI, that daily cap and the duty to give customers a receipt with specified information have applied since 1 January 2024. Since the same date, kiosk operators have also had to file with the DFPI a list of every kiosk location they own, operate or manage in the state.

From 1 January 2025, operators have had to give customers pre-transaction disclosures, and the law caps what they may collect in fees on a single transaction. The DFPI states that these kiosk dates were not changed by Assembly Bill 1934, the 2024 law that moved the general DFAL licensing date back by a year.

Under that general licensing regime, companies that exchange, store or transfer digital financial assets for California residents have needed a DFAL licence, or a completed licence application on file with the DFPI, since 1 July 2026. Kiosk operators are covered by the same licensing requirement. The 4 November order, announced after that licensing date, rests on the kiosk-specific consumer rules that were already in force before it.

Who Is Affected and What Comes Next

The order directly affects CoinFlip and its California customers who lost money to scams through its kiosks. The DFPI said the more than $4.8 million is to be paid to California victims; its announcement did not set out how individual victims will be identified or paid, so affected consumers should watch for further information from the DFPI. The regulator invites Californians who have been victims of scams or fraud to file a complaint with it and points consumers to its Crypto Scam Tracker.

For other kiosk operators, the order shows which kiosk rules the DFPI is enforcing in practice: the $1,000 daily limit per customer, fee limits, pre-transaction disclosures and complete receipts, alongside customer identification and suspicious-activity controls under anti-money laundering law. The DFPI said the action is the latest in a series against crypto kiosk operators, after it shut down Hermes Bitcoin and fined RockItCoin, Coinme, Inc. and Coinhub.

For crypto firms more broadly, the case confirms that the DFPI is using both the Digital Financial Assets Law and the California Consumer Financial Protection Law against crypto businesses that serve California residents. Firms that operate in the state without a DFAL licence or a pending application, or whose consumer-protection controls fall short of the law, face the same tools. At the time of writing, the order document itself had not yet appeared in the DFPI's published monthly summaries of actions and orders, which ran to September 2026, so this report relies on the DFPI's press release and its official DFAL guidance.