California Crypto Guidance: DFPI Licensing, Kiosks, and Scams

California regulates cryptocurrency primarily through the Digital Financial Assets Law (DFAL), which Governor Newsom signed in October 2023. The law requires most crypto businesses that serve California residents to hold a license from the Department of Financial Protection and Innovation (DFPI) by July 1, 2026, and it sets specific consumer protections around custody, disclosures, kiosks, and enforcement. If you buy, sell, or hold crypto in the state, these California crypto regulations shape what the platforms you use are allowed to do, what they must tell you, and what you can do when something goes wrong.¹

What the Law Covers

California defines a “digital financial asset” as a digital representation of value used as a medium of exchange, unit of account, or store of value that is not legal tender. That sweeps in Bitcoin, Ethereum, stablecoins, and most tokens traded on exchanges.¹

A few things sit outside the definition. Merchant-specific loyalty points that can only be redeemed with the issuer don’t count. Neither do in-game currencies that stay within games from the same publisher or platform. Assets already regulated as securities under federal or state law are also excluded, so a token the SEC treats as a security falls under securities law rather than DFAL.²

Any company that exchanges, transfers, stores, or administers digital assets for California residents must hold a DFAL license from the DFPI. Just holding yourself out as able to do those activities triggers the requirement, even without a completed transaction.³ Companies that file a complete application by July 1, 2026 can keep serving California residents while the DFPI reviews it.⁴ Operating without a license can draw civil penalties of up to $100,000 per day; a licensed company that materially violates the law faces up to $20,000 per day.⁵

Protections You Get on a Licensed Platform

The DFAL layers in specific obligations that affect how your assets are held and what you have to be told before you transact.

Your Crypto Is Held in Trust

A licensed company must maintain control of each type of digital asset in an amount at least equal to what it owes its customers at all times. Customer assets are held in trust for your benefit, not treated as the company’s own property. The law requires daily reconciliation of customer accounts, recordkeeping by asset type and customer, and a strict prohibition on commingling customer assets with the company’s operating funds.³ This matters because collapses of crypto platforms in other jurisdictions have left customers discovering their assets had been mixed with company funds and were effectively gone.

Fees and Terms Up Front

Before you complete a transaction, a licensed company must disclose the terms, conditions, and all fees involved. That includes direct charges and any spread or markup built into the exchange rate. You should know what you’re paying before you commit.

No FDIC or SIPC Backstop

Licensed companies must also tell you plainly that your digital assets are not protected by FDIC deposit insurance or SIPC coverage.¹ If a bank fails, FDIC insurance covers deposits up to $250,000. If a crypto platform fails, no federal insurance backstop exists. The DFPI requires this disclosure because many consumers assume otherwise.

A related technical risk sits outside anyone’s regulation: if you lose your private keys or recovery phrase, there is no customer service line that can restore access. The assets are gone. That is a different kind of risk than forgetting a bank password, and it catches people off guard.

Crypto Kiosk Rules

California singles out crypto kiosks, the physical machines where you insert cash and receive cryptocurrency, for extra regulation. Kiosks have been disproportionately used in scam schemes, particularly against older adults instructed by fraudsters to deposit cash at the machines.

Two restrictions apply to every kiosk operator in the state:

An operator cannot accept or dispense more than $1,000 from or to any single customer in a day. An industry group challenged the limit, and a court upheld it as a valid consumer protection measure.⁶
As of January 1, 2025, an operator cannot charge more than the greater of $5 or 15% of the dollar value of the crypto in the transaction. On a $100 purchase, the ceiling is $15; on a $20 purchase, the $5 floor applies.⁷

Operators must give you a receipt for every transaction that includes the operator’s name and the name of the exchange used to set the price or spread.⁸

The DFPI has already issued six-figure consent orders against kiosk operators that exceeded the daily limit, charged above the fee cap, or printed receipts missing the required exchange information, with portions of the penalties returned to overcharged consumers as restitution.⁹¹⁰ If a kiosk tries to take more than $1,000 from you in a day or charges a fee above the cap, that is a reportable violation.

Scams the DFPI Warns About

The DFPI publishes regular alerts about scams targeting California consumers, and the same patterns keep appearing.

“Pig butchering” is the most prominent. A scammer contacts you through a text, dating app, or social media and spends weeks or months building what feels like a genuine relationship. The conversation eventually turns to investing, often with photos suggesting a wealthy lifestyle. The scammer walks you through opening a crypto account, buying cryptocurrency, and transferring it to a fraudulent platform that shows fake returns. When you try to withdraw, the platform demands more fees or disappears.¹¹

Other patterns the DFPI tracks include advance-fee fraud, where you’re told to pay upfront to “unlock” earnings; romance scams built through social media; and impersonation scams in which someone claims to represent a legitimate exchange. In many of these cases, the victim is directed to convert cash into crypto at a kiosk and send it to a wallet the scammer controls.¹²

The DFPI maintains a Crypto Scam Tracker you can search by company name, scam type, or keyword before sending money to an unfamiliar platform.¹¹

Checking a License and Filing a Complaint

Before giving money to a crypto company, check whether it holds a California license using the DFPI’s Regulated Entities List. You can search by business name and filter by license type. A company that claims to be licensed but does not appear in the database should be treated as a red flag.¹³

If a crypto business has treated you unfairly, overcharged you, or defrauded you, the DFPI takes complaints through its online portal. The form takes about five minutes and is the recommended route. You can also call the department’s toll-free consumer line at (866) 275-2677.¹⁴ The DFPI uses complaints to inform investigations and decide where to focus enforcement.¹⁵

Taxes Are a Separate Federal Matter

California’s rules govern the businesses that handle crypto in the state; they do not change your federal tax obligations. The IRS treats digital assets as property, so sales, exchanges, and other disposals can trigger taxable events, and every Form 1040 asks about digital asset activity regardless of whether you own any.¹⁶ You must report gains and losses whether or not you receive a Form 1099-DA from a broker, and the IRS warns against waiting for a form before reporting.¹⁷

1
Department of Financial Protection and Innovation. Digital Financial Assets
2
California Legislative Information. California Financial Code – Digital Financial Assets Definition
3
California Legislative Information. California Financial Code – Digital Financial Assets Law
4
Department of Financial Protection and Innovation. Digital Financial Assets Law – Preparing for Your Application
5
Department of Financial Protection and Innovation. Index of Fees, Fines and Penalties
6
Department of Financial Protection and Innovation. Court Upholds Daily Transaction Limit for Crypto Kiosks
7
California Legislative Information. California Financial Code – Digital Financial Asset Transaction Kiosks
8
Department of Financial Protection and Innovation. Digital Financial Assets Law – Information for Kiosk Operators
9
Department of Financial Protection and Innovation. Consent Order – LSGT Services LLC dba Coinhub
10
Department of Financial Protection and Innovation. Consent Order – Coinme Inc
11
Department of Financial Protection and Innovation. Pig Butchering – How to Spot and Report the Scam
12
Department of Financial Protection and Innovation. Trends in Consumer Crypto Complaints
13
Department of Financial Protection and Innovation. Regulated Entities List
14
Department of Financial Protection and Innovation. Submit a Complaint
15
Department of Financial Protection and Innovation. How to File a Complaint with the DFPI
16
Internal Revenue Service. Determine How to Answer the Digital Asset Question
17
Internal Revenue Service. Reminders for Taxpayers About Digital Assets