The California Department of Financial Protection and Innovation (DFPI) has issued a Consent Order against RockItCoin, LLC, one of the largest Bitcoin ATM operators in the United States, for violations of California's Digital Financial Assets Law (DFAL) at its approximately 307 kiosk locations in the state.
The order, dated January 13, 2026, requires RockItCoin to pay $202,814.22 in restitution to overcharged California consumers and a $75,000 administrative penalty—totaling over $277,000 in financial obligations.
Case Information
Three Violations of California's Digital Financial Assets Law
The DFPI's investigation found RockItCoin violated three separate provisions of the DFAL, which took effect January 1, 2024:
Violations Found:
- Section 3902 — Daily Transaction Limit: RockItCoin allowed individual California customers to exceed the $1,000 per-day transaction limit on multiple occasions
- Section 3904 — Fee Cap: RockItCoin charged fees exceeding the DFAL's cap of 15% (or $5, whichever is greater), resulting in approximately $202,814.22 in aggregate overcharges from January 1 through August 4, 2025
- Section 3905 — Receipt Requirements: Receipts issued to customers did not include all information required by law
RockItCoin's Explanation
According to the consent order, RockItCoin attributed the daily limit violations to several technical issues rather than deliberate non-compliance:
- Customers creating multiple login accounts that were not initially detected
- Customers transacting at multiple kiosks during a software transition period
- Transactions interrupted by internet connectivity issues
- Undefined system errors
Regarding the fee overcharges, RockItCoin stated it had relied in good faith on a mathematical model to calculate transaction fees, but the calculation was incorrect. The company represents that it has since corrected the fee calculation issue at the DFPI's request and implemented software enhancements to address the daily limit violations.
Important context: RockItCoin entered the consent order without admitting or denying any of the findings, conclusions, or violations alleged. The company stated it entered the order to avoid the expense and uncertainty of further proceedings.
Penalties and Compliance Requirements
Financial Obligations
- Consumer restitution: $202,814.22 to be paid directly to affected California consumers through a DFPI-approved notification program. Consumers have 12 months to file claims.
- Administrative penalty: $75,000 payable to the DFPI
- No consumer waiver: Restitution payments may not be conditioned on consumers waiving any rights
Ongoing Compliance
- Desist and refrain: RockItCoin must stop accepting more than $1,000 per day from any customer and stop charging fees above the DFAL limits
- Reporting: Written compliance reports due every 60 days for one year, including California transactional data
- Policy changes: RockItCoin must implement revised policies and procedures to ensure ongoing DFAL compliance
Broader Regulatory Context
This consent order is the latest in a series of DFPI enforcement actions against Bitcoin ATM operators under California's Digital Financial Assets Law. The DFPI has previously issued Desist and Refrain Orders against Hermes Bitcoin and Coin Time for similar DFAL violations, with potential penalties reaching up to $497 million combined in those cases.
RockItCoin is also currently subject to a Civil Investigative Demand from the Missouri Attorney General as part of a broader investigation into Bitcoin ATM fee disclosure practices and fraud facilitation.
The enforcement action references an August 4, 2025 notice from FinCEN (the U.S. Treasury's Financial Crimes Enforcement Network) urging cryptocurrency kiosk operators to be vigilant in identifying and reporting suspicious activity, recognizing that kiosks can be exploited by scammers.
California's Evolving Regulatory Framework
California's DFAL, which became operative on January 1, 2024, imposes several requirements on Bitcoin ATM operators including the $1,000 daily transaction limit, a 15% fee cap, and detailed receipt requirements. The state's DFAL licensing requirement is set to take effect on July 1, 2026, which will add an additional layer of regulatory oversight for kiosk operators.
Scale of RockItCoin's California Operations
The consent order reveals the scale of RockItCoin's presence in California: approximately 307 kiosks that have processed over 83,000 digital financial asset transactions since January 1, 2024. RockItCoin, LLC is a foreign limited liability company headquartered in Chicago, Illinois, and is one of the largest Bitcoin ATM networks in the country with over 2,500 locations across 47 states.
What This Means for RockItCoin Customers
If You Used a RockItCoin Kiosk in California:
- California consumers who were overcharged between January 1 and August 4, 2025 may be entitled to restitution
- RockItCoin will contact eligible consumers through a DFPI-approved notification program
- Consumers will have 12 months from the start of the restitution period to file claims
- RockItCoin states it has already corrected the fee calculation issue
Consumers with questions about the DFPI's enforcement actions can contact the agency's Consumer Services Office at 1-866-275-2677.