Washington's Department of Financial Institutions wants to strip CoinFlip of its money transmitter license, bar both the company and its chief executive from Washington's licensed money services industry for ten years, and collect a $1,029,600 fine — in a Statement of Charges that alleges the operator ran Washington kiosks for two years without the age-based limits it already applied to its own over-the-counter desk, while more than half of its Washington business came from customers aged 60 or older. The charges, dated August 26, 2026 and announced September 3, name GPD Holdings LLC, the licensed entity behind the CoinFlip brand, and Benjamin Weiss, its CEO and the "Responsible Individual" on its Washington license.
The action is the second time in under three months that Washington has moved against one of the country's largest kiosk operators' authority to exist in the state, rather than settling for a fine. In June, DFI sought to revoke Bitcoin Depot's license and personally fine founder Brandon Mintz $1.5 million. By our count, CoinFlip now runs more Washington kiosks than any other operator we track: our location database lists 111 active CoinFlip machines in the state, against 58 for Bitstop and 41 for RockItCoin. The headline fine is also not the largest number in the document: the proposed order would require CoinFlip to refund fees and markup to every Washington customer aged 60 or older since September 1, 2023, an exposure that, by our estimate below, likely exceeds the fine itself. One correction to how this story has circulated: Washington has not yet banned anything. A Statement of Charges is a notice of intent. CoinFlip and Weiss have the right to contest every element at an administrative hearing, and nothing in the document is a finding until an order is entered.
Case: In the Matter of GPD Holdings LLC (NMLS #1975146) and Benjamin Weiss (NMLS #1982729)
Agency: Washington Department of Financial Institutions, Division of Consumer Services
Case Number: C-26-4341-26-SC01
Issued: August 26, 2026 (announced September 3, 2026)
Signed by: Brian J. Guerard, Acting Director, Division of Consumer Services
Legal Basis: Uniform Money Services Act, chapter 19.230 RCW; chapter 208-690 WAC; Bank Secrecy Act rules at 31 C.F.R. Parts 1010 and 1022
Source: Statement of Charges (PDF) · DFI press release
"State regulators' examination work is critical, and DFI will take action to address problems when companies fail to meet compliance expectations," DFI Director Charlie Clark said in the agency's announcement. Neither CoinFlip nor Weiss had publicly responded to the Washington charges as of publication, and DFI has not said whether a hearing has been requested. In a separate case, the company called Missouri's May 2026 lawsuit against it "meritless," and in two Texas consent orders it neither admitted nor denied the state's findings. We will update this story if CoinFlip responds or requests a hearing.
What the State Is Asking For
The document is titled a Statement of Charges and Notice of Intent to Enter an Order to Revoke License, Prohibit From Industry, Require Affirmative Actions, Impose Fine, Collect Investigation Fee, and Recover Costs and Expenses. That title is the remedy list. Section IV spells out what the Director intends to order unless the respondents contest it:
- Revocation of GPD Holdings' money transmitter and currency exchanger license, which the company has held since January 28, 2021.
- Ten-year prohibition barring GPD Holdings, and separately barring Weiss, from participating in the affairs of any money transmitter, currency exchanger, or authorized delegate licensed by Washington.
- A customer audit. CoinFlip would have to audit every existing Washington customer and prove to DFI that each one meets Know-Your-Customer and Enhanced Due Diligence requirements, "regardless of the Washington customer's tier."
- Refunds reaching back to September 1, 2023, structured in four tiers (detailed below).
- The $1,029,600 fine, a $3,837 investigation fee, and the state's prosecution costs, to be set at hearing or by declaration if the respondents default.
- Recordkeeping orders requiring CoinFlip to disclose where its books are kept and who is responsible for them.
The refund structure is unusually detailed for a notice of intent, and it is where the elder-protection theory turns into money. For Washington transactions from September 1, 2023 to the present, customers listed on a confidential Attachment A, which DFI has not described publicly, would receive the full transaction amount plus all fees and markup. Customers who were 60 or older at the time of each transaction would receive all fees and markup. All other customers who passed KYC and Enhanced Due Diligence would receive their fees back. Fees paid by customers who never completed KYC would go to the Washington Department of Revenue as unclaimed property. Each refund check would have to be mailed with tracking and a letter stating that, "Following an order from the Washington State Department of Financial Institutions it has been determined that you are entitled to a refund," and CoinFlip would owe DFI copies of the checks and proof of receipt.
Why the Refunds, Not the Fine, Are the Bigger Number
DFI's press release says the $1,029,600 fine "is significant due to the high number and nature of the alleged violations that harmed Washington seniors the most." It is significant. But the refund order stacked on top of it reaches into every senior transaction CoinFlip processed in Washington for three years, and DFI's own figure that more than 50% of the company's Washington business came from seniors means the refund pool is more than half of everything the kiosks earned in the state during the window.
CoinFlip is private and does not disclose per-kiosk volume, so the exact figure is known only to DFI and the company. A public proxy exists: Bitcoin Depot, which records kiosk sales as gross revenue, reported full-year 2025 revenue of $614.9 million across roughly 8,665 machines, or about $71,000 in cash taken per kiosk per year. Applying that rate to CoinFlip's Washington network — 111 active machines today, 129 including machines our database has recorded as removed — gives a rough sense of scale:
Bitcoin ATM News estimate of the refund exposure (assumptions stated):
- Volume: 111 to 129 kiosks × about $71,000 per kiosk per year × 3 years (September 2023 to September 2026) ≈ $23.6 million to $27.5 million in cash deposited.
- Fees and markup: Iowa alleges CoinFlip's effective charge is roughly 21% and Missouri alleges up to 21.9%. At 21%, that volume implies about $5 million to $5.8 million in fees and markup collected in Washington over the window.
- Senior tier: With more than 50% of business from customers 60 and older, the fees-and-markup refund owed to seniors alone would be at least $2.5 million, or more than twice the fine.
- On top of that: fee refunds to every other customer who passed KYC, and full transaction amounts plus fees and markup to the victims listed on Attachment A, whose number and losses DFI has not disclosed.
These are estimates, not findings. Bitcoin Depot's per-kiosk volume may run higher or lower than CoinFlip's in Washington, kiosk counts moved during the window, and CoinFlip's actual markup is exactly what the fee-disclosure allegations say customers could not see. But the direction is clear: even at half the proxy volume, the refund order would rival the fine, and the refund order is not capped by statute the way the civil penalty is. For a company that has already lost Tennessee and is litigating in Iowa and Missouri, the Washington filing prices in years of revenue, not just a penalty.
The Core Claim: Age Limits at the Counter, None at the Kiosk
Section 1.3 of the document is a single paragraph, and it is the sentence the rest of the case is built around. Between about September 6, 2023 and September 30, 2025, DFI alleges, CoinFlip "engaged in an unfair and deceptive act or practice by not having or implementing adequate controls to protect elderly customers. For example, Respondents have age-related lifetime thresholds for over-the-counter transactions, but not for transactions using Respondents' kiosks."
Why this detail matters: The allegation is not that CoinFlip lacked an elder-protection control. It is that the company had one — a lifetime, age-based threshold — and applied it only to its over-the-counter channel, where a human handles the transaction, while leaving the unattended kiosk channel without it. If DFI can prove that, the state's theory is that the company's own policy shows it understood the risk and chose where to mitigate it. CoinFlip has not yet answered the allegation.
DFI's press release supplies the context the order does not: more than half of CoinFlip's Washington business involved customers 60 and older, which the agency says made the business model itself a heightened scam risk for seniors. The public data on kiosk fraud points the same way, with a caveat. The FBI's Internet Crime Complaint Center logged 391 cryptocurrency kiosk complaints from Washington residents in 2025, with $8.3 million in adjusted losses, out of 13,460 complaints and $389 million nationally. Victims 60 and older accounted for $257.4 million of the national figure. Those figures cover complaints involving kiosks run by every operator, not CoinFlip alone, and the FBI notes that a complaint classified as kiosk-related can also include losses through other payment methods.
A Repeat Anti-Money-Laundering Finding
The second pillar of the case is the AML program, and DFI is explicit that this is not the first time it has raised the issue: the alleged deficiencies were "a repeat violation from an examination the Department conducted in 2023." A first-exam AML finding usually produces a remediation plan. A repeat finding two years later is how a regulator justifies revocation instead of another plan. The charges list eight specific failures for the September 2023 to September 2025 window:
Fees: What the Website Said Versus What Customers Paid
Washington also charges CoinFlip with deceptive statements about fees, on two fronts. One is disclosure design. DFI alleges that transaction fees "were not disclosed in a clear and conspicuous manner and were commingled with other disclosures," and that fees "were not clearly labeled because customers had to subtract the market rate from the effective rate to determine the transaction fee." That is a precise description of the spread-based pricing model: the customer sees an exchange rate, not a fee, and can only compute what they paid by knowing the spot price.
The other is a flat misstatement. Paragraph 1.17 alleges that between September 2023 and September 2025 CoinFlip's website said network fees for kiosk transactions were $2.49 to $2.99 per transaction, "when the fees were actually $0.00 to $5.99 per transaction." That same network fee is at the center of Missouri's lawsuit, which alleges CoinFlip concealed markups of up to 21.9% behind a prominently displayed $2.99 "Network Fee", and of Iowa's, which alleges hidden fees of roughly 21%. Iowa and Missouri sued under consumer-protection statutes. Washington has attached the same pricing display to a proposed license revocation.
What DFI Says CoinFlip Failed to Report
A third cluster of the state's claims concerns candor with the regulator itself. Washington licensees must report material changes to DFI and report adverse actions through NMLS, the multistate licensing system, within deadlines set by RCW 19.230.150 and WAC 208-690-110 that vary by the type of event. The charges describe the material-change window as 30 business days. DFI says CoinFlip missed both kinds of report repeatedly:
- Bank accounts. A new business bank account opened around March 2, 2025 went unreported until June 26, 2026. A second account opened around April 25, 2025 still had "not [been] properly reported" as of the date of the charges.
- The 2023 data breach. CoinFlip's August 2023 breach — which exposed Social Security numbers and government IDs for roughly 36,646 customers nationally and produced a $475,000 class settlement — allegedly went unreported to Washington from August 8 to October 20, 2023, even though it involved Washington customers' data.
- Three adverse actions. A Minnesota Department of Commerce consent order (unreported from December 12, 2024 to February 6, 2025), the Iowa Attorney General's February 2025 lawsuit (unreported from February 27 to April 22, 2025), and an Illinois class action (unreported from November 7, 2023 until June 3, 2026 — more than two and a half years).
- Call reports and annual filings. Three 2024 quarterly Money Services Business Call Reports allegedly omitted volume from CoinFlip's Olliv app and misreported transmission liability figures; two more misclassified fiat liabilities; and the 2023 and 2024 annual assessment reports lacked a companywide average daily transmission liability.
- Permissible investments. Washington requires licensees to hold safe assets against outstanding customer obligations. DFI alleges CoinFlip's permissible-investment reports omitted the required liability calculation and counted holdings in "a hedge fund account held by an open-end management investment company not registered with the United States Securities and Exchange Commission."
- Surety bond. From July 3, 2023 to June 27, 2025, the company's bond was allegedly $20,000 to $30,000 below the required level.
- Refunds and records. CoinFlip allegedly had no refunds policy compliant with RCW 19.230.330(3), failed to timely refund at least 15 Washington customers, and had no adequate records-disposal policy.
The document also states that DFI's investigation "continues to date," which leaves room for the allegations to be amended.
Why Weiss Is Named Personally
As in the Bitcoin Depot case, Washington reaches the individual through a specific statutory hook rather than a veil-piercing theory. Under RCW 19.230.280, a licensee is liable for violations committed by its employees, and the designated Responsible Individual "may be subjected to administrative sanctions" for the licensee's violations. Weiss, per the charges, held that role "at all times relevant." Naming him to NMLS as the accountable person is what makes him a respondent.
There is one meaningful difference from the Bitcoin Depot filing. Washington directed that entire personal fine at Mintz alone; here the $1,029,600 fine is "joint and several" against GPD Holdings and Weiss together, meaning the state can collect the full amount from either. The ten-year industry prohibition, though, is proposed against Weiss individually, and a prohibition order follows the person. Weiss signed the February 2026 Texas consent order on CoinFlip's behalf; he is now personally exposed in Washington.
Where This Fits in CoinFlip's Record
The Washington charges land on a record of state actions against CoinFlip going back three years:
What Happens Next
The charges are entered under the state Administrative Procedure Act, chapter 34.05 RCW. CoinFlip and Weiss can file a written request for a hearing before an administrative law judge; if they do not, DFI can enter a default order imposing the proposed sanctions. A contested case would let CoinFlip test DFI's evidence — including the allegation that its OTC desk had age limits its kiosks lacked — on the record. Unlike Bitcoin Depot, whose kiosks were already offline and whose company was already in Chapter 11 when Washington charged it, CoinFlip would be defending a network that is still running.
The practical exposure is not small. CoinFlip's own location finder lists 118 Washington kiosks, and our database counts 111 active machines, concentrated in the Puget Sound corridor — Seattle, Tacoma, Federal Way, Kent, Auburn, Puyallup — with a smaller cluster in Vancouver and the Olympia area. Without a license, none of them could lawfully operate in the state. And because revocations and prohibition orders are reportable adverse actions in NMLS, a final order in Washington would become visible to every other state where CoinFlip holds a license — the same reporting obligation DFI says the company already missed three times.
What This Means for Washington Consumers
If you used a CoinFlip kiosk in Washington on or after September 1, 2023, the proposed order — if entered — would put you in one of four refund categories. Customers listed on DFI's confidential Attachment A would receive the transaction amount plus fees and markup. Customers who were 60 or older at the time of a transaction would receive fees and markup, but not the transaction amount itself. Other customers who completed KYC and Enhanced Due Diligence would receive fees. Fees paid by customers without verified KYC would go to the state as unclaimed property. Nothing has been ordered yet: this filing proposes the refunds but does not itself impose them. The separate refund failures DFI alleges under existing law, involving at least 15 customers, are a different obligation. What you can do now:
- Keep every kiosk receipt and, where possible, the wallet address and transaction ID. The refund tiers depend on your age at the time of each transaction and on whether you were identified as a victim.
- File a complaint with DFI if you lost money to a scam through a CoinFlip kiosk or were denied a refund. DFI's announcement points Washington consumers to its online complaint form for crypto kiosk issues, and the Consumer Services Division's enforcement unit can be reached at (360) 902-8703 or csenforcecomplaints@dfi.wa.gov. Attachment A is confidential, and neither the charges nor DFI's announcement explains how it was compiled or whether new complaints would add names to it.
- Watch for recovery scams. An announced refund program is a lure for fraudsters posing as regulators. DFI will not ask for a fee or a crypto deposit to process a refund. Review our consumer protection resources before responding to anyone claiming to help you recover funds.
Washington residents can also check which operators run kiosks near them on our Washington Bitcoin ATM directory.
What This Means for Operators
Three lessons in this filing apply well beyond CoinFlip.
- Channel parity on elder controls. If you maintain age-based limits, cooling-off periods, or lifetime caps for any channel, a regulator will ask why the unattended kiosk — the channel where scams actually happen — is exempt. The Washington charges treat that asymmetry as an unfair and deceptive practice in itself.
- Repeat exam findings escalate. DFI's 2023 examination produced AML findings; the 2025 examination found them unremediated. The distance between a remediation plan and a revocation notice was one exam cycle.
- Report the bad news yourself. DFI's charges list three unreported material changes and three unreported adverse actions, from new bank accounts to a data breach to out-of-state lawsuits. The deadlines under Washington's money services statute and rules differ by event type, and each missed report is an independent count that needs no proof of consumer harm.
Operators can review the full enforcement landscape on our operators directory, where trust grades are computed from public enforcement records. This story will be updated if CoinFlip requests a hearing, responds publicly, or if DFI enters an order.