California Bitcoin ATM Regulations

Licensing Requirements

California regulates Bitcoin ATMs under the Digital Financial Assets Law (DFAL), enacted as SB 401 in 2023 and codified for kiosk operators at Cal. Fin. Code §§ 3901-3907. The law is administered by the California Department of Financial Protection and Innovation (DFPI).

DFAL imposes obligations on kiosk operators in three phases:

• January 1, 2024 — $1,000 daily per-customer transaction cap (§ 3902); receipt-contents requirements (§ 3905(b)); mandatory submission of all California kiosk locations to DFPI, with updates required within 30 days of any change.
• January 1, 2025 — Fee cap at the greater of $5 or 15% of the USD transaction value (§ 3904); written pre-transaction disclosures covering asset amount, fees, and reference exchange price (§ 3905(a)).
• July 1, 2026 — Operators engaged in digital financial asset business activity through kiosks must hold a DFAL license from DFPI.

Under § 3907(b), operators who allow other parties to conduct digital-financial-asset transactions through their kiosks must ensure those parties hold the appropriate licenses and comply with DFAL.

The DFAL daily cap and fee cap are already in effect and actively enforced. In October 2025 the DFPI entered consent orders against Coinhub ($675,000 penalty plus $105,000 restitution) and RockItCoin (consent order) for DFAL violations, signaling that DFPI treats the statute's requirements as hard limits rather than guidance.

Transaction Limits

California imposes a $1,000 daily transaction limit per customer under Cal. Fin. Code § 3902, covering both cash accepted from and cash dispensed to a customer at a digital financial asset kiosk. The cap has been in effect since January 1, 2024.

Fee Caps

KYC & New Customer Rules

DFAL imposes specific disclosure and receipt requirements that operate in addition to federal KYC and BSA obligations.

Pre-transaction written disclosures (§ 3905(a)) — effective January 1, 2025: Before each transaction, operators must provide a clear and conspicuous written disclosure, in English and in the operator's primary advertising language, that includes:

• The amount of the digital financial asset involved in the transaction.
• All fees and charges the customer will pay, expressed in U.S. dollars.
• A comparison of the transaction price to the price the digital asset would have traded at on a licensed digital asset exchange.
• A warning that digital-asset transactions are generally non-reversible, where applicable.

Receipt contents (§ 3905(b)) — effective January 1, 2024: Each kiosk receipt must include the customer's name, date and time of the transaction, operator name, digital asset amount, USD amount, operator fees, the spread between the customer price and the licensed-exchange reference price, and the name of the exchange used for the reference price calculation.

Standard federal KYC, sanctions screening, and identity verification obligations continue to apply alongside these DFAL-specific rules.

Consumer Protection Resources

The California Department of Financial Protection and Innovation (DFPI) and the California Department of Justice are the primary public contacts for consumer complaints about Bitcoin ATM operators in California.

Consumers can start with DFPI or file a complaint at the DFPI's consumer portal. DFPI has already used DFAL to bring public enforcement actions — including the Coinhub and RockItCoin consent orders — and continues to accept consumer complaints about kiosk operators.

• Verify operator licensing through DFPI or NMLS before sending funds through a kiosk.
• Retain receipts (required to include customer name, operator name, fees, and spread under § 3905(b)) if you believe a transfer was induced by a scam.
• If you were charged more than the $5 or 15% fee cap or asked to transact above the $1,000 daily limit, document the transaction — these are direct DFAL violations.
• California regulators continue to warn residents about impersonation, investment, and cryptocurrency fraud, including government-impersonation schemes that use Bitcoin ATMs.

Federal Requirements

DFAL layers California kiosk-specific requirements on top of — not in place of — federal AML, sanctions, SAR, and consumer-risk obligations for cash-to-crypto businesses.

• Register with FinCEN as a money services business when required by federal law.
• Maintain a written anti-money-laundering program, designate a compliance officer, and train kiosk support staff.
• Use customer identification, sanctions screening, and scam-escalation procedures sized to transaction risk.
• File Suspicious Activity Reports and Currency Transaction Reports when thresholds or facts require them.

Legislative Reference

California's kiosk framework is codified at Cal. Fin. Code §§ 3901-3907 (Digital Financial Asset Kiosks) within the broader Digital Financial Assets Law. DFAL was enacted by SB 401 (2023), signed by Governor Newsom, and subsequently amended (including licensing-effective-date adjustments) that set the kiosk licensing deadline at July 1, 2026.

Primary regulator: California Department of Financial Protection and Innovation (DFPI).

Official source: DFPI — Digital Financial Assets Law: Information for Kiosk Operators.