California Crypto Guidance: DFPI Licensing, Custody, and Scams

California crypto regulations center on the Digital Financial Assets Law (DFAL), which requires most companies that exchange, transfer, store, or administer cryptocurrency for California residents to hold a license from the Department of Financial Protection and Innovation (DFPI) by July 1, 2026. The same law imposes custody standards, mandatory disclosures, and specific limits on crypto kiosks. For consumers, it means licensed platforms have to keep your assets segregated, tell you what you’re paying, and warn you that crypto isn’t covered by federal deposit insurance.

What Crypto Activity the Law Covers

A “digital financial asset” under California law is a digital representation of value used as a medium of exchange, a unit of account, or a store of value that is not legal tender. Bitcoin, Ethereum, stablecoins, and most exchange-traded tokens fall inside that definition.¹

Two things are carved out. Rewards or loyalty points redeemable only with the merchant that issued them don’t count. Neither do in-game currencies, as long as they stay inside games from the same publisher or on the same platform.² Assets already regulated as securities under federal or state law are also excluded, so a token the SEC treats as a security stays under securities law rather than DFAL.

Who Needs a DFPI License

Any company that exchanges, transfers, stores, or administers digital financial assets for California residents needs a DFAL license. So does any company that simply holds itself out as able to do those things, even before completing a single transaction.³

The compliance deadline is July 1, 2026. The original law set that date one year earlier, but Governor Newsom signed AB 1934 in September 2024 to push it back and give businesses more time.¹ A company that files a complete application by the deadline can keep serving California residents while the DFPI reviews it.⁴

The financial bar is meaningful. The DFPI expects an initial tangible net worth of at least $100,000, plus a $500,000 surety bond from a surety company authorized in California. Both figures are starting points and can be adjusted during review based on the applicant’s size and risk.⁴

Exemptions

Financial Code section 3103 exempts certain banks and people who only supply connectivity software or computing power to decentralized networks, which covers miners and node operators. There’s also a small-business exemption: if you reasonably expect to earn less than $50,000 a year from activity that would otherwise require a license, you don’t need one.⁵

Penalties for Skipping the License

Operating without a required license can trigger civil penalties of up to $100,000 per day. A licensed company that materially violates the law faces up to $20,000 per day.⁶ Those are ceilings, not automatic assessments, but they give the DFPI real leverage.

What Licensed Platforms Owe Their Customers

The DFAL builds several concrete protections into how licensed companies handle your account.

Segregated Custody

A licensed company must maintain control over each type of digital financial asset in an amount at least equal to what it owes customers, at all times. Your crypto is held in trust for your benefit, not treated as company property. The law requires daily reconciliation of customer accounts, recordkeeping by asset type and customer, and a strict ban on commingling customer assets with the company’s operating funds.³

When crypto exchanges have collapsed elsewhere, customers often found their assets had been mixed with company funds and were effectively gone. California’s segregation rule is aimed squarely at preventing that.

Fee and Term Disclosures

Before you complete a transaction, a licensed company must tell you the terms, conditions, and all fees, including direct charges and any spread built into the exchange rate. The point is that you should know what you’re paying before you commit.

No Federal Insurance

Licensed companies also have to tell you plainly that your digital assets are not protected by FDIC deposit insurance or SIPC coverage. If a bank fails, FDIC insurance covers deposits up to $250,000. If a crypto exchange fails, no federal insurance stands behind your balance.¹

Rules for Crypto Kiosks

California treats crypto kiosks, the physical machines that take cash and dispense cryptocurrency, as a special case. Scammers have used them heavily, often instructing older adults to feed cash into a kiosk and send the crypto to a wallet the scammer controls.

Two rules apply to every operator in the state:

A kiosk operator cannot accept or dispense more than $1,000 from or to any single customer in a day. An industry group challenged this cap in court, and a judge upheld it as a valid consumer protection measure.⁷
As of January 1, 2025, an operator cannot charge more than the greater of $5 or 15% of the dollar value of the crypto in the transaction. On a $100 purchase, the maximum fee is $15; on a $20 purchase, the $5 floor applies.⁸

Operators must also give a receipt for every transaction showing the operator’s name and the name of the exchange used to set the price or spread.⁹

Enforcement Actions So Far

The DFPI has already moved against kiosk operators without waiting for the full licensing regime to take effect. In late 2025, the DFPI fined Coinhub (operating as LSGT Services, LLC) $675,000 for kiosks that accepted more than $1,000 per day from individual customers, charged fees above the statutory cap after January 2025, and failed to provide required pre-transaction disclosures and proper receipts. The order included $105,000 in restitution to overcharged consumers, credited against the total penalty.¹⁰

Earlier the same year, the DFPI fined Coinme $300,000 for allowing kiosks to accept more than $1,000 from customers with the same name on the same day and for printing receipts that omitted the name of the exchange used to set the spread. That order included $51,700 in restitution.¹¹

Both cases involved basic operational violations rather than complex financial misconduct, which suggests the DFPI is watching the fundamentals closely.

Scams the DFPI Warns About

The DFPI publishes regular alerts about scams targeting California consumers, and the same patterns keep repeating.

The most prominent is “pig butchering.” A scammer reaches you through a text message, dating app, or social media, then spends weeks or months building what feels like a real relationship before steering the conversation toward investing. They walk you through opening a crypto exchange account, buying cryptocurrency, and transferring it to a fraudulent platform that displays fake returns. When you try to withdraw, the platform demands more fees or disappears.¹²

Other patterns the DFPI tracks include advance-fee fraud (you’re told to pay upfront costs to “unlock” your earnings), romance scams built through social media, and impersonation scams in which someone claims to represent a legitimate exchange. Many of these end with the victim converting cash into crypto at a kiosk and sending it to a wallet controlled by the scammer.¹³

The DFPI also warns about a purely technical risk: if you lose your private keys or recovery phrase, no customer service line can help, and your assets are permanently inaccessible. It’s a different kind of risk from forgetting a bank password, and it catches people off guard.

You can search reported scams by company name, scam type, or keyword using the DFPI’s Crypto Scam Tracker before sending money to any unfamiliar platform.¹²

Verifying a License and Filing a Complaint

Before doing business with a crypto company, check whether it holds a California license using the DFPI’s searchable Regulated Entities List. You can search by business name and filter by license type. A company that claims to be licensed but doesn’t appear in the database should be treated as a red flag.¹⁴

If you believe a crypto business has treated you unfairly, overcharged you, or engaged in fraud, the DFPI takes complaints through its online portal. The form takes about five minutes and is the recommended method. You can also call the consumer line at (866) 275-2677.¹⁵ The DFPI uses complaints to guide investigations and enforcement.¹⁶

A Note on Federal Taxes

California’s rules govern the businesses that facilitate crypto transactions. Your federal tax obligations exist separately. The IRS treats digital assets as property, so every sale, exchange, or disposal can be a taxable event, and every taxpayer must answer the digital asset question on Form 1040 whether or not they own any.¹⁷ You must report all gains and losses whether or not you receive a Form 1099-DA, and that includes activity on decentralized platforms, staking income, and token swaps.¹⁸

1
Department of Financial Protection and Innovation. Digital Financial Assets
2
California Legislative Information. California Financial Code – Digital Financial Assets Definition
3
California Legislative Information. California Financial Code – Digital Financial Assets Law
4
Department of Financial Protection and Innovation. Digital Financial Assets Law – Preparing for Your Application
5
Department of Financial Protection and Innovation. Digital Financial Assets Law Frequently Asked Questions
6
Department of Financial Protection and Innovation. Index of Fees, Fines and Penalties
7
Department of Financial Protection and Innovation. Court Upholds Daily Transaction Limit for Crypto Kiosks
8
California Legislative Information. California Financial Code – Digital Financial Asset Transaction Kiosks
9
Department of Financial Protection and Innovation. Digital Financial Assets Law – Information for Kiosk Operators
10
Department of Financial Protection and Innovation. Consent Order – LSGT Services LLC dba Coinhub
11
Department of Financial Protection and Innovation. Consent Order – Coinme Inc
12
Department of Financial Protection and Innovation. Pig Butchering – How to Spot and Report the Scam
13
Department of Financial Protection and Innovation. Trends in Consumer Crypto Complaints
14
Department of Financial Protection and Innovation. Regulated Entities List
15
Department of Financial Protection and Innovation. Submit a Complaint
16
Department of Financial Protection and Innovation. How to File a Complaint with the DFPI
17
Internal Revenue Service. Determine How to Answer the Digital Asset Question
18
Internal Revenue Service. Reminders for Taxpayers About Digital Assets