California’s Crypto Licensing Wall Hits Kiosk Operators Hardest

Bitcoin Depot, the largest crypto kiosk operator in the United States, pulled roughly a third of its machines out of California after the state capped how much cash a customer could feed into one in a day. That was the warm-up. On July 1, 2026, California’s Digital Financial Assets Law (DFAL, the state’s first comprehensive crypto licensing regime) takes full effect, and any firm serving California residents must hold a license, have a complete application on file, or qualify for a written exemption. For exchanges and custodians, that means a compliance project. For the cash-to-crypto kiosk business, it is closer to an extinction event.

The coverage so far has tracked the obvious players: the centralized exchanges and stablecoin issuers weighing whether to file or geofence. The party with the most to lose is quieter and far less liquid. Crypto kiosks, the machines that let unbanked and underbanked users swap physical cash for Bitcoin, were already bleeding under a separate set of rules. The licensing deadline is the second blow.

What AB 39 and SB 401 Put in Statute

DFAL is the combined work of two bills California passed in 2023 and amended in 2024. the AB 39 licensing statute on the California legislature site is the core regime, loosely modeled on New York’s BitLicense but with wider reach. It captures any digital financial asset business activity, which the statute defines as exchanging, transferring, or storing a digital asset for a California resident, plus issuing a stablecoin.

The companion bill, the SB 401 kiosk and disclosure statute, layers consumer rules on top. It is the one that matters most for the machines. SB 401 caps kiosk transactions at $1,000 per customer per day, limits operator fees to the greater of $5 or 15 percent of a transaction, and forces detailed receipts and refund obligations on operators when a customer reports a fraudulent transaction quickly.

Read together, the two laws form the most consumer-protective state crypto regime in the country. The kiosk caps have been live since January 1, 2024. The licensing wall arrives July 1, 2026. Operators have to clear both.

Who Has to File Before the Deadline

The trigger is the customer’s residency, not the firm’s address. A Singapore exchange serving California users is in scope. So is a US custodian, a payment processor, a staking-as-a-service provider, and every kiosk owner with a machine on a Los Angeles gas-station counter. The exemption list is deliberately short.

• Banks and credit unions with a state or federal charter, because they already answer to a primary regulator.
• SEC-registered broker-dealers, for activity inside the scope of that registration.
• Money transmission licensees under California’s existing Money Transmission Act, for activity that license already covers.
• Merchants that accept crypto only as payment for goods or services.

Everyone else needs a DFAL license or a complete application filed before July 1. The Department of Financial Protection and Innovation (DFPI, California’s financial regulator) began taking applications on March 9, 2026, through the Nationwide Multistate Licensing System (NMLS, the multi-state portal used for money-services licensing). The department’s published expectations include at least $100,000 in tangible net worth and a $500,000 surety bond, both adjustable upward during review based on a firm’s California volume and asset mix.

The Kiosk Operators Nobody Is Counting

The licensing fees are survivable for a billion-dollar exchange. They are existential for an industry whose core economics SB 401 already broke. And the public record on that damage runs through one company’s filings.

Bitcoin Depot’s Numbers Tell the Story

Bitcoin Depot, a publicly traded kiosk operator, blamed the California caps directly in its investor disclosures. According to the company’s second-quarter 2024 results filed with the SEC, revenue fell to $163.1 million, down 17 percent from $197.5 million a year earlier, with the decline tied to the law that took effect in January 2024. First-quarter revenue slid 15 percent on the same basis.

The physical retreat was sharper than the revenue dip. The company cut its kiosk footprint by 36 percent in 2024 and flagged plans to remove roughly another 30 percent later that year. Each machine pulled means a lost rental payment to the convenience store or laundromat that hosted it, which the company estimated in the hundreds of thousands of dollars.

• $1,000 is the hard daily ceiling per customer at any single or networked kiosk in California.
• 36 percent of Bitcoin Depot’s kiosk fleet came out of service in 2024 as the caps bit.
• $5 or 15 percent is the maximum fee an operator can charge on a transaction, whichever is greater.

Why the Math Stops Working

Kiosks are a cash-heavy, high-cost business. Operators pay armored cash pickup, retail rent, compliance staff, and the spread on converting fiat to crypto in seconds. A $1,000 ceiling caps the revenue ceiling, and a fee tied to 15 percent of that small transaction caps the margin. The customers who used kiosks for $3,000 or $5,000 buys are gone, and the small-ticket users who remain do not cover the fixed cost of a machine. Layer a DFAL license on top, with its bond, net-worth, and audited anti-money-laundering program, and the per-kiosk economics fall apart for any operator without national scale.

Enforcement the DFPI Can Bring to Bear

The reason none of this is theoretical is the enforcement framework behind the statute. The DFPI can issue subpoenas, run on-site examinations, demand books and records, order firms to stop, and assess civil penalties of up to $100,000 per violation per day, plus restitution for California users and referral to the attorney general for criminal matters.

It has also already won in court. The Alliance for the Fair Access to Cryptocurrency Terminals sued in January 2024 to block the kiosk caps. On September 4, 2024, the Superior Court for Los Angeles County upheld the $1,000 limit as a reasonable method of limiting fraud, according to the DFPI’s statement on the kiosk ruling.

The law’s common-sense restrictions, including a $1,000 daily limit at crypto kiosks, protect consumers from fraudulent transactions and limit the use of kiosks for illicit purposes.

That was DFPI Commissioner Clothilde Hewlett, framing the ruling in the agency’s release. The signal to operators is hard to miss. The regulator that wrote the caps has staffed up crypto-specialized examiners, defended its rules in court, and now holds the licensing switch for July 1.

DFAL Measured Against the New York BitLicense

The closest precedent is New York’s BitLicense, launched in June 2015. Within roughly 18 months of that regime going live, more than a dozen firms withdrew from New York or shut their US operations rather than absorb the cost, and a decade later only a few dozen firms hold an active BitLicense. California is structurally similar but commands a far larger market, which changes the exit math for big players while squeezing small ones just as hard.

What Stablecoin Issuers Now Face

The other group reading the statute closely is stablecoin issuers. DFAL requires any issuer marketing a stablecoin to California users to hold one-for-one reserves of cash and short-term Treasuries, publish monthly reserve attestations, and submit to DFPI examination. The rules echo the reserve logic of the federal GENIUS Act but add California-specific guardrails.

The practical effect is a de facto national floor. If an issuer meets California’s reserve and disclosure standard, it almost certainly clears every other state and the federal baseline, so the largest operators are likely to build to the California bar and apply it everywhere. For users holding those tokens, the upside is genuine: less counterparty risk on the dollars sitting in their wallets.

The DFPI has also kept authority to write further implementing rules through 2027, so the compliance bar is not fixed. The reserve and attestation requirements that look manageable now can tighten, and the agency has shown with kiosks that it will use the room the legislature gave it.

Frequently Asked Questions

Does DFAL apply to crypto kiosk operators?

Yes. Any operator that owns, manages, or controls a digital asset kiosk in California needs a DFAL license or a complete application on file by July 1, 2026, on top of the SB 401 caps that have applied since January 2024.

Can a firm keep serving California users while its application is pending?

Yes, but only if the application was filed before July 1, 2026, and is materially complete. The DFPI can revoke that safe harbor if it finds the application deficient, so a placeholder filing does not protect ongoing operations.

What does a DFAL application require financially?

The DFPI’s published expectations include at least $100,000 in tangible net worth and a $500,000 surety bond, both filed through NMLS and both subject to upward adjustment based on a firm’s projected California activity, asset mix, and liabilities.

Is there a cap on what crypto kiosks can charge?

Yes. SB 401 limits operator fees to the greater of $5 or 15 percent of the transaction value and caps daily volume at $1,000 per customer, the combination that pushed Bitcoin Depot to cut a large share of its California machines.

Which firms are exempt from DFAL?

Chartered banks and credit unions, SEC-registered broker-dealers acting within their registration, existing California money transmission licensees, and merchants accepting crypto only as payment are exempt for that covered activity. Most other intermediaries are not.

July 1 is when California stops being an open market for digital assets and becomes a licensed one. The exchanges will file, the stablecoin issuers will build to the new floor, and the first DFPI examination reports due in the August window will set the bar for everyone. The kiosk operators are the ones to watch, because their machines were already disappearing before the licensing clock even started.

Disclaimer: This article is for informational purposes only and does not constitute financial, investment, or legal advice. Cryptocurrency activity and regulatory compliance carry substantial risk; consult a qualified attorney or compliance professional before acting. Figures are accurate as of publication.