Compliance reference · Updated for 2026
2026 was the most consequential year for digital-asset rules in this state's history. Licensing went live on 1 July, penalties reach $100,000 a day, kiosk transactions are capped at $1,000 and kiosk fees at 15%. Here is the full three-layer stack — federal, state and local — and what each part means for you.
Licensing live from
1 Jul 2026
Unlicensed penalty
$100k/day
For most of the past decade, "is this legal in California?" had a fairly dull answer. Your counterparty needed to be registered federally with FinCEN as a money services business, run an anti-money-laundering program under the Bank Secrecy Act, and hold state money transmitter licenses where the activity required them. California, despite its size, had no digital-asset-specific licensing regime at all.
That has changed completely, and if you last looked at this in 2023 or 2024 your mental model is out of date in ways that matter. California now operates one of the more demanding state frameworks in the country, and it arrived in stages that are easy to confuse with each other.
This page is our attempt at a reference you can actually use — what each layer requires, when each provision took effect, which agency enforces it, and what any of it means if you are simply a person in Los Angeles trying to buy some Bitcoin without getting fleeced. Every claim links to a primary source so you can check it rather than trust us.
Structure
Any business converting your dollars into digital assets in Los Angeles sits under all three of these simultaneously. Confusing which layer a rule comes from is the most common mistake in crypto compliance commentary.
| Layer | Who enforces it | What it requires | Who it applies to |
|---|---|---|---|
| Federal | FinCEN, IRS, SEC, CFTC | Money services business registration, Bank Secrecy Act and AML programs, customer identification, suspicious activity reporting, tax reporting | Every business converting between dollars and digital assets, anywhere in the US |
| California — state | Department of Financial Protection and Innovation (DFPI) | Digital Financial Assets Law licensing, kiosk transaction and fee caps, location reporting, receipt and disclosure requirements, examination and enforcement | Any business conducting digital financial asset business activity with California residents |
| Los Angeles — local | City of Los Angeles, County of Los Angeles | Ordinary business tax registration, business permits, land-use and signage rules for host premises | Businesses physically operating here — but no crypto-specific local license |
This is a plain-English summary for consumers, not legal advice. Businesses should take advice from California-licensed counsel; the DFPI publishes its own guidance and frequently asked questions.
Chronology
The staged rollout is why so much published commentary contradicts itself. A provision that was not yet in force when an article was written may be in force now.
13 October 2023
Governor Newsom signs both bills, creating the Digital Financial Assets Law. AB 39 builds the licensing framework; SB 401 adds kiosk-specific consumer protections.
1 January 2024
The $1,000 per customer per day transaction limit takes effect, along with the obligation for operators to report every kiosk location to the DFPI, which publishes them.
1 January 2025
Operators may no longer collect more than the greater of $5 or 15% of transaction value from a single customer transaction. Pre-transaction disclosure and detailed receipt requirements begin.
9 March 2026
Applications open through the Nationwide Multistate Licensing System, giving covered businesses a window to file before the deadline.
1 July 2026
Covered businesses must hold a DFAL license, have a complete application on file, or qualify for a statutory exemption. Civil penalties of up to $100,000 per day become available against unlicensed activity.
State layer
The core obligation is straightforward to state and demanding to satisfy: a business engaged in digital financial asset business activity involving a California resident must be licensed by the Department of Financial Protection and Innovation, or have a complete application pending, or fall within a statutory exemption. The scope is deliberately broad — exchanges, custodial wallet providers, kiosk operators and businesses facilitating transactions all fall within it.
Because the DFPI is a supervisory agency rather than a registration desk, licensure brings the things supervision brings: examination, reporting, capital and bonding expectations, compliance-program requirements, and enforcement exposure. That is a meaningful step up from the pre-2026 position, where a crypto business could serve Californians on the strength of federal registration and a patchwork of money transmitter licenses.
The enforcement number is the part that changed behavior. Civil penalties of up to $100,000 per day against an unlicensed entity engaging in covered activity with the state's roughly 39 million residents is not a cost of doing business — it is an existential figure for anything short of a very large company. The practical consequence, which you may already have noticed, is that some smaller services quietly stopped accepting California addresses during 2026.
For consumers that narrowing is mostly good. It means the platforms still openly serving you have at minimum submitted to a supervisory process. It also means you should check before depositing rather than after, because "it worked last year" is no longer a reliable signal.
State layer
These are the provisions most likely to affect you directly, because they change what happens on the screen in front of you.
| Provision | What it says | In force from | Legislative purpose |
|---|---|---|---|
| Daily transaction limit | $1,000 per customer, per day, per operator | 1 January 2024 | Caps the size of a single fraud loss and deters bulk criminal use |
| Fee ceiling | The greater of $5 or 15% of the transaction value | 1 January 2025 | Limits the premium chargeable to cash-dependent customers |
| Pre-transaction disclosure | Fees and terms must be shown before the customer commits | 1 January 2025 | Prevents fee reveal after the amount is selected |
| Detailed receipt | Itemised receipt with specified transaction information | 1 January 2025 | Creates a cost-basis record and an evidence trail |
| Location reporting | Operators must report every kiosk location to the DFPI, which publishes them | 1 January 2024 | Makes the estate visible to regulators and the public |
| Licensing | A DFAL license, or a complete application on file | 1 July 2026 | Brings kiosk operators under ongoing supervision |
Summarised from the statute and DFPI guidance. The daily transaction limit was challenged and upheld by a California court. See our Bitcoin ATM guide for how these rules play out at individual machines.
This is the gap worth understanding, because it is where most of your cost actually lives. SB 401 caps the fee. It does not cap the exchange rate. An operator can charge you a perfectly compliant fee and still quote a Bitcoin price several percent away from the market, and that margin is invisible unless you check.
Which is why our standing advice at any kiosk is to ignore the fee line and read the quantity of crypto you will receive, then compare it against the market price on your phone. That single number captures every component of what you are paying. The fee disclosure is a legal requirement that tells you about part of your cost; the quantity tells you about all of it.
Federal layer
The state framework sits on top of federal obligations that have applied for years and have not gone anywhere.
A business exchanging dollars for digital assets is a money transmitter for federal purposes and must register with the Financial Crimes Enforcement Network as a money services business. Registration is renewable and the registrant list is public, which is what makes it verifiable by you.
FinCEN MSB registrationRegistered businesses must run a written anti-money-laundering program, identify customers, keep records, and file suspicious activity and currency transaction reports. This is why no compliant service in California can offer genuine anonymity, at a kiosk or anywhere else.
FinCENThe IRS treats digital assets as property, and broker reporting obligations for digital-asset transactions have tightened substantially. Assume every trade on a licensed US venue is visible to the IRS, and that California receives the same characterization of your gains.
IRS digital assetsWhether a particular token is a security or a commodity remains contested, and the answer determines whether the SEC or the CFTC has jurisdiction. For a retail buyer of major assets this rarely changes what you do, but it matters enormously for anyone offering yield, lending or investment products.
Investor.govLocal layer
Very little that is crypto-specific, and this surprises people who assume a city of this size must have its own regime. Neither the City of Los Angeles nor Los Angeles County operates a digital-asset licensing framework sitting above the state one. The DFAL is the operative regime.
What local government does require is the ordinary stuff any business needs. A crypto company with an office in Santa Monica or Century City needs city business tax registration like any other firm. A convenience store hosting a kiosk needs its usual permits, and the installation is subject to normal land-use, accessibility and signage rules. If a machine sits in a shopping center, the landlord's requirements apply. None of that is crypto regulation; it is retail regulation that happens to touch a crypto machine.
There is one practical consequence for consumers. Because access to a kiosk depends on the host business rather than the operator, the host's licensing and hours govern your ability to transact. A machine listed as available around the clock is available only while the shop is open — which is the second most common reason for a wasted trip after two-way confusion. Our locations guide covers that in practical detail.
For you
Federal AML obligations plus state licensing mean every compliant route requires identification. A kiosk phone-number tier is reduced friction, not anonymity — the operator still keeps records. Any service promising true anonymity is unlicensed or lying.
$1,000 per day and a fee ceiling of the greater of $5 or 15% are set by statute. An operator cannot make an exception for you, and a machine advertising higher daily limits is quoting rules from another state.
Operators must provide a detailed receipt. Take it, and photograph it before the thermal paper fades — it is your cost basis, and in California that matters because there is no preferential capital gains rate.
The field of platforms serving California narrowed during 2026. Three registers and three minutes will confirm any operator's standing. Do it once per platform, before your first deposit.
Supervision reduces conduct and counterparty risk. It does not insure your holdings, prevent platform failure or reverse a bad trade. Federal deposit insurance does not cover crypto.
None of the above affects your tax position. California taxes crypto gains as ordinary income up to 13.3% with no preferential rate — read our tax guide.
Do this once
You never have to take a compliance claim on trust — including ours. Every assertion on this page is checkable against a public register.
Registers worth bookmarking
State money transmitter licenses, searchable by entity
Federal money services business registration
DFAL licensing, published kiosk locations, enforcement
Whether an "adviser" is actually registered
California tax treatment and filing guidance
Questions we actually get
Yes. Buying, holding, selling and transferring cryptocurrency is legal for California residents. What is regulated is the business on the other side of your transaction. Since 1 July 2026, any company conducting digital financial asset business activity with Californians must hold a license from the Department of Financial Protection and Innovation under the Digital Financial Assets Law, or have a complete application on file, with civil penalties of up to $100,000 per day for operating without one.
The DFAL is the framework created by Assembly Bill 39 and Senate Bill 401, both signed on 13 October 2023. AB 39 established a licensing, supervisory and enforcement regime for digital financial asset business activity, administered by the DFPI. SB 401 added specific consumer protections for crypto kiosks. Its provisions phased in between January 2024 and July 2026, and it now applies broadly to exchanges, wallet providers, kiosk operators and transaction facilitators serving the state.
License applications opened through the Nationwide Multistate Licensing System on 9 March 2026, and the licensing requirement became effective on 1 July 2026. From that date, covered businesses needed either an issued license, a complete application on file, or a statutory exemption. The DFPI can pursue civil penalties of up to $100,000 per day against unlicensed entities engaging in covered activity with California residents.
$1,000 per customer per day per operator, under Senate Bill 401, in force since 1 January 2024. Fees are separately capped at the greater of $5 or 15% of the transaction value since 1 January 2025. A California court upheld the daily transaction limit after it was challenged. Operator marketing that advertises daily maximums of $25,000 or $50,000 is describing other states.
No crypto-specific ones. Neither the City of Los Angeles nor Los Angeles County operates a separate digital-asset licensing regime on top of the state framework. A crypto business operating here still needs the ordinary things any business needs — city business tax registration, applicable permits, and compliance with land-use and signage rules for any physical premises hosting a kiosk — but there is no LA-specific crypto license for either businesses or individuals.
Three registers, about three minutes. Find the operator's exact legal entity name on its own legal or licensing page — not the brand name. Search that entity on NMLS Consumer Access to see its state money transmitter licenses. Cross-check federal money services business registration on FinCEN's registrant list. Then check the DFPI's digital financial assets pages for California-specific licensing and enforcement information.
Not in the way deposit insurance protects a bank balance. A license means the operator is supervised, must maintain certain controls, and can be examined and sanctioned. It does not insure your holdings, guarantee the platform cannot fail, or make a bad trade reversible. Federal deposit insurance does not cover cryptocurrency. Licensing reduces counterparty and conduct risk; it does nothing about market risk or your own custody mistakes.
Next in this series
The other half of compliance — IRS treatment plus California's 13.3% ordinary-income rate.
Read the guide ATMsHow the SB 401 caps play out at individual machines across the city.
Read the guide ExchangesLicense transparency is 25% of our scoring weight.
Read the guide SafetyThe consumer harm the DFAL kiosk provisions were written to reduce.
Read the guide LocalWho operates here, and what licensing they need to do it.
Read the guide InstitutionalKYC, AML and source-of-funds review at the institutional end.
Read the guide