California orders CoinFlip to pay $5.16 million over kiosk failures

By Nathan Brooks

On November 4, 2026, California’s Department of Financial Protection and Innovation ordered GPD Holdings LLC, which does business as CoinFlip, to pay approximately $5.16 million. The consent order follows alleged compliance failures across CoinFlip’s network of roughly 500 digital asset kiosks in California.

The payment obligation comprises at least $4,811,483 in restitution for 20 identified California victims of a scam and $351,530 in disgorgement of fees the regulator says CoinFlip improperly collected. Restitution represents roughly 93% of the base $5.16 million total. That structure directs most of the money to harmed consumers rather than the state.

What the order requires

CoinFlip must also stop the practices the DFPI deemed unlawful and implement significant operational changes under continuing regulator oversight. The DFPI did not allege that CoinFlip itself carried out or directly facilitated the scams. Instead, the agency found that weak customer identification and inadequate transaction monitoring allowed third-party fraudsters to exploit people using the kiosks.

That allocation of responsibility is operationally significant: the regulator links the losses to control failures at CoinFlip’s machines rather than to direct facilitation by the operator. For CoinFlip, the remedy therefore extends beyond restitution to supervised changes in how the network identifies customers and monitors transactions.

Where the compliance failures began

The DFPI’s findings reach back to 2021, when CoinFlip’s anti-money laundering controls were inadequate, according to the order. The agency also found that the company exceeded California’s $1,000 daily transaction limit per customer beginning in 2024. Excessive customer fees followed from 2025 onward.

The findings cover at least five calendar years and four control areas: anti-money laundering, customer identification, transaction monitoring and pricing. The continuing remedy has no stated completion date, which places execution of the changes under DFPI supervision rather than payment of the initial penalty at the center of the next phase.

What does this change for kiosk operators and users?

For operators, the order supplies a California-specific cost benchmark without creating a fixed penalty formula. The roughly $5.16 million package combines victim restitution with fee disgorgement, while the required operational changes add an unquantified compliance burden. The enforcement targets are concrete: customer identification, transaction monitoring, the per-customer daily limit and customer fees.

The case also makes effective customer controls a more consequential part of operating a kiosk network. CoinFlip cannot close its exposure with the consent payment alone; it must maintain revised practices under DFPI oversight.

Operators elsewhere in California can expect the agency to treat those same control areas as scrutiny points, although the order does not establish an automatic penalty schedule for other businesses.

For users, the immediate remedy is narrower than a blanket refund. The stated restitution covers 20 identified victims of a scam, while the fee disgorgement addresses excessive customer charges. The order does not promise automatic compensation for every person who used a CoinFlip kiosk in California.

The broader enforcement sequence

CoinFlip is not the first operator to draw DFPI attention. The regulator has previously taken action against Hermes Bitcoin and RockItCoin. The CoinFlip order sets out the financial terms for this case, but it does not supply details about the earlier actions or equate their conduct with the findings against CoinFlip.

Three developments will determine the next phase. First, CoinFlip must implement the required operational changes under DFPI oversight. Second, the $4,811,483 restitution figure is a minimum, so the overall liability may rise if additional restitution is ordered. Third, the DFPI may extend its enforcement posture to other operators in California.

The next test is CoinFlip’s implementation under DFPI oversight, while the restitution floor leaves room for additional victim payments and broader California enforcement.