California’s financial regulator has ordered CoinFlip to pay approximately $5.16 million in restitution and disgorgement over alleged compliance failures at its crypto kiosks, the California Department of Financial Protection and Innovation (DFPI) announced in a consent order dated November 4, 2026.
The order targets GPD Holdings LLC, which does business as CoinFlip and operates around 500 digital asset kiosks across California.
Restitution and disgorgement
CoinFlip must pay at least $4,811,483 in restitution to 20 identified California victims of a scam. It must also surrender $351,530 in disgorgement, which covers excessive fees charged to customers. Together, the two amounts total approximately $5.16 million.
Regulator’s findings
The DFPI alleged that CoinFlip’s anti-money laundering measures were inadequate starting in 2021. It also found that the company exceeded California’s $1,000 daily transaction limit per customer beginning in 2024, and that from 2025 onward it charged excessive fees.
The order does not accuse CoinFlip of directly facilitating the scams. Instead, the regulator attributed the harm to operational shortcomings: weak customer identification and inadequate transaction monitoring allowed third-party fraudsters to exploit people using the kiosks.
Required changes and oversight
Under the consent order, CoinFlip must stop the unlawful practices and implement significant operational changes under ongoing DFPI oversight.
Broader crackdown
CoinFlip is not the first kiosk operator to face DFPI action. The regulator has previously taken action against Hermes Bitcoin and RockItCoin.
For the kiosk industry, the order illustrates the potential cost of noncompliance. Most of the penalty goes to victims rather than to the state, suggesting California regulators are focused on making harmed consumers whole and on tying operator liability to real-world losses inflicted through their machines.
Key issues to watch include how CoinFlip implements the required operational changes under DFPI supervision, whether the restitution total grows since the order sets the figure at a minimum of $4,811,483, and whether the DFPI’s string of actions against Hermes Bitcoin, RockItCoin and now CoinFlip extends to other operators in the state.
