From the journal

California DFPI Orders Hermes Bitcoin to Cease Crypto Kiosk Operations Under DFAL, 18 May 2026

The California Department of Financial Protection and Innovation announced a consent order on 18 May 2026 requiring Hermes Bitcoin, the operator of 42 crypto kiosks across Southern California, to cease all digital financial asset business in the state by 20 May 2026. The DFPI alleged violations of the Digital Financial Assets Law (DFAL), the California Consumer Financial Protection Law, and federal anti-money laundering rules. Restitution totals $174,874.28 with a $1 million suspended administrative penalty.

3 min read

The California Department of Financial Protection and Innovation (DFPI) announced a final consent order on 18 May 2026 against Anh Management, LLC, the operator of Hermes Bitcoin kiosks. The order required the company to cease all digital financial asset business in California by 20 May 2026. Hermes Bitcoin operated 42 crypto kiosks across Southern California. The DFPI alleged that the company processed over 3,000 non-compliant transactions and issued more than 14,000 deficient receipts. The settlement is final and in effect.

The DFPI applied the Digital Financial Assets Law at Financial Code Division 1.25, sections 3101 through 3905. The DFAL took effect 1 July 2025 and full licensure begins 1 July 2026. The agency enforced the rules in advance through the California Consumer Financial Protection Law. The order alleges violations of the DFAL's $1,000 single-day cash transaction cap at section 3601, the fee limits at section 3603, the receipt content requirements at section 3604, and the customer identification requirements at section 3605. The order also cites the federal Bank Secrecy Act customer identification program rules at 31 CFR 1010.220 for affiliated kiosk operations. Consideration includes $174,874.28 in restitution and a $1 million administrative penalty held in suspense pending compliance with the consent order.

The order reaches every digital financial asset kiosk operator that serves California consumers. Operators must respect the $1,000 single-day cash cap, the statutory fee cap, and the receipt and customer identification rules under the DFAL. Operators must collect tax identification numbers, verify customer identity, and maintain audit trails before processing transactions. Banking and payment partners that route flows to kiosk networks should review counterparty due diligence files. The DFPI has signaled that pre-license enforcement will continue and that operators relying on prior unlicensed activity face restitution and outright bans.

DFAL licensure applications open 1 July 2026 under Financial Code section 3201. Unlicensed operators may continue limited activity only under DFPI conditional approval pending license review. The consent order bars Hermes Bitcoin from any digital financial asset business in California unless the DFPI grants a license. Other states with kiosk-specific statutes, including Minnesota SF 3868 and Vermont H.659, are advancing parallel restrictions on cash-loaded crypto ATMs.

Licentium advises crypto-asset service providers and kiosk operators on state money transmitter and digital asset law compliance through a partner network across enforcement defense and licensing. Contact us to discuss DFAL filings, consent order negotiation, or pre-license remediation. Work we undertake includes DFAL license applications, BitLicense filings, federal money services business registration, BSA and AML compliance programs, transaction monitoring policies, and consumer disclosure design.

Source: California Department of Financial Protection and Innovation, "DFPI Shuts Down Crypto Kiosk Operator for Cheating Consumers and Violating State Laws," 18 May 2026, https://dfpi.ca.gov/press_release/dfpi-shuts-down-crypto-kiosk-operator-for-cheating-consumers-and-violating-state-laws/

The information provided is not legal, tax, investment, or accounting advice and should not be used as such. It is for discussion purposes only. Seek guidance from your own legal counsel and advisors on any matters. The views presented are those of the author and not any other individual or organization. Some parts of the text may be automatically generated. The author of this material makes no guarantees or warranties about the accuracy or completeness of the information.

Crypto Regulatory

More from the journal

See all

British Virgin Islands Confirms OECD CARF Adoption with First Crypto-Asset Information Exchanges in 2028

The British Virgin Islands has committed to the OECD's Crypto-Asset Reporting Framework (CARF), with the first exchanges of crypto-asset information scheduled for 2028. BVI-based reporting Crypto-Asset Service Providers will collect transaction, identity, and tax residence data from 2027 onward. The BVI International Tax Authority is the competent authority. CRS 2.0 entered force in the BVI on 1 January 2026 and now includes crypto-assets and CBDCs within scope.

Trump Executive Order Integrates Fintech and Digital Assets Into Federal Payment Rails on 19 May 2026

President Donald Trump signed the Executive Order titled "Integrating Financial Technology Innovation Into Regulatory Frameworks" on 19 May 2026. The order directs federal banking regulators, including the Federal Reserve, to reconsider barriers that limit fintech and digital asset firms from obtaining bank charters, federal payment account access, and regulated banking partnerships. Regulators must report within 90 days. The Federal Reserve must complete a Reserve Bank account evaluation within 120 days.

APRA and ASIC Issue Joint Industry Letters on AI Risk and Cyber Resilience, April and May 2026

The Australian Prudential Regulation Authority published an open letter to all regulated entities on 30 April 2026 setting expectations for governance of AI and AI agents. The Australian Securities and Investments Commission followed with an 8 May 2026 letter to licensees calling for urgent action on cyber resilience against AI-enabled threats. Both regulators warn that existing prudential and operational risk standards already cover AI use and that supervisory action will follow identified gaps.

Ready to launch legally?

Book a 30-minute consultation. We'll map your licensing path and tell you exactly what's required, in plain language.