On November 4, the California DFPI announced a consent order with a Chicago-based operator of digital financial asset transaction kiosks and an online trading desk. The order resolves findings that the operator violated the Digital Financial Assets Law (DFAL) (previously covered by InfoBytes here). According to the order, the DFPI found that the operator: (i) accepted more than $1,000 from a single customer in one day, in violation of § 3902; (ii) collected fees above the statutory cap, which is $5 or 15 percent of the transaction value, whichever is greater, in violation of § 3904; (iii) failed to provide required pre-transaction disclosures, in violation of § 3905(a); and (iv) issued kiosk receipts that lacked required information, in violation of § 3905(b). The DFPI also identified deficiencies in the operator’s customer due diligence, transaction monitoring, and risk management under its BSA/AML program obligations as a money services business. The DFPI concluded that this alleged conduct violated sections 90003(a)(1) and (a)(2) of the California Consumer Financial Protection Law. In its press release, the agency stated that the operator’s compliance failures had been “enabling scammers to exploit kiosk users and drain their assets.”

Under the consent order, the operator, which neither admitted nor denied the findings, must refrain from the cited violations. It must also pay $351,530 in disgorgement of excess fees within 180 days. In addition, it must pay at least $4,811,483 in restitution to 16 identified California consumers. Restitution may not be conditioned on any consumer waiving rights, and unclaimed funds must escheat to the state. Once the operator satisfactorily completes its obligations, the DFPI will treat the findings and conclusions as “resolved” when it considers the operator’s DFAL license application, although the findings will not be the “sole basis” of any decision on that application.