California ordered CoinFlip, a crypto ATM company, to pay $4.8 million to scam victims and criticized federal regulators for not adequately policing fraud. This combination of restitution and public rebuke signals a shift in enforcement pressure.
Many compliance programs focus primarily on federal regulations like the Bank Secrecy Act, FinCEN registration, and federal examination cycles. It's easy to overlook state actions. The CoinFlip order suggests this is a mistake, especially for fraud teams dealing with crypto ATM scams. Here are five assumptions to reconsider.
Myth 1: "If we meet federal AML/CFT Framework requirements, we're covered."
Reality: Federal compliance sets a floor, not a ceiling.
California acted independently of federal authorities, ordering restitution and criticizing federal regulators. A company can hold a FinCEN registration, maintain an AML/CFT Framework, and file Suspicious Activity Reports (SARs), yet still face state action if consumers are defrauded through its services.
Federal AML rules focus on money laundering and illicit finance reporting. Consumer fraud losses fall under different regulations, and state authorities have their own consumer protection and money transmission mandates. Your federal controls might satisfy a BSA examiner but may not address whether a victim was warned before using a machine.
Myth 2: "Enforcement is the regulator's job. Our job is reporting."
Reality: Filing a SAR doesn't fulfill your responsibility to prevent fraud.
A SAR is a confidential report to FinCEN, not a customer protection measure. If your fraud strategy ends with filing reports, victims continue losing money while you document it.
The California order emphasizes restitution, not just reporting. Regulators will ask what your company did to prevent losses, not just if you reported them. Document preventive controls like warnings, limits, and refusal criteria as thoroughly as your filings.
Myth 3: "State action is isolated and won't shape national expectations."
Reality: State orders often set precedents.
When a state orders restitution and criticizes federal oversight, others notice. A remedy that works in one jurisdiction, like compensating victims directly, can be adopted by others.
Treat the California order as a preview of future expectations. Ask your team if you could identify affected customers, quantify losses, and produce transaction records quickly for remediation. If not, that's a gap to address.
Myth 4: "Federal gaps mean lighter obligations for us."
Reality: Federal gaps mean increased scrutiny from other regulators.
Criticism of federal regulators doesn't imply a permissive environment. When a state highlights federal shortcomings, it's signaling its intent to step in. Companies in this gap attract attention.
Emerging technologies like crypto ATMs often outpace existing rules. This ambiguity increases your responsibility to act reasonably, even without specific federal guidelines.
Myth 5: "A single national compliance policy is the efficient approach."
Reality: A single policy works only if it meets the strictest standards.
A uniform national policy may seem efficient, but it must meet the toughest state standards to be effective. Otherwise, you'll need a patchwork of exceptions.
Design a national baseline with state-specific overlays. Your Customer Due Diligence procedures, Transaction Monitoring Rules, and warnings should be adaptable by jurisdiction. This is as much a RegTech and governance issue as a policy one.
What to Do Instead
Start with a jurisdictional gap analysis. Map each state where you operate against its money transmission, consumer protection, and virtual currency requirements, then compare that to your federal-first controls. Identify where you rely on federal compliance as a proxy.
Next, integrate victim-centered controls into transaction flows. Fraud typologies often involve a customer being coached by a third party. Implement scripted warnings, transaction limits for new customers, and escalation triggers for scam patterns. Route cases through your MLRO or fraud lead, and keep records of decisions.
Finally, prepare for remediation, not just defense. Maintain data to identify and quantify victim losses. If a regulator orders restitution, speed and accuracy are crucial.
The lesson from California is clear: waiting for federal clarity is no longer a viable strategy.
