To do this type of business legally, you have to comply with both federal laws and state laws. The federal laws basically say you have to register with FinCEN and comply with anti-money laundering laws, which mostly means you have a duty to know who your customers are and why they're transacting with you, to refuse to do business with people who are obviously laundering money, and to report suspicious activity to FinCEN. It's reasonably doable to comply with federal law as an small operator. However, this person didn't just fail to register, she also knowingly facilitated money laundering, which is illegal even if you're registered.

What exactly you have to do to comply with state law varies dramatically. In some states buying and selling bitcoin is basically unregulated, and in others there are onerous registration/licensing and financial requirements that are basically impossible to fulfill as an individual. Off the top of my head I'm not sure where California falls on the spectrum.

The best way to avoid this sort of trouble seems to be "be a large enough company that your internal operations make it too confusing to work out who to prosecute".

With all the money generated by the financial services industry in NY, I wonder if some future forward politician from another less prosperous state could find it in their heart to make their state a safe haven for new financial services based on cryptocurrency. It seems like the argument could be made that it'll create a better set of jobs than that foxconn deal in Wisconsin.

Realistically, probably not. Compliance with a lot of these types of laws is challenging and at times murky (especially in new areas).

That being said, from a practical perspective, ignoring compliance requirements in your area of business for whatever reason can lead to these outcomes. Make dangerous choices win dangerous prizes.