California is preparing to implement one of the most comprehensive state regulatory frameworks for cryptocurrency and digital asset businesses in the United States. The California Digital Financial Assets Law (DFAL) introduces a licensing and supervisory regime for companies engaged in digital asset activities with California residents.
Beginning July 1, 2026, businesses operating in this space must either obtain a license from the California Department of Financial Protection and Innovation (DFPI) or have a license application pending in order to legally conduct digital financial asset business activity in the state.
The DFAL represents California’s effort to establish regulatory oversight similar to other state digital asset licensing regimes while strengthening consumer protection, transparency, and financial integrity across the crypto industry.
What Is the Digital Financial Assets Law?
The DFAL was enacted through Assembly Bill 39 and Senate Bill 401, signed into law in October 2023. The legislation authorizes the DFPI to license, supervise, and enforce compliance for companies engaged in digital asset business activities involving California residents.
The law creates a comprehensive regulatory structure for digital asset companies similar to frameworks used for other financial service providers, including money transmitters and lenders.
Although originally scheduled to become effective in 2025, subsequent legislation extended the operative licensing date to July 1, 2026, allowing regulators additional time to finalize rulemaking and application procedures.
Who Must Obtain a DFAL License?
Under the DFAL, any person or entity that engages in “digital financial asset business activity” with or on behalf of a California resident must obtain a license from the DFPI unless an exemption applies.
Digital financial asset business activity generally includes services involving:
- Exchanging digital assets (e.g., cryptocurrency exchanges)
- Storing or safeguarding digital assets for customers (custody services)
- Transferring digital assets on behalf of customers
- Operating digital asset transaction platforms or brokerage services
- Certain stablecoin-related activities
The licensing requirement applies regardless of whether the company has a physical presence in California.
Exemptions from Licensing
Certain entities and activities are exempt from DFAL licensing requirements. These include:
- Federally or state-chartered banks and credit unions
- Trust companies already regulated under banking laws
- Persons providing only technology infrastructure (such as network validation or computing services)
- Businesses reasonably expecting to generate less than $50,000 annually from covered digital asset activity
Companies relying on exemptions must carefully analyze their operations to confirm eligibility under the statute.
Key Application and Licensing Requirements
The DFPI is expected to administer DFAL license applications through the Nationwide Multistate Licensing System (NMLS), similar to other financial services licensing programs.
Applicants will likely need to provide:
- Organizational structure and ownership disclosures
- Background checks and fingerprints for key personnel
- Detailed business plans and operational descriptions
- Financial statements demonstrating capital adequacy
- Cybersecurity and information security programs
- Policies addressing consumer protection and risk management
The DFPI will evaluate applicants based on financial condition, managerial competence, and overall fitness to operate within California’s regulatory framework.
Consumer Protection and Compliance Obligations
The DFAL places significant emphasis on protecting consumers and promoting transparency in the digital asset marketplace.
Licensed companies must comply with a number of ongoing obligations, including:
Consumer disclosures
- Clear disclosure of fees and charges
- Information about insurance coverage and transaction risks
- Explanation of liability for unauthorized or mistaken transactions
Operational safeguards
- Maintaining reserves of customer digital assets equal to customer entitlements
- Implementing cybersecurity and information security programs
- Maintaining records of digital asset activity for at least five years
Regulatory oversight
- Annual reporting and financial statements
- Periodic regulatory examinations by the DFPI
- Payment of annual assessments to cover the cost of program administration
Violations of the DFAL may result in enforcement actions and civil penalties of up to $20,000 per day for non-compliance.
Additional Rules for Digital Asset Transaction Kiosks
The DFAL also establishes specific requirements for digital asset transaction kiosks, commonly known as cryptocurrency ATMs.
These provisions include:
- Limits on daily transaction amounts
- Fee caps for kiosk operators
- Mandatory transaction receipts and disclosures
These requirements were implemented in stages beginning in 2024 and will ultimately align with the broader DFAL licensing regime by 2026.
Preparing for the 2026 Licensing Deadline
Companies currently offering cryptocurrency or digital asset services to California residents should begin preparing well in advance of the July 1, 2026 deadline. Key preparatory steps include:
- Conducting a regulatory analysis of business activities
- Determining whether a DFAL license or exemption applies
- Developing compliance policies and risk management frameworks
- Preparing financial, governance, and cybersecurity documentation for licensing
Given California’s size and influence in the financial services market, the DFAL is expected to significantly shape the regulatory landscape for digital asset businesses operating in the United States.
Conclusion
The Digital Financial Assets Law marks a major step in California’s effort to regulate the rapidly evolving digital asset industry. By introducing a licensing framework, consumer protection standards, and regulatory oversight, the DFAL aims to bring greater transparency and accountability to crypto-related financial services operating within the state.
Businesses engaging with California residents should begin assessing their regulatory obligations now to ensure they are prepared for the upcoming licensing requirements.
How RCG Helps
RCG helps fintech providers navigate regulatory and operational complexities. We advise on product strategy, licensing, risk management, and controls, ensuring providers remain compliant while delivering innovative solutions.