California’s Digital Financial Assets Law (DFAL) is now fully operative, marking the start of a new era for crypto regulation in the United States. As of July 1, 2026, any firm conducting covered digital asset activities with California residents must be licensed by the Department of Financial Protection and Innovation (DFPI) or have a pending application, or face enforcement action.
A new licensing regime goes live
The DFAL licensing framework, enacted in October 2023 via AB 39 and SB 401 and amended in September 2024 by AB 1934, was designed to bring crypto exchanges, custodians, OTC desks, kiosks and certain issuers under state prudential supervision. Applications opened on March 9, 2026 through the Nationwide Multistate Licensing System (NMLS), giving firms a narrow runway to meet the July 1 deadline.
From July 1, persons engaging in “digital financial asset business activity” with or on behalf of a California resident are prohibited from operating unless they are DFPI‑licensed, have submitted a complete application, or qualify for an exemption. DFPI has made clear that missing the deadline will disqualify operators from continuing to serve California and can block future applications.
Scope: who must be licensed
DFAL’s licensure net is broad. It covers persons that: exchange, transfer or store digital financial assets with or for California residents; issue redeemable digital financial assets; issue electronic certificates representing interests in precious metals; and, in limited cases, operators exchanging in‑game value for money or certain digital assets. Crucially, holding a virtual currency or money transmitter license in another state does not, by itself, eliminate the need for a DFAL license.
Exemptions exist but are narrow, including certain banks, providers of only connectivity software or computing power to decentralized networks, and persons reasonably expecting less than $50,000 in annual revenue from covered activity. Firms must also assess whether they need additional California licenses beyond DFAL, since the DFAL license does not replace other state requirements.
Stablecoins: reserve backbone and issuer gating
Stablecoins are a central pillar of DFAL. The law prohibits offering stablecoins to California residents unless the issuer is a DFAL licensee or applicant, or a qualifying financial institution, and maintains eligible securities on a one‑to‑one basis with outstanding stablecoin liabilities. In practice, this creates an issuer‑gating model: exchanges, custodians and other intermediaries may not exchange, transfer or store a stablecoin unless its issuer meets DFAL’s reserve and licensing conditions.
The reserve requirement is intended to ensure that redemptions can be met at par and to reduce run risk. DFPI’s FAQs direct issuers to Chapter 6 of the statute for detailed obligations, and signal that supervision will focus on asset quality, segregation, attestation and ongoing reporting.
Custody, capital and consumer safeguards
Beyond stablecoins, DFAL imposes classic prudential and conduct rules on licensees. Firms must maintain capital and liquidity sufficient to meet obligations to California residents, hold digital financial assets to satisfy customer entitlements, and maintain a surety bond or trust account in amounts set by DFPI. Licensees are also subject to DFPI examination, recordkeeping, and periodic reporting, with examination costs billable to the firm.
Consumer disclosure obligations are extensive. Licensees must provide a schedule of fees and charges; state whether products or services are insured; disclose liability for unauthorized, mistaken or accidental transfers; explain rights to stop or revoke preauthorized payments; issue detailed receipts; and list service outages affecting 10,000 or more customers in the prior 12 months. The law further requires at least 10 hours of live weekday phone support for California residents, a notable operational burden for some platforms.
Enforcement posture and kiosk rules already active
DFPI has signaled an active enforcement stance. The agency achieved its first DFAL enforcement action in July 2025 against crypto kiosk operator Coinme, underscoring that kiosk provisions have been live ahead of the broader licensing deadline. Kiosk operators face layered obligations: daily per‑customer limits of $1,000 in dispensed or accepted value; pre‑transaction disclosures from January 1, 2025; and a fee cap of the greater of $5 or 15% of the U.S. dollar equivalent of the digital assets involved, calculated against a licensed exchange price at transaction time. Kiosk operators must also have submitted a completed DFAL application by July 1, 2026 to continue operating.
At the same time, DFPI has clarified that DFAL licensees will not need a separate Money Transmission Act license for certain overlapping activities, such as transmitting payments for virtual currency purchases or issuing stored value used exclusively for virtual currency, while preserving supervisory authority through liability thresholds.
Compliance expectations: AML, cyber, Travel Rule
DFPI’s licensing review will scrutinize core compliance infrastructure. Applicants must demonstrate mature Bank Secrecy Act/AML programs, including a designated BSA compliance officer, risk‑based KYC/CDD, staff training, sanctions screening, and suspicious activity and currency transaction reporting processes. The regulator expects use of blockchain analytics to address terrorist financing, sanctions evasion, darknet activity, ransomware and fraud risks, and adherence to the Travel Rule.
Cybersecurity and operational resilience are equally central. DFPI assesses programs against the NIST Cybersecurity Framework 2.0, looking at governance, asset management, access controls, data protection, detection, incident response and recovery. Fraud prevention obligations include specific measures to protect older consumers, reflecting California’s high losses from crypto‑enabled investment scams, ATM fraud and sextortion, particularly among those aged 60 and over.
What comes next for industry and regulators
With DFAL operative, near‑term focus shifts to application processing, examination readiness and market adaptation. Firms that missed the July 1 window face immediate business disruption in California, while those with pending applications will be under pressure to respond quickly to DFPI information requests and demonstrate compliance maturity. Over the medium term, DFPI’s rulemaking and supervisory practices will likely shape de facto national standards, given California’s market size and its concentration of blockchain firms and users.
For stablecoin issuers, the next phase will involve granular guidance on eligible reserve assets, attestations, and reporting cadence, as well as how DFPI coordinates with federal counterparts. For exchanges and custodians, key questions include how DFPI treats proof‑of‑reserves, segregation architectures, and insolvency protections. And for kiosk operators, continued enforcement will test whether fee caps, disclosures and daily limits are being applied correctly in practice.