Since 1 Jul 2026, California's Digital Financial Assets Law (DFAL) bars a person from exchanging, transferring or storing digital financial assets with or on behalf of a California resident unless it holds a licence from the Department of Financial Protection and Innovation (DFPI), is exempt, or submitted a completed application on or before 1 Jul 2026 and is awaiting a decision. The deadline has passed, so a firm that had not submitted a completed application by then can serve residents only once it is licensed, or if an exemption covers it.
The regime in brief
The DFAL is Division 1.25 of the California Financial Code. Assembly Bill 39 added it, and the Governor approved it on 13 Oct 2023. The licensing requirement was first set for 1 Jul 2025. Assembly Bill 1934, approved on 29 Sep 2024, moved that date to 1 Jul 2026.
On 30 Jun 2026, the day before the deadline, the Governor approved Senate Bill 97, an urgency statute that took effect immediately. Some of its changes are listed under Recent changes below.
The DFPI licenses and supervises under the Law. Its website returned an access block (HTTP 403) to this guide's automated requests, so this guide relies on the chaptered texts of AB 39, AB 1934 and SB 97 on the California Legislature's site. For the federal side and other states, see Anvesan's United States regime page.
Who needs a license
The Law governs the digital financial asset business activity of a person doing business in California, and of a person wherever located that engages in, or holds itself out as engaging in, digital financial asset business activity with or on behalf of a California resident.
The key terms, as amended by SB 97:
- Digital financial asset. A digital representation of value used as a medium of exchange, unit of account or store of value that is not legal tender. The exclusions include merchant rewards points of a defined kind; value issued by or for a game publisher and used mainly within games, if it is not otherwise a digital financial asset; securities registered with or exempt from registration with the SEC, or qualified with or exempt from qualification with the DFPI; and digital records of ownership of goods such as art or tickets.
- Digital financial asset business activity. Exchanging, transferring or storing a digital financial asset, or holding electronic precious metals, or electronic certificates representing interests in precious metals, on behalf of another person, or issuing shares or electronic certificates representing such interests.
- Resident. A person domiciled in California, physically present there for more than 183 of the previous 365 days, or with a place of business there, or the legal representative of a person domiciled there. A licensee and its affiliates are not residents.
Kiosk operators are covered too. Under Section 3907, an operator that engages in the activity must comply with Section 3201. One that lets another person do business through its kiosk must ensure, from 1 Jul 2026, that the person holds a DFAL licence.
Who is exempt
Section 3103 lists persons whose activity the Law does not apply to. They include, among others:
- governments and their agencies;
- FDIC-insured commercial and industrial banks, some foreign banks, insured savings associations, trust companies licensed in California, national associations authorised to engage in trust banking, and insured credit unions with an office in California;
- firms registered under the Commodity Exchange Act, and securities broker-dealers, each only to the extent set out in the section;
- a person whose activity with residents is reasonably expected to be worth $50,000 or less a year in aggregate;
- a person that receives no compensation, directly or indirectly, for the service, which since SB 97 expressly includes one that merely keeps the ability to terminate, suspend or interrupt a transaction solely to prevent unauthorized or fraudulent activity and is not paid for that;
- merchants accepting digital financial assets as payment for goods or services other than digital financial assets; persons that contribute only connectivity software or computing power to securing a network that records digital financial asset transactions, or to a protocol governing transfers; and persons that provide only data storage or security services to a business in the activity and do not otherwise engage in it on behalf of others.
The Commissioner can also exempt persons or transactions by regulation or order, if the Commissioner finds this is in the public interest and that regulating them is not necessary for the Law's purposes. The Commissioner must post a list of those exemptions on the Commissioner's website.
Requirements at headline level
Sherpa's data returns no signed-off headline figures for this activity in the United States, so this guide has no figures box. These are the main requirements in the Law.
- Application. Section 3203 lists what an application contains, including the applicant's business history for the past five years (or since it started, if shorter), its control persons and executive officers, licences held in other states, criminal convictions, deferred prosecution agreements and pending criminal proceedings, and the number of California residents it served in the month before it applies. It comes with a nonrefundable fee in an amount the DFPI determines.
- Security. A licensee keeps a surety bond or trust account in US dollars, in a form and amount the DFPI determines, for the protection of residents.
- Capital and liquidity. A licensee keeps capital and liquidity the DFPI considers sufficient, based on the risks of its business. The Law lists factors the DFPI may consider, including, but not limited to, the mix of assets and liabilities, business volume, leverage and arrangements to protect customers if the licensee becomes insolvent. Section 3215 requires the Commissioner, on request, to tell an applicant the minimum capital and liquidity that will be required of it, based on the information the applicant gives about its business plan.
- People. The Commissioner requires fingerprints for an FBI criminal history check from an applicant that is an individual, from its executive officers and responsible individuals, and from individuals that control it. Where a controlling person is a company, that company's executive officers and responsible persons are checked.
- Ongoing duties. Each year, a licensee files an annual report between 1 Oct and 1 Nov, and pays by 28 Feb a pro rata share of the programme's costs as the Commissioner estimates them. Applicants operating while their application is pending pay that share too. The DFPI may extend the annual report period, and may change the payment dates by rule.
The Law also sets customer disclosures, records and policies. See the full path in Sherpa's Pathfinder.
The application process and timelines
The Law lets the Commissioner use the Nationwide Multistate Licensing System and Registry (NMLS) to collect and maintain records and to process fees. The DFPI's own application pages could not be read for this guide, so it does not report their dates or forms.
The steps in Section 3203:
- Filing. The applicant files the application with the fee. For that section, Section 3203 defines a "completed application" as one that contains the fee, the listed information and anything else the Commissioner's regulations require. Under Section 3201, only a completed application filed on or before 1 Jul 2026 lets a firm keep operating while it waits.
- Investigation. The DFPI investigates criteria that include the applicant's financial condition, experience and fitness; the competence, experience, character and fitness of its executive officers, responsible individuals and controlling persons; likely compliance with the Law; and a "reasonable promise of success". It may inspect the business premises, and the applicant pays the reasonable costs.
- Decision. The DFPI approves, conditionally approves or denies the application. If the DFPI does not receive the applicant's written acceptance of the conditions within 31 days of its notice of them, or the applicant does not request a hearing on them within 31 days, the application is deemed withdrawn.
- Taking effect. A licence takes effect on the later of the date it is issued and the date the licensee provides the required security.
Section 3205 lets the Commissioner issue a conditional licence in two cases. The first is an applicant holding a New York virtual currency licence or a qualifying New York limited purpose trust charter, issued or approved no later than 1 Jan 2025, if the applicant pays all appropriate fees and complies with the Law. The second is an applicant that has supplied all fingerprints and meets every other requirement, where, despite reasonable efforts, the Commissioner has been unable to complete the required criminal history investigations with reasonable speed. The sections of the Law read for this guide set no deadline for the DFPI's decision.
An unlicensed person that engages in the activity in violation of the Law can face a civil penalty of up to $100,000 a day under Section 3407. A licensee or covered person that materially violates it can face up to $20,000 a day, or for each act or omission.
Recent changes
- 3 Sep 2026. Assembly Bill 1180 was presented to the Governor. If enacted, it would let the DFPI adopt regulations, from 1 Jul 2027 until the section expires on 1 Jan 2032, allowing applicants and licensees to make payments required under the Law to the DFPI in a stablecoin issued by a licensee and redeemable directly from the issuer. Payments related to enforcement would be excluded, and so would stablecoin payments that the Controller, the Treasurer or the DFPI determines would interfere or conflict with specified Government Code provisions. As read on 28 Sep 2026, the Legislature's status page showed the bill with the Governor.
- 30 Jun 2026. SB 97 took effect. Among other changes, it required a completed application by the deadline and moved the New York licence cut-off from 1 Jan 2023 to 1 Jan 2025. It also exempted from an exchange's pre-listing certification any asset the New York Department of Financial Services approved for listing on or before 1 Jan 2025 (the earlier cut-off was 1 Jan 2023), required exchanges to describe their order execution practices, removed from the definition of the activity the exchange of in-game value for a digital financial asset from the same publisher, or for legal tender outside the game, and repealed the stablecoin chapter.
- 11 Oct 2025. The Governor approved Senate Bill 822, which, among other changes, clarifies that digital financial assets are intangible property subject to California's Unclaimed Property Law.
Related guides: GENIUS Act regulations in 2026, the FCA crypto licence and the MiCA licence. Other markets are in the Atlas.