California DFAL: Digital Financial Assets Law Guide

California’s Digital Financial Assets Law: How the Largest State Economy Regulates Crypto

California’s Digital Financial Assets Law (DFAL), signed by Governor Gavin Newsom on October 13, 2023, establishes the state’s comprehensive regulatory framework for digital financial asset businesses. As the world’s fifth-largest economy and home to a significant portion of the US crypto industry — including Coinbase, Ripple, and numerous DeFi and Web3 startups — California’s regulatory approach carries outsized significance for the digital asset ecosystem.

The DFAL creates a licensing regime administered by the Department of Financial Protection and Innovation (DFPI), covering a broad range of digital financial asset activities. Its implementation timeline extends through 2025-2026, tracked in the US bills tracker alongside other pending state legislation. The US state regulatory comparison places DFAL in context among the 50-state landscape, with conditional licensing provisions allowing firms to operate while full applications are processed.

Scope and Covered Activities

What Constitutes “Digital Financial Asset Business Activity”

Under the DFAL, “digital financial asset business activity” includes:

1. Exchanging, transferring, or storing digital financial assets or engaging in digital financial asset administration
2. Holding electronic precious metals or certificates of electronic precious metals on behalf of another person
3. Exchanging digital financial assets for monetary value or other digital financial assets

Key Definitions

Digital financial asset: A digital representation of value that is used as a medium of exchange, unit of account, or store of value, and that is not legal tender. This includes cryptocurrencies, utility tokens, and stablecoins, but excludes:

• Digital representations of traditional financial instruments (securities, commodities)
• Rewards programs, gift certificates, or game-related digital content
• Digital assets used within a closed system

Digital financial asset administration: Issuing a digital financial asset with the authority to redeem the asset for legal tender, bank credit, or other digital financial assets.

Who Must Be Licensed

Any person engaged in, or holding themselves out as engaged in, digital financial asset business activity with or on behalf of a California resident must obtain a DFAL license from the DFPI. This includes:

• Crypto exchanges operating in California
• Custody providers holding crypto for California residents
• Stablecoin issuers with California users
• Payment processors using digital financial assets
• Certain DeFi interfaces (though the application to purely decentralized protocols is unclear)

Exemptions

The DFAL exempts:

• Banks and credit unions chartered under California or federal law
• Licensed money transmitters (to the extent their activities are covered by the money transmitter license)
• Persons engaged in digital financial asset activity exclusively with institutional investors
• The state or federal government
• Persons whose digital financial asset business activity with California residents is below a de minimis threshold (to be determined by DFPI rule)

Licensing Requirements

Application Process

The DFAL license application requires:

Entity Information:

• Legal name, organizational structure, and state of incorporation
• Ownership structure including all persons with 10% or more ownership interest
• Management biographies and background check authorizations
• Business plan describing the digital financial asset activities to be conducted
• Organizational chart

Financial Requirements:

• Audited financial statements
• Surety bond or trust account (amount determined by DFPI based on the volume and type of activity)
• Demonstration of adequate capital to conduct the proposed business activities
• Projected financial statements

Compliance Programs:

• Written AML/BSA compliance program
• Written cybersecurity program
• Written consumer protection policies
• Written complaint resolution procedures
• Business continuity and disaster recovery plan

Conditional License

The DFAL provides for a conditional licensing period during the implementation phase:

• Entities actively engaged in digital financial asset business activity in California before the effective date may apply for a conditional license
• The conditional license allows continued operation while the full license application is processed
• Conditional licensees must comply with all substantive DFAL requirements
• The conditional license period is temporary — entities must ultimately obtain a full license or cease operations

License Fees

• Application fee: Set by DFPI regulation (expected to be $5,000-$10,000)
• Annual assessment: Based on the volume of digital financial asset activity
• Examination costs: Licensees must reimburse DFPI for examination costs

Operational Requirements

Customer Protection

DFAL licensees must:

• Segregation: Hold customer digital financial assets separate from the licensee’s own assets
• Disclosure: Provide customers with clear, conspicuous disclosures before executing transactions, including:
  • The terms and conditions of the transaction
  • A description of the digital financial asset involved
  • The fees charged
  • The licensee’s complaint resolution process
  • A statement that the digital financial asset is not legal tender and is not insured by the FDIC
• Receipts: Provide transaction receipts
• Customer assets: Maintain customer assets in an amount at least equal to the aggregate amount of all customer digital financial assets

Reserve Requirements for Stablecoin Issuers

Entities issuing digital financial assets that purport to be backed by or redeemable for monetary value must:

• Maintain reserves equal to or exceeding the outstanding value of issued digital financial assets
• Hold reserves in high-quality liquid assets as specified by DFPI rule
• Provide periodic attestation of reserve adequacy by an independent auditor

AML/BSA Compliance

Licensees must implement AML programs consistent with FinCEN requirements, including:

• Customer identification and verification
• Transaction monitoring
• SAR filing
• OFAC sanctions screening
• Ongoing training and independent review

Cybersecurity

Licensees must maintain a cybersecurity program that includes:

• Risk assessment
• Access controls
• Encryption
• Incident response plan
• Employee training
• Third-party vendor management

DFPI Supervision and Examination

Examination Authority

The DFPI has authority to:

• Conduct periodic examinations of licensees (both on-site and off-site)
• Require licensees to produce books, records, and documents
• Issue subpoenas for examination purposes
• Coordinate with other state and federal regulators

Reporting Requirements

Licensees must submit:

• Annual reports containing financial statements and activity data
• Quarterly financial reports (for larger licensees)
• Event-driven reports for material changes, security incidents, and customer complaints

Enforcement

Enforcement Powers

The DFPI can:

• Issue orders to cease and desist from violations
• Revoke or suspend licenses for material violations
• Impose civil penalties of up to $100,000 per violation
• Seek injunctive relief in court
• Refer matters to the Attorney General for criminal prosecution

Operating Without a License

Engaging in digital financial asset business activity in California without a DFAL license (and without an applicable exemption) is a violation subject to:

• Civil penalties
• Cease and desist orders
• Potential criminal prosecution for willful violations

Comparison with New York BitLicense

The DFAL and BitLicense share similarities but differ in important ways:

What This Means for Your Business

For crypto businesses operating in California: Assess whether your activities fall within the DFAL’s scope and prepare for licensing. The conditional licensing pathway provides a bridge, but you must ultimately obtain a full license. Begin building compliance infrastructure now.

For startups: The DFAL’s exemption for institutional-only platforms provides a potential pathway for B2B businesses to operate without a DFAL license. Evaluate whether restructuring your business model to serve only institutional clients is viable.

For compliance officers: The DFAL’s requirements are substantial but less onerous than the New York BitLicense. Focus on customer asset segregation, disclosure requirements, and AML program adequacy. The DFPI’s examination approach is still being established — build relationships with DFPI staff early.

For national operators: If you already hold a BitLicense, California DFAL compliance will be relatively straightforward as the BitLicense standards exceed DFAL requirements in most areas. If you operate under state money transmitter licenses, assess whether those licenses cover your digital financial asset activities or whether a separate DFAL license is required.