Digital Financial Assets Law Frequently Asked Questions

Signed by Governor Newsom on October 13, 2023, DFAL creates a robust regulatory framework, including licensure and enforcement authority, for certain crypto activities.  This law creates a comprehensive regulatory program for many crypto companies, requires DFPI to license and supervise many crypto asset-related companies that serve California residents, and provides important consumer protections for users. Furthermore, DFAL requires additional obligations for crypto kiosks operating in California.

Assembly Bill 39 (AB 39) and Senate Bill 401 (SB 401) together comprise the Digital Financial Assets Law (DFAL).

• Chapters 1 through 8 of DFAL contain the text of AB 39, which prohibits, on or after July 1, 2025, a person from engaging in digital financial asset business activity or presenting itself as being able to engage in digital financial asset business activity with or on behalf of a California resident unless certain criteria are met, including they are licensed by the DFPI.
• Chapter 9 of DFAL contains the text of SB 401, which provides for the regulation of digital financial asset transaction kiosks, including limits on how much money can be accepted or dispensed by a kiosk operator in a day from a single customer, transaction fee limits, and a requirement to provide a detailed receipt for every transaction. More information about DFAL’s kiosk provisions can be found at ca.gov/dfal-kiosk.

Some of the requirements of DFAL became effective on January 1, 2024, while      others are effective January 1, 2025, or July 1, 2025.

• DFAL provides many consumer, investor, and safety-and-soundness protections for California residents who use various digital financial asset products and services and requires supervision and oversight of crypto asset-related companies, including:
  • Providing the DFPI the authority to license, supervise, and examine crypto asset-related companies, including digital financial asset businesses, custodians, and stablecoin issuers. Requiring that persons licensed under the law maintain capital and liquidity sufficient to ensure that licensees can meet their obligations to California residents.
  • Requiring digital financial asset businesses to protect the public from scams and frauds by investigating assets before listing those assets for sale to California residents.
  • Requiring that licensees hold sufficient digital financial assets to satisfy residents’ entitlements.
  • Requiring persons licensed under the law to provide consumer and investor disclosures, to better inform of risks, possible conflicts of interest, and fees. 
  • Requiring persons licensed under the law to provide 10 hours of live customer phone support on weekdays to better serve California residents.
  • Prohibiting the offering of stablecoins to California residents unless the stablecoin meets reserve requirements and other obligations that protect California residents when they redeem stablecoins.
  • Creates a range of protections when using digital financial asset kiosks, including limiting how much money can be accepted or dispensed by a kiosk operator in a day from a single customer, capping transaction fees, and mandating the provision of detailed receipts and disclosures.

• Persons (whether an individual or company) who engage in, or hold themselves out as engaging in, the exchange, transfer, or store digital financial assets with, or on behalf of, California residents.
• Persons who issue digital financial assets with the authority to redeem the digital financial assets for money or another digital financial asset.
• Persons who issue electronic certificates representing interests in precious metals or who hold such certificates for others.
• Persons who exchange digital representations of value used within online games for money or certain digital financial assets. However, this does not include digital representations of value issued by or on behalf of a publisher and used solely within an online game, game platform, or family of games sold by the same publisher or offered on the same game platform.

Any DFAL license applicant should thoroughly review DFAL before submitting an application. Some of the obligations of holding a DFAL license include:

• Maintenance of certain policies and procedures relating to security, risk management, fraud prevention, and compliance.
• Maintenance of minimum capital and liquidity amounts as determined by the DFPI to protect California residents.
• Maintenance of a surety bond or trust account in an amount to be determined by the Department in order protect California residents.
• Maintenance of records, preparation of reports, and submitting to supervision and examination by the Department.

 Licensees will be required to provide comprehensive disclosures to California residents,   including:

• A schedule of fees and charges.
• Whether the licensee’s products and services are insured.
• Whether a licensee is liable for unauthorized, mistaken, or accidental transfers or exchanges.
• Whether a resident has a right to stop a preauthorized payment or revoke authorization for a transfer.
• Detailed receipts.
• A list of the instances in the past 12 months when the licensee’s service was unavailable to 10,000 or more customers due to a service outage.

Financial Code section 3103 lists several exemptions, including certain banks, persons that only provide certain connectivity software or computing power to decentralized networks, and persons who reasonably expect to make less than $50,000 annually from activity otherwise subject to DFAL licensure.

In general, beginning July 1, 2025, any entity engaging in any “digital financial asset business activity” with or on behalf of a California resident will require a DFAL license, regardless of holding a license in another state. Persons who have a pending DFAL license application with the DFPI that are also authorized to conduct DFAL-like activities in New York may receive a conditional license.

The DFAL license does not replace any other licenses required under California law, and business activities should be carefully reviewed to ensure proper licensure.

DFPI plans to publish the application, related instructions, and materials in 2025. DFAL provides for DFPI to use the National Multi-State Licensing System (NMLS) to administer its acceptance of applications and maintenance of licenses, including for the provision of fingerprints from required persons of applicants. Once released, application and document submission will be managed via NMLS.

On or before February 28 each year, licensees and applicants will be billed their pro rata cost share of all costs and expenses reasonably incurred in the administration of the licensing program for the ensuing year and any deficit incurred or anticipated in the administration of the program in the year of the assessment and the preceding year.

DFAL also authorizes DFPI to bill licensees for the reasonable and necessary costs of examinations.

Yes, the DFPI may examine licensees and their agents to ensure compliance with DFAL.

DFAL enables DFPI to provide informal guidance to prospective applicants. DFPI is currently developing that process, along with other DFAL processes. Please visit the DFAL website to track DFPI updates and consider participating in DFPI’s DFAL implementation regulatory process.

In the meantime, if you are a prospective DFAL licensee, or have a question about how the law affects your business, join our email list to receive future updates or email crypto@dfpi.ca.gov.

Beginning January 1, 2024, a kiosk operator must provide the Department a list of all       kiosk locations that an operator owns, operates, or manages in the state.

• An operator is defined as a person who owns, operates, or manages a digital financial asset transaction kiosk located in this state.
• Additionally, by January 1, 2024, an operator (1) may not dispense or accept more than $1,000 in a day to or from a customer via kiosks and (2) must provide a customer with a receipt with specified information for any transaction made at the operator’s kiosk.

Beginning January 1, 2025, kiosk operators must provide pre-transaction disclosures to customers and are prohibited from collecting from customers in any single transaction the greater of $5 or 15% of the U.S. dollar equivalent of digital financial assets involved in the transaction.

By July 1, 2025, operators must comply with the licensing requirements stated in the law.

Learn more on the Kiosk Operators webpage.

DFAL requirements related to stablecoin issuers depend on the characteristics of the stablecoin. The DFPI will be publishing more on stablecoins in the future.