Entities subject to California’s new Digital Financial Assets Law (“DFAL”), signed by Governor Newsom on October 13, 2023, must either be licensed or have applied through the Nationwide Multistate Licensing System (“NMLS”) for regulatory review by July 1, 2026. The DFAL creates a regulatory framework, including licensure and enforcement authority, for certain crypto activities related to virtual currency exchanging and trading services, including exchanging, transferring, storing, and issuing digital financial assets.
Assembly Bill 39 (AB 39) and Senate Bill 401 (SB 401) together comprise the DFAL. The sponsors of the DFAL argued that “AB 39 will promote a healthy and sustainable crypto asset market by licensing and regulating businesses that help Californians buy and sell these new digital financial products. While crypto assets have the potential to empower consumers and disrupt the financial sector in unexpected ways, their high volatility and the prevalence of fraud, illicit behavior, and technical and security vulnerabilities expose California consumers to significant financial harm.”1 SB 401 addressed cryptocurrency kiosks, stating, “SB 401 establishes consumer protections for crypto kiosks to reduce fraud and other criminal activity and rein-in high mark-ups on crypto transactions.” The bill mitigates the risk of transactions related to fraud and other criminal activity by limiting the amount of transactions to no more than $1,000 per customer per day.
The bill also requires an operator of a crypto kiosk to provide a detailed receipt to a consumer with specified information about the transaction and caps the transaction fees that operators can charge to no more than $5 or 15% of the value of the transaction, whichever is greater.”2 The DFAL addresses the risks posed by crypto kiosks in several ways. In response to concerns about the use of crypto kiosks for fraud and other criminal activity, it seeks to mitigate the size of financial harm related to fraud and deter the use of kiosks by criminal organizations by limiting the size of transactions that any person can initiate to $1,000 per day. To improve oversight of the industry, this bill requires operators to provide DFPI with the locations of all kiosks, which DFPI is required to post online, and to be licensed pursuant to AB 39 (Grayson). Supporters of the bill believe that these requirements create transparency and impose licensure requirements that will help both DFPI and local law enforcement crackdown on unregistered kiosks that they discover when investigating complaints.
On September 29, 2024, AB 1934 extended the initial required license date from July 1, 2025 to July 1, 2026.3 The DFAL has been codified under California Financial Code § 3101 et. seq.
The DFAL was created with a goal of providing a comprehensive regulatory program for many crypto companies, and in that regard DFAL requires DFPI to license and supervise many crypto asset-related companies that serve California residents and establishes certain consumer protections for users. These protections include:
- Providing the DFPI with the authority to license, supervise, and examine crypto asset-related companies, including digital financial asset businesses, custodians, and stablecoin issuers.
- Requiring that persons licensed under the law maintain sufficient capital and liquidity to ensure that licensees can meet their obligations to California residents.
- Requiring digital financial asset businesses to protect the public from scams and frauds by investigating assets before listing those assets for sale to California residents.
- Requiring that licensees hold sufficient digital financial assets to satisfy residents’ entitlements.
- Requiring persons licensed under the law to provide consumer and investor disclosures, to better inform them of risks, possible conflicts of interest, and fees.
- Requiring persons licensed under the law to provide 10 hours of live customer phone support on weekdays to better serve California residents.
- Prohibiting the offering of stablecoins to California residents unless the stablecoin meets reserve requirements and other obligations that protect California residents when they redeem stablecoins.
- Creates a range of protections when using digital financial asset kiosks, including limiting how much money can be accepted or dispensed by a kiosk operator in a day from a single customer, capping transaction fees, and mandating the provision of detailed receipts and disclosures.
Persons Required to Obtain a DFAL
- Persons (whether an individual or company) who engage in, or hold themselves out as engaging in, the exchange, transfer, or store digital financial assets with, or on behalf of, California residents.
- Persons who issue digital financial assets with the authority to redeem the digital financial assets for money or another digital financial asset.
- Persons who issue electronic certificates representing interests in precious metals or who hold such certificates for others.
- Persons who exchange digital representations of value used within online games for money or certain digital financial assets. However, this does not include digital representations of value issued by or on behalf of a publisher and used solely within an online game, game platform, or family of games sold by the same publisher or offered on the same game platform.
Despite these requirements, the DFAL license does not replace any other licenses that may be required under California law. Further, the DFAL requirements related to stablecoin issuers depend on the characteristics of the stablecoin, requiring an in-depth review regarding potential applicability.
Exemptions
Cal. Fin. Code § 3103 lists several exemptions, including certain banks, persons that only provide certain connectivity software or computing power to decentralized networks, and persons who reasonably expect to make less than $50,000 annually from activity otherwise subject to DFAL licensure.
Merchants accepting digital assets as payment for goods or services do not fall under the definition of who must obtain DFAL licenses and are not subject to the DFAL licensing requirements.
Licensing Obligations
Some of the obligations of holding a DFAL license include:
- Maintenance of certain policies and procedures relating to security, risk management, fraud prevention, and compliance.
- Maintenance of minimum capital and liquidity amounts as determined by the DFPI to protect California residents.
- Maintenance of a surety bond in an amount of no less than $500,000 or trust account in an amount to be determined by the Department in order protect California residents.
- Maintenance of records, preparation of reports, and submitting to supervision and examination by the Department.
Entities currently conducting business with California residents that will require obtaining a DFAL license should review the published regulatory license checklist found on the NMLS Resource Center and prepare for application no later than the July 1, 2026 deadline.
1 AB 39, Assembly Floor Analysis, September 12, 2023 (https://leginfo.legislature.ca.gov/faces/billAnalysisClient.xhtml?bill_id=202320240AB39#)
2 SB 401, Senate Rules Committee Analysis, September 14, 2023 (202320240SB401_Senate Floor Analyses.pdf) (“A digital financial asset transaction kiosk (more colloquially known as a “crypto kiosk”) is a physical machine that allows a consumer to buy and sell crypto assets, like bitcoin or ether, using cash, debit or credit card, or bank transfer. Crypto kiosks are often found in grocery, convenience, or liquor stores, and generally target consumers who are less technologically savvy and less knowledgeable about crypto markets than consumers who purchase crypto assets on online and mobile platforms, such as Coinbase and Kraken. Operators of crypto kiosks are not subject to any state oversight or regulation of their business practices. The Department of Financial Protection and Innovation has not deemed crypto assets as “money” under state money transmission laws, and California has yet to enact a regulatory framework for crypto-related business activities.”).
3 AB 1934. 3201 (Finance Code 3201: “On or after July 1, 2026, a person shall not engage in digital financial asset business activity, or hold itself out as being able to engage in digital financial asset business activity, with or on behalf of a resident unless any of the following is true: (a) The person is licensed in this state by the department under Section 3203. (b) The person submits an application on or before July 1, 2026, and is awaiting approval or denial of that application. (c) The person is exempt from licensure under this division pursuant to Section 3103.”). (Bill Text – AB-1934 Digital financial asset businesses.)
