California’s Digital Financial Assets Law (DFAL) licensing requirements went live on July 1, 2026, establishing a comprehensive licensing, supervisory, and enforcement framework for digital asset businesses operating in or serving California. Administered by the Department of Financial Protection and Innovation (DFPI), the law applies broadly to entities such as crypto exchanges, wallet providers, crypto kiosks, and transaction facilitators.
The regulatory landscape for digital assets continues to rapidly change, with California implementing these changes around the same time as DFAL’s effective date:
On June 30, 2026, Governor Newsom signed SB 97 into law, an “urgency statute” amending DFAL that went into immediate effect. Most notably, SB 97 repealed the DFAL provisions governing stablecoins, making clear that stablecoin issuers are not required to obtain a DFAL license, in light of the evolving federal framework under the GENIUS Act.
The bill also makes various technical clarifications, including:
SB 97 repeals in its entirety Chapter 6 of DFAL, which specifically governed the regulation of stablecoins. DFAL’s now-repealed Chapter 6 would have prohibited a covered person from exchanging, transferring, or storing a digital financial asset that is a stablecoin or engaging in digital financial asset administration of a stablecoin unless specified conditions were satisfied. It also established a separate California framework under which the DFPI could recognize qualifying stablecoin issuers and impose stablecoin-specific conditions and oversight. SB 97 repeals these provisions in light of the ongoing implementation of the GENIUS Act.
According to the bill’s author, California Senator Tim Grayson, “with the enactment of federal law related to stablecoins in July 2025, DFAL needed to be updated to reflect the growing federal role in that space,” including the preemptive effect of the federal law on the ability of California to regulate stablecoins at the state level. Nevertheless, entities engaging in stablecoin-related activities should continue to evaluate whether their activities constitute covered digital financial asset business activity under DFAL’s broader licensing framework, as such activities may still require licensure, notwithstanding the repeal of Chapter 6.
In general, entities that wish to engage in digital financial asset business activity must have obtained a license from the DFPI or have submitted an application on or before July 1, 2026 and be awaiting a decision on that application. SB 97 updates this standard, specifying that entities must have submitted a completed application, rather than a placeholder application to get a foot in the door of the DFAL licensing regime. Entities that did not submit a completed application by July 1, 2026, including businesses formed or entering the California market after that date, must obtain a DFPI license before commencing covered digital financial asset business activity in California.
Digital asset businesses should pay particular attention to this completed application standard to qualify for DFAL’s safe harbor. Applicants that have already filed may wish to confirm with the DFPI that their application has been deemed complete. The DFAL application process is rigorous and iterative, requiring detailed disclosures on governance, risk management, cybersecurity, financial condition, and consumer protection practices.
SB 97 removes certain assets from the coverage of the DFAL regime, including:
DFAL also established a conditional license pathway, allowing the DFPI to issue conditional licenses to applicants holding or maintaining a license to conduct virtual currency business activity under New York’s BitLicense regime or as a New York limited-purpose trust company charter authorizing virtual-currency business activity. The cutoff to qualify for this conditional license pathway originally required an entity’s New York license to have been issued or approved no later than January 1, 2023. SB 97 revises this cutoff date, allowing the entity’s New York license to have been issued or approved no later than January 1, 2025, significantly expanding the conditional license pathway.
SB 97 clarifies the definition of “control,” when used in reference to a digital financial asset transaction, to mean the “power to execute unilaterally or prevent indefinitely a digital financial asset transaction, unless the power to prevent indefinitely is limited to the ability to terminate, suspend, or interrupt a transaction solely in response to unauthorized or fraudulent activity.”
The bill also clarifies that, when used in reference to a person, control means “the direct or indirect power to . . . vote 25 percent or more of any class of the voting securities issued by a person . . . [or] direct or cause the direction of the management and policies of a person, whether through the ownership of voting securities, by contract . . . or otherwise.”
Changes to Reporting, Disclosure, and Operational Requirements
SB 97 revises the DFAL annual reporting requirements, requiring licensees to report a description of any material data security breach or cybersecurity event of the licensee, rather than any data security event. It also revises the requirement to file reports of a change in the licensee’s business to instead include only those proposed changes that might raise material safety and soundness or operational concerns.
The bill also revises certain disclosure and operational requirements, clarifying when certain consumer disclosures must be included separately, requiring the provision of up-to-date order execution practices, and prohibiting DFAL’s 14-day prior notice requirement for material changes from applying to changes in terms, conditions, or policies that are reasonably necessary to address a risk of loss to the resident or covered person, to the extent that the change does not relate to the fee schedule.
The DFPI has been engaged in both informal and formal DFAL rulemaking for several years, and its initial rulemaking submission was rejected by OAL before ultimately securing approval. Following targeted revisions addressing the OAL’s comments, the DFPI resubmitted the DFAL rulemaking, which was approved on June 29, 2026.
The finalized regulations are significant because they provide the first implementing guidance under DFAL and, in particular, establish the framework governing the interaction between DFAL and the California Money Transmission Act.
The regulations establish a comprehensive licensing framework for DFAL applicants, including:
The regulations also define key concepts such as “control,” incorporate the NMLS Forms MU1 and MU2, as well as the DFPI Form 2 filings for personal financial information for officers and directors, and establish detailed supervisory expectations for ongoing compliance for licensed entities.
The regulations create three targeted exemptions from separate California Money Transmission Act (MTA) licensure for DFAL-regulated businesses to reduce duplicative regulation where DFAL-regulated activity also involves related fiat movement. The exemptions cover:
Lastly, on June 22, 2026, Governor Newsom convened the first meeting of California’s Tech Fraud Task Force as part of the Governor’s Innovation Council. The Innovation Council was first announced in December 2025 to bring together state agencies, experts, and technology leaders to leverage opportunities and address risks posed by emerging technologies.
The Tech Fraud Task Force, a key component of the Innovation Council, is co-led by the DFPI in collaboration with the Business, Consumer Services, and Housing Agency. Following the July 1 agency reorganization, that role is expected to transition to the new Business and Consumer Services Agency. The Task Force includes major technology companies, financial industry associations, consumer advocacy organizations, and blockchain analytics firms, among others. As Governor Newsom stated, “California has helped build the modern digital world, and we can’t allow bad actors to twist that progress into a tool for fraud. Tackling consumer fraud is critical to protecting affordability for Californians. The scope and scale of the problem require an all-of-California approach.”
The establishment of the Task Force signals California’s continued and heightened focus on technology-enabled financial fraud, and digital asset and fintech businesses operating in or serving California should anticipate increased regulatory scrutiny and coordinated enforcement efforts across state agencies.