California's Digital Financial Assets Law (DFAL) takes effect July 1, 2026. Six days from now, any entity exchanging, transferring, storing, or issuing digital assets for California's 8.2 million crypto-holding residents must hold a DFAL license, have a completed application on file with the DFPI...
"We will not hesitate to pursue actions against those who defraud Californians and flout our laws." — KC Mohseni, Commissioner, California Department of Financial Protection and Innovation
California's Digital Financial Assets Law (DFAL) takes effect July 1, 2026. Six days from now, any entity exchanging, transferring, storing, or issuing digital assets for California's 8.2 million crypto-holding residents must hold a DFAL license, have a completed application on file with the DFPI, or qualify for a statutory exemption. Those that do not face enforcement action in the nation's largest state economy.
The DFPI opened license applications on March 9, 2026, via the Nationwide Multistate Licensing System (NMLS). Applicants must demonstrate at least $100,000 in tangible net worth, post a $500,000 surety bond, submit an independent BSA/AML program review, and maintain reserves matching aggregate customer digital asset holdings. The regime is the most prescriptive state-level crypto licensing framework since New York's BitLicense launched in 2015 — a regime that issued fewer than 50 licenses in a decade and triggered an exodus of major platforms including Kraken and Bitfinex from the state.
The DFPI has already signaled aggressive enforcement. Since June 2025, the agency has levied over $10 million in penalties and restitution orders across at least four enforcement actions targeting crypto kiosk operators alone. The Hermes Bitcoin shutdown in May 2026 — involving 14,120 documented violations and a suspended $9.9 million penalty — marks the most significant DFAL action to date.
Governor Gavin Newsom signed the Digital Financial Assets Law (AB 39) on October 13, 2023. The original enforcement date of July 1, 2025, was extended by one year through AB 1934, signed September 29, 2024, giving industry additional time to prepare.
DFAL covers five categories of digital financial asset business activity conducted with or on behalf of California residents:
The law applies to any entity serving California residents, regardless of where the entity is incorporated or headquartered. California's adult population of approximately 30.3 million includes an estimated 8.2 million crypto holders — roughly 27% of the state's adults, according to Coinpaper data. This makes the state the largest single-jurisdiction crypto consumer market in the United States.
The DFPI began accepting applications through NMLS on March 9, 2026. The agency published a preparation checklist and held industry training on March 23.
Minimum requirements for applicants include:
| Requirement | Threshold | |---|---| | Tangible net worth | $100,000 minimum | | Surety bond | $500,000 starting amount | | BSA/AML program | Independent review required | | Information security program | Development and maintenance required | | Reserve requirement | 1:1 match of aggregate customer digital asset holdings | | Compliance officer | Designated individual required |
Both the net worth and surety bond amounts are subject to adjustment by the DFPI based on activity volume, asset mix, leverage, liquidity, and customer protection considerations. This individualized assessment mirrors New York's approach under the BitLicense, where capital requirements are determined case-by-case.
The DFPI has not publicly disclosed the total number of applications received since March 9. Filings through NMLS may not appear immediately in public records.
DFAL carves out explicit exemptions for entities already subject to comparable federal or state oversight:
Additional activity-based exemptions apply to:
The exemption for SEC-registered broker-dealers and CFTC-regulated entities applies only when those entities are acting within their regulated capacity. Dealing in non-security digital assets outside that scope still requires a DFAL license.
The DFPI has moved with notable speed. Since launching DFAL enforcement in mid-2025, the agency has taken at least four public enforcement actions, all targeting crypto kiosk operators:
1. Coinme (June 2025) — First DFAL Action The DFPI's inaugural DFAL enforcement targeted Seattle-based Coinme, Inc. The agency found Coinme conducted transactions exceeding the $1,000 daily per-customer limit and issued more than 4,050 receipts missing required customer information. Penalty: $300,000 civil monetary penalty plus $51,700 in restitution. Coinme was required to submit compliance updates to the DFPI every 60 days for one year.
2. Coinhub (October 2025) — $675,000 Penalty The DFPI fined Coinhub $675,000, including $105,000 in restitution to California consumers. The agency found thousands of transactions conducted without collecting sufficient identifying information, violating both federal AML requirements and DFAL. According to the DFPI, many Coinhub kiosk customers were over 60 years old, raising vulnerability and elder fraud concerns.
3. Bitcoin ATM Crackdown — Operation Shamrock (October 2025) The DFPI joined a multi-agency effort providing law enforcement with education and resources to disrupt cybercriminals exploiting crypto kiosks. The operation specifically targeted scam-facilitation through Bitcoin ATMs.
4. Hermes Bitcoin (May 2026) — Largest Action to Date The DFPI ordered Anh Management, LLC (doing business as Hermes Bitcoin) to cease all 42 crypto kiosk operations in Southern California by May 20, 2026. The investigation documented 14,120 instances of missing or improper receipts and disclosures since January 1, 2024, fees exceeding statutory maximums, AML failures, and acceptance of cash exceeding the $1,000 daily limit. The settlement includes a suspended $9.9 million administrative penalty — payable in full if terms are violated — and permanently bars Hermes Bitcoin from digital financial asset business in California.
Separately, the DFPI fined Nexo Capital Inc. $500,000 in January 2026 for unlicensed lending to approximately 5,456 California borrowers between 2018 and 2022. While technically a lender licensing violation rather than a DFAL action, it demonstrates the DFPI's broader enforcement posture toward crypto entities.
The DFPI's enforcement focus on crypto kiosks reflects a deliberate policy priority. California hosts over 4,500 crypto kiosk locations, concentrated in Los Angeles, San Diego, and Sacramento, according to DFPI data analyzed by TRM Labs.
Senate Bill 401, which supplements DFAL, imposes specific requirements on kiosk operators:
The kiosk enforcement pattern is consistent across all four DFAL actions. Common violations include exceeding the $1,000 daily limit, charging fees above the statutory cap, issuing incomplete or missing receipts, and failing to collect adequate customer identification. The recurring pattern suggests systemic non-compliance in the kiosk segment rather than isolated infractions.
DFAL is frequently described as a "BitLicense-style" regime. The comparison is instructive but imprecise.
| Feature | New York BitLicense (2015) | California DFAL (2026) | |---|---|---| | Administering agency | NYDFS | DFPI | | Application system | Proprietary | NMLS (multi-state) | | Capital requirements | Case-by-case | $100K net worth + $500K bond (adjustable) | | AML requirements | Full BSA/AML program | Independent BSA/AML review | | Stablecoin provisions | Separate guidance | Integrated into statute | | Kiosk-specific rules | None | SB 401 supplements | | Licenses issued (to date) | Fewer than 50 in 10 years | Applications opened March 2026 | | Processing time | 12-24 months historically | Unknown |
New York's BitLicense became a cautionary tale. The $5,000 application fee and 12-to-24-month processing timeline, combined with extensive compliance requirements, led major platforms to exit the state. Kraken, Bitfinex, and ShapeShift stopped serving New York residents rather than apply. A decade later, the NYDFS has approved fewer than 50 licenses — though recent approvals of Mastercard (May 2026), Galaxy (May 2026), and Strike (March 2026) suggest institutional demand has normalized the process.
California's use of NMLS — the same system used by 50+ state banking regulators — could reduce processing friction. However, the individualized capital assessment process introduces uncertainty for applicants, and the DFPI has not published expected processing timelines.
DFAL integrates stablecoin regulation directly into the licensing framework. Key requirements:
These provisions run parallel to the federal GENIUS Act, which remains in Senate negotiations with updated text expected July 4, 2026. California's framework could serve as a de facto standard if federal legislation stalls further, given the state's market size.
The central question is whether DFAL will replicate the BitLicense exodus. Several structural differences suggest a different outcome.
Arguments for compliance: California's 8.2 million crypto holders represent a market too large for most exchanges and service providers to abandon. Unlike 2015, when the industry was nascent and retail volume was concentrated among early adopters, the 2026 market includes institutional participants — ETF issuers, custody providers, and payment firms — with compliance infrastructure already built for multi-state operations.
Arguments for caution: Smaller operators, particularly kiosk companies and niche DeFi interfaces, face proportionally higher compliance costs. The $500,000 surety bond alone would be prohibitive for operators earning less than $1 million annually. The $50,000 revenue exemption provides limited relief.
Industry observers cited by Decrypt note that if enforcement is perceived as "overly aggressive or misaligned with operational realities," activity could shift offshore or underground. The DFPI's concentration on kiosk operators — the segment with the highest documented consumer harm — suggests the agency is prioritizing consumer protection cases over broad industry sweeps.
Commissioner Mohseni has stated publicly that the DFPI is prepared to protect California consumers "regardless of what is happening in Washington," positioning DFAL as a backstop against stalled federal crypto legislation.
California is six days from activating the most comprehensive state-level crypto licensing regime since New York's BitLicense. The DFPI has spent the past 12 months building an enforcement track record — over $10 million in penalties, a permanent industry ban for one operator, and more than 14,000 documented violations in a single case — that signals the agency intends to enforce the July 1 deadline with consequence.
The law's scope is broad: exchanges, custodians, transfer providers, kiosk operators, and stablecoin issuers serving any of California's estimated 8.2 million crypto holders must comply. The financial thresholds — $100,000 net worth, $500,000 bond, 1:1 reserves — are manageable for large platforms but potentially prohibitive for smaller entrants.
Whether DFAL becomes the regulatory model or cautionary tale depends on execution. The DFPI's track record suggests an agency willing to enforce early, enforce heavily, and enforce independently of federal timelines. For the crypto industry, California's largest experiment in state-level digital asset regulation starts in less than a week.