California's Digital Financial Assets Law (DFAL) licensing mandate took effect July 1, 2026, imposing a $100,000-per-day penalty on any unlicensed exchange, custodian, or crypto kiosk operator serving the state's 39 million residents. The DFPI began accepting applications on March 9, 2026, throug...
"This enforcement action should send a strong message to kiosk operators that California means business when it requires digital asset companies to follow the rules that help prevent scammers from taking advantage of unsuspecting Californians." — KC Mohseni, Commissioner, California Department of Financial Protection and Innovation
California's Digital Financial Assets Law (DFAL) licensing mandate took effect July 1, 2026, imposing a $100,000-per-day penalty on any unlicensed exchange, custodian, or crypto kiosk operator serving the state's 39 million residents. The DFPI began accepting applications on March 9, 2026, through the Nationwide Multistate Licensing System (NMLS), giving firms fewer than four months to compile financial statements, surety bonds, BSA/AML audits, and cybersecurity documentation.
The state hosts approximately 25% of the nation's blockchain firms and more than 4,500 crypto kiosk locations. Enforcement actions have already yielded measurable results: Coinme was ordered to pay $300,000 in penalties and $175,000 in consumer refunds for overcharging; Hermes Bitcoin's 42 Southern California kiosks were shut down after 14,120 disclosure violations and 3,006 illegal transactions; and Nexo Capital received a $500,000 fine for extending 5,456 unlicensed loans to Californians. On June 30, Governor Newsom signed SB 97, an urgency statute that carved stablecoins out of DFAL's scope, deferring to the federal GENIUS Act framework. The net effect is the most aggressive state-level crypto enforcement apparatus in the United States since New York introduced BitLicense in 2015.
DFAL, signed by Governor Newsom in October 2023, covers four categories of digital financial asset business activity requiring licensure:
The law applies to any entity serving "California residents," defined as individuals domiciled in the state, physically present for more than 183 days in the prior 365, or maintaining a California place of business. The scope captures exchanges, wallet providers, custodians, DeFi interfaces with custodial elements, and crypto kiosk operators.
Exemptions exist for FDIC-insured banks and credit unions, SEC-registered broker-dealers, CFTC-regulated entities, government bodies, and businesses with expected annual California digital asset revenue below $50,000. Non-custodial wallet providers that do not exercise control over user assets are also exempt.
The original licensing deadline was July 1, 2025. Governor Newsom signed AB 1934, extending it by one year to July 1, 2026, to allow the DFPI to finalize its rulemaking process and give firms additional preparation time.
The financial requirements for a DFAL license are substantial:
| Requirement | Amount | |---|---| | Application fee | $7,500 + DFPI review costs | | Minimum surety bond | $500,000 | | Minimum tangible net worth | $100,000 | | Record retention period | 5 years |
Final surety bond and net worth requirements are determined by the DFPI based on transaction volumes, business model complexity, and risk profile. The $500,000 bond minimum represents a floor, not a ceiling.
Applicants must submit an independent review of their Bank Secrecy Act / anti-money laundering program. Information security programs are assessed against the NIST Cybersecurity Framework 2.0. Background checks are required for all control persons. These requirements represent a compliance burden that mirrors — and in some areas exceeds — the standards applied under New York's BitLicense.
According to Joe Ciccolo, executive director of the California Blockchain Advocacy Coalition, DFAL could "standardize compliance nationally" while potentially displacing operators that lack the resources to meet its requirements. The DFPI has indicated it may issue conditional licenses to applicants that already hold a New York BitLicense, acknowledging partial regulatory equivalence.
The DFPI has not waited for the licensing deadline to act. A series of enforcement actions since mid-2025 demonstrates the agency's willingness to use its authority:
Coinme (June 2025 – March 2026)
Hermes Bitcoin / Anh Management LLC (May 2026)
Nexo Capital Inc. (January 2026)
Cumulative enforcement penalties to date exceed $1.1 million across these three cases, with an additional $1 million suspended against Coinme. The DFPI has signaled through Commissioner Mohseni's public statements that enforcement activity will increase in the second half of 2026.
California's crypto kiosk market sits at the center of the enforcement push. DFPI data shows more than 4,500 kiosk locations across the state, concentrated in Los Angeles, San Diego, and Sacramento. Nationally, more than 30,000 Bitcoin ATMs operate across the United States.
The industry's fraud profile is acute. According to TRM Labs analysis of DFPI-released data, 84% of illicit activity connected to California crypto kiosks involves scams. Illicit transaction volume at kiosks runs at 1.2% of total cash-to-crypto volume — nearly double the 0.63% rate across the broader crypto ecosystem. TRM identified a single exchange address that received funds from 40 different North American ATM locations, flagged as a scammer aggregation point.
The FBI reported $333 million in Bitcoin ATM-related fraud losses nationally in 2025, up 57% from $247 million in 2024, based on more than 12,000 complaints.
California's kiosk-specific regulations, in effect since January 1, 2024, impose:
Bitcoin Depot, the largest operator nationally with approximately 9,700 machines, reported Q4 2025 revenue of $116 million, down 15% year-over-year, with analysts projecting a further 30-40% decline in 2026. Two states — Indiana and Tennessee — have imposed outright bans on crypto kiosks. Additional municipalities have enacted local prohibitions.
"The operators standing in five years will be the ones who invested in compliance while others cut corners," said Andrew Barnard, CEO of Bitstop, which operates approximately 2,700 kiosks across the US and Puerto Rico.
On June 30, 2026 — one day before the DFAL licensing deadline — Governor Newsom signed SB 97, an urgency statute that took immediate effect. The bill repealed Chapter 6 of DFAL in its entirety, removing all stablecoin-specific provisions from the state framework.
The rationale, according to the bill's author: "With the enactment of federal law related to stablecoins in July 2025, DFAL needed to be updated to reflect the growing federal role in that space," including the preemptive effect of the GENIUS Act on California's ability to regulate stablecoin issuance at the state level.
SB 97 also introduced technical and clarifying amendments to the broader DFAL framework. The Crypto Council for Innovation submitted a formal support letter to Governor Newsom on July 13, endorsing the carve-out.
A critical caveat remains: entities engaging in stablecoin-related activities may still require licensure under DFAL's broader definitions if their operations constitute exchange, transfer, storage, or administration of digital financial assets. The stablecoin exemption removes a dedicated regulatory chapter but does not create a blanket exclusion from DFAL's general licensing requirement.
DFAL enters enforcement at a moment of heightened federal regulatory activity. The SEC has added three crypto-specific items to its July 2026 agenda — rules for crypto asset offerings, broker-dealer capital requirements for digital assets, and crypto market structure amendments. The CLARITY Act, which passed the House in July 2025, faces a narrow Senate window before the August 2026 recess.
California's framework creates a layered compliance obligation. Firms may need to satisfy DFAL requirements, existing Money Transmitter Act obligations, any applicable SEC or CFTC registration, and — if the CLARITY Act passes — new federal commodity classification rules. The DFPI has acknowledged this complexity, proposing regulations that address the interaction between DFAL and the Money Transmitter Act.
The comparison to New York's experience is instructive. When the NYDFS introduced BitLicense in 2015, firms including Kraken and Bitfinex exited the state rather than absorb compliance costs. California's approach attempts to mitigate a similar exodus through conditional licensing provisions for BitLicense holders and a more standardized application process via NMLS.
However, with 25% of the nation's blockchain firms based in California, the stakes are materially higher. A significant compliance-driven departure would concentrate the industry in jurisdictions with lighter oversight — precisely the outcome state regulators aim to prevent.
Louisiana has adopted a framework under its Virtual Currency Business Act that mirrors BitLicense. Illinois has granted its Department of Financial and Professional Regulation authority over digital asset exchanges. Texas maintains a lighter approach, with bonding requirements starting at $25,000 and no heavy capital mandates for basic exchange activity.
California's DFAL represents the most consequential state-level crypto licensing regime since New York's BitLicense. The law's scope — covering approximately one-quarter of all US blockchain firms and over 4,500 kiosk locations — gives it outsized influence on national compliance standards. The DFPI's pre-deadline enforcement actions against Coinme, Hermes Bitcoin, and Nexo signal an agency prepared to use its authority aggressively.
The SB 97 stablecoin carve-out reflects a pragmatic adjustment to federal preemption under the GENIUS Act, but the broader DFAL framework remains intact and expansive. The $500,000 surety bond floor, NIST 2.0 cybersecurity requirements, and independent AML audit mandates set a compliance standard that will filter out undercapitalized operators — whether that serves consumer protection or market concentration is a question the data will answer over the next 12 months.
The economic value distribution implications are clear. Compliance costs represent a new and significant extraction layer in the digital asset value chain. Operators must now allocate substantial resources to licensing, bonding, legal counsel, and ongoing regulatory reporting — costs that will either be passed to consumers through higher fees or absorbed through compressed margins. For an industry built on the premise of disintermediation, California's framework introduces a layer of intermediation that the market has not yet fully priced.