California's Digital Financial Assets Law (DFAL) takes effect July 1, 2026 — 24 days from now. Any entity exchanging, transferring, storing, or issuing digital financial assets for California residents must hold a state license, have a pending application on file, or qualify for an exemption by t...
"Clear rules tend to attract serious operators and institutional capital, but marginal or under-resourced players may choose to exit." — Joe Ciccolo, Executive Director, California Blockchain Advocacy Coalition
California's Digital Financial Assets Law (DFAL) takes effect July 1, 2026 — 24 days from now. Any entity exchanging, transferring, storing, or issuing digital financial assets for California residents must hold a state license, have a pending application on file, or qualify for an exemption by that date. Noncompliance carries penalties up to $100,000 per day.
The state hosts approximately one-quarter of all U.S. blockchain companies. The DFPI has already imposed over $2.4 million in fines and restitution across at least five enforcement actions since mid-2025, shutting down crypto kiosk operators and penalizing unlicensed lenders months before the licensing deadline arrives. Governor Newsom's appointment of Claudia Quiroz — former director of the DOJ's National Cryptocurrency Enforcement Team — as DFPI General Counsel in November 2025 signals that enforcement intensity will increase, not decrease.
The parallels to New York's 2015 BitLicense are direct. That regime drove firms including Kraken and Bitfinex out of the state entirely. California's version arrives a decade later, in a market now contending with parallel federal legislation — the Clarity Act — which passed the Senate Banking Committee 15-9 on May 14 and targets a floor vote by July. Whether federal preemption will eventually override state licensing regimes remains unresolved. For now, legal counsel uniformly advises against betting on it.
The Digital Financial Assets Law comprises two pieces of legislation: Assembly Bill 39 (AB 39) and Senate Bill 401 (SB 401), signed by Governor Newsom in October 2023. Governor Newsom subsequently signed AB 1934 on September 29, 2024, extending the compliance deadline from July 1, 2025, to July 1, 2026.
The DFPI began accepting license applications via the Nationwide Multistate Licensing System (NMLS) on March 9, 2026. Covered activities include:
Applicants face an initial requirement of $100,000 in tangible net worth and a $500,000 surety bond, according to DFPI guidance — both subject to upward adjustment based on operational complexity. Stablecoin issuers must maintain 100% backing in high-quality liquid assets, including U.S. Treasury securities, agency bonds, and rated municipal bonds. Licensees must maintain capital and liquidity in amounts the DFPI deems sufficient under Financial Code § 3207, and the regulator retains authority to require increases at any time.
Entities with annual revenue below $50,000 from covered activities qualify for an exemption. Banks, certain broker-dealers, and government entities are also exempt.
The DFPI has moved aggressively against operators well before the July 1 deadline, establishing precedent and deterrence simultaneously. Confirmed enforcement actions include:
| Entity | Penalty | Restitution | Date | Violation | |--------|---------|-------------|------|-----------| | Nexo Capital Inc. | $500,000 | — | Jan 14, 2026 | Unlicensed lending to 5,456 CA borrowers | | Evergreen ATM (Getcoins) | $1,000,000 (suspended) | — | Jan 16, 2026 | Excess fees, AML failures | | LSGT Services (Coinhub) | $675,000 | $105,000 | Nov 2025 | DFAL violations at kiosks | | Coinme, Inc. | $300,000 | $51,700 | Jun 2025 | First-ever DFAL enforcement action | | RockItCoin | $75,000 | $202,000 | 2025 | Consumer overcharges | | Anh Management (Hermes Bitcoin) | $9.9M (suspended) | — | May 2026 | Excess fees, ordered to cease by May 20 |
The Nexo action is notable for its scope: the DFPI found that the Cayman Islands corporation originated loans with approximately 5,000 California consumers between July 2018 and November 2022 without a finance lender license. The agency determined that Nexo's practice of overcollateralizing loans "was not a substitute for evaluating" borrower repayment ability.
The Hermes Bitcoin settlement carries the largest potential penalty — $9.9 million — if the operator fails to comply with settlement terms. The company operated 42 kiosks in Southern California.
Crypto ATM kiosks have become the primary enforcement target under DFAL, and for quantifiable reasons. According to data published by the DFPI and analyzed by TRM Labs, California hosts over 4,500 crypto ATM locations, with the largest concentrations in Los Angeles, San Diego, and Sacramento.
TRM Labs' analysis of 30+ crypto kiosk operators found that 84% of illicit activity connected to kiosks involved scams. Cash-to-crypto illicit volumes represented 1.2% of total kiosk volume — double the 0.63% industry average for crypto exchanges. In 2023, 79% of cash-to-crypto illicit volume went to known scam addresses.
SB 401 imposed specific requirements on kiosk operators effective January 1, 2024:
Enforcement actions against Getcoins, Coinhub, Coinme, and Hermes Bitcoin all cited violations of these provisions — processing transactions above the daily cap, charging excess fees, and printing receipts that omitted required spread transparency information.
New York's BitLicense, established in 2015, remains the most direct comparison. Since inception, the New York Department of Financial Services (NYDFS) has issued fewer than 50 BitLicenses. Recent 2026 recipients include Mastercard (May 27, 2026), Zap Solutions (Strike), and GalaxyOne Prime — signaling that institutional-grade firms continue to find the compliance burden worthwhile.
The application process typically requires 12 to 24 months from initial preparation to final approval. The BitLicense application fee is $5,000 with a minimum $500,000 surety bond.
California's DFAL mirrors this structure but arrives at a different scale. Key differences:
The BitLicense precedent suggests that a licensing requirement of this scope will result in some firms exiting. Kraken and Bitfinex both withdrew from New York rather than comply. Whether California sees a comparable exodus depends on the compliance economics for individual firms and whether federal legislation intervenes.
The Digital Asset Market Clarity Act (H.R. 3633), introduced by House Financial Services Chairman French Hill on May 29, 2025, passed the Senate Banking Committee 15-9 on May 14, 2026. Democratic Senators Ruben Gallego (AZ) and Angela Alsobrooks (MD) joined all committee Republicans to advance the bill.
The legislation was placed on the Senate Legislative Calendar under General Orders on June 1 (Calendar No. 423). White House officials have targeted a July 4 signing, though multiple lawmakers have indicated end-of-July or early August is more realistic. About eight weeks of floor time remain before the summer recess. A floor vote requires 60 senators.
On preemption, the Clarity Act's language is narrow. It supersedes state securities and digital asset licensing laws only for core development activities under §15H(b). States retain full authority over anti-money laundering, anti-fraud, and anti-manipulation enforcement. Legal advisors at Whiteford, Taylor & Preston and Baker McKenzie have counseled clients to avoid reliance on imminent federal preemption and to build adaptable multi-state compliance models.
If the Clarity Act passes with its current preemption scope, state regimes like DFAL would likely remain operative for exchange, custody, and kiosk operations. Only development-related activities would fall under exclusive federal jurisdiction.
California's position as the world's fourth-largest economy makes DFAL compliance a default requirement for any firm seeking U.S. market reach. The state's approximately 25% share of domestic blockchain companies means the licensing deadline affects a disproportionate share of the industry.
The compliance cost structure creates a natural filter. At $100,000 minimum net worth, a $500,000 surety bond, and ongoing capital requirements subject to DFPI discretion, the barrier is manageable for venture-backed companies and institutional operators. It is less manageable for smaller exchanges, DeFi front-ends, and kiosk operators running on thin margins.
The $50,000 annual revenue exemption provides a narrow safe harbor for hobby-scale operations but excludes virtually any commercial-grade service.
The compressed application timeline — 114 days from when NMLS began accepting applications to the compliance deadline — adds operational pressure. Firms that had not begun compliance preparation before March 9 face a difficult path to meeting the July 1 deadline, even with the provision allowing continued operation while an application is pending.
California's DFAL represents the most consequential state-level crypto licensing event since New York's 2015 BitLicense. The combination of market scale — one-quarter of domestic blockchain firms — pre-deadline enforcement actions totaling millions in penalties, and a compressed compliance timeline creates material operating risk for firms that have not initiated licensing.
The federal picture offers no near-term relief. Even optimistic Clarity Act timelines extend to July at the earliest, and the bill's preemption provisions would not displace state exchange or custody licensing. Firms operating in California without a license or pending application after July 1 face daily penalties of up to $100,000 and potential cease-and-desist orders, as multiple kiosk operators have already experienced.
The data from New York's BitLicense era and the DFPI's early enforcement actions point to a predictable outcome: institutional and well-capitalized operators will absorb compliance costs, smaller firms will face consolidation or exit, and enforcement will intensify after the deadline passes. The question is not whether California will enforce DFAL. The DFPI has already answered that.