California's Digital Financial Assets Law (DFAL) takes full effect on July 1, 2026, requiring every firm conducting digital-asset business with the state's 39.1 million residents to hold a license, have a completed application on file, or qualify for one of 17 statutory exemptions. The Department...
"Clear rules tend to attract serious operators and institutional capital." — Joe Ciccolo, Executive Director, California Blockchain Advocacy Coalition
California's Digital Financial Assets Law (DFAL) takes full effect on July 1, 2026, requiring every firm conducting digital-asset business with the state's 39.1 million residents to hold a license, have a completed application on file, or qualify for one of 17 statutory exemptions. The Department of Financial Protection and Innovation (DFPI) began accepting applications through the Nationwide Multistate Licensing System (NMLS) on March 9, 2026, giving the industry less than four months to comply. Firms that miss the deadline must cease serving California customers that day.
The law's scope is broad. It covers exchanges, custodians, wallet providers, stablecoin issuers, transaction facilitators, and the roughly 25% of U.S. blockchain firms headquartered in the state, according to Decrypt. Combined with SB 401's kiosk-specific rules — a $1,000 daily transaction cap and a fee ceiling of 15% or $5, whichever is greater — DFAL creates the most comprehensive state-level crypto regulatory framework since New York's BitLicense in 2015.
The DFPI has signaled the deadline is not symbolic. Since mid-2025, the regulator has issued at least four enforcement actions against crypto ATM operators alone, levying over $1.4 million in penalties and shutting down operators outright. The message to the industry: apply, qualify for an exemption, or exit California.
California's crypto licensing regime rests on three statutes. Assembly Bill 39 (AB 39), signed by Governor Gavin Newsom on October 13, 2023, established the core Digital Financial Assets Law. It grants the DFPI licensing authority over persons who exchange, transfer, store, or administer digital financial assets on behalf of California residents.
Senate Bill 401 (SB 401), signed the same day, addresses digital financial asset transaction kiosks — the physical machines commonly called crypto ATMs. SB 401 imposed a phased compliance schedule: location reporting and a $1,000 daily transaction cap took effect January 1, 2024. Fee caps (the greater of $5 or 15% of transaction value) and pre-transaction written disclosure requirements followed on January 1, 2025.
Assembly Bill 1934 (AB 1934), signed in September 2024, extended the original licensing deadline from July 1, 2025 to July 1, 2026, giving operators an additional 12 months to prepare applications and build compliance infrastructure.
A digital financial asset under the law is defined as a digital representation of value used as a medium of exchange, unit of account, or store of value, excluding legal tender, certain in-game tokens, rewards points, and securities registered with or exempt from SEC registration.
The DFPI opened the application portal on March 9, 2026, through the NMLS. The baseline financial thresholds, per DFPI published guidance, are:
| Requirement | Minimum Amount | |---|---| | Application fee | $7,500 + review costs | | Tangible net worth | $100,000 | | Surety bond | $500,000 |
These figures are starting points. The DFPI has stated it will adjust tangible net worth and surety bond requirements during the application review based on activity volume, asset mix, leverage, liquidity, and customer protection obligations, per Jenner & Block's analysis. Applicants with larger California operations, complex custody models, or material outstanding customer obligations should expect higher thresholds.
For context, New York's BitLicense carries a $5,000 application fee with a minimum $500,000 surety bond, but total upfront compliance costs typically run $350,000 to $1.5 million, according to industry compliance estimates. Annual ongoing costs reach $400,000 to $1.5 million when factoring in New York Department of Financial Services assessments, legal and audit fees, and compliance staffing.
California's DFAL adds requirements beyond New York's framework: quarterly CPA examinations of reserves and five-year recordkeeping obligations. The full cost of DFAL compliance will not be clear until the DFPI processes a meaningful number of applications and final capital requirements are set.
The DFPI has not waited for the July 1 deadline to act. The regulator has conducted at least four enforcement actions against crypto kiosk operators since mid-2025, establishing a pattern of escalating penalties:
Coinme Inc. (June 2025): The DFPI's first consent order under DFAL provisions. Coinme was fined $300,000, of which $51,700 was designated as customer restitution, for violations including exceeding the daily transaction limit and failing to register machines.
Coinhub / LSGT Services, LLC (late 2025): A $675,000 penalty, including $105,000 in customer restitution, for overcharging users since 2024 and accepting transactions exceeding the $1,000 daily limit. The firm was also cited for missing required transaction disclosures.
Hermes Bitcoin / Anh Management, LLC (May 2026): Ordered to cease all kiosk operations in California by May 20, 2026. The DFPI identified more than 14,120 instances of missing or improper receipts and disclosures since January 1, 2024, alongside fees exceeding legal limits and anti-money laundering failures across 42 kiosks in Southern California. The settlement carries a suspended $9.9 million administrative penalty payable upon non-compliance.
Evergreen ATM, LLC (January 2026): The DFPI issued enforcement orders against this kiosk operator, according to the agency's published enforcement records.
Beyond kiosks, the DFPI fined crypto lending platform Nexo Capital Inc. $500,000 in January 2026 for originating loans to approximately 5,456 California borrowers between July 2018 and November 2022 without a California Financing Law license and without assessing borrowers' ability to repay.
DFPI Commissioner KC Mohseni has framed the enforcement stance in direct terms: "We will not hesitate to pursue actions against those who defraud Californians and flout our laws."
The regulatory pressure on crypto kiosks extends beyond California. Bitcoin Depot, once North America's largest crypto ATM operator, filed for Chapter 11 bankruptcy on May 18, 2026, and immediately deactivated its entire fleet of more than 9,000 machines.
The company reported an $80.7 million revenue decline in Q1 2026 — a 49.2% drop year-over-year, according to CoinDesk. Bitcoin Depot cited increasingly stringent state regulations, including new transaction limits and, in some jurisdictions, outright bans on crypto ATM operations, as rendering its business model unsustainable.
The bankruptcy filing followed lawsuits from the attorneys general of Massachusetts and Iowa over alleged facilitation of crypto scams. Industry-wide, crypto ATM fraud hit a record $389 million in reported losses in 2025, a 58% increase from 2024, per federal data cited by Bloomberg.
Tennessee in April 2026 became the second U.S. state, following Indiana, to ban crypto ATMs outright, with that ban effective July 1, 2026 — the same day California's licensing regime takes full effect. Customers with transactions in progress or balances tied to Bitcoin Depot accounts remain unable to access funds under Chapter 11 restrictions.
DFAL casts a wide net. It applies to any person, wherever located, conducting covered digital financial asset business activity with or on behalf of a California resident. Covered activities include exchanging, transferring, storing, or administering digital financial assets.
The legislature included 17 exemptions and empowered the DFPI to add, remove, or modify them. Key exemptions include:
Notable gaps remain. The statute does not contain explicit language addressing decentralized finance (DeFi) protocols, according to available legal analyses. Whether a smart-contract-based protocol with no centralized operator constitutes a "person" engaging in covered activity is an open interpretive question the DFPI has not publicly addressed. Deputy Commissioner for Digital Financial Assets Brynly Llyr has stated the agency's priority: "What we want to see is compliance. What we want to see is a good, healthy industry."
California's DFAL does not exist in isolation. A broader trend of state-level enforcement intensification is underway, driven in part by a federal pullback. According to law firm Whiteford, Taylor & Preston, the U.S. Department of Justice, SEC, and CFTC have shifted enforcement priorities away from failure-to-register violations, prompting states to fill the gap.
New York State Senator Zellnor Myrie proposed the CRYPTO Act on January 14, 2026, which would criminalize unlicensed virtual currency business in New York. The bill introduces graduated penalties: a Class A misdemeanor for any unlicensed activity, escalating to a Class C felony for operations involving $100,000 or more in 30 days or $1 million or more in one year. If passed, New York would become the 19th state to explicitly criminalize unlicensed crypto transactions.
The result is a regulatory patchwork that imposes substantial compliance costs. According to industry data, licensing across the top 15 U.S. states costs $600,000 to $1.5 million upfront, while full 49-state coverage runs $1.3 million to $3 million or more. California's entry as the second major crypto-specific licensing regime, covering a state with approximately 8.2 million crypto-holding residents and roughly 27% adult crypto ownership, raises the compliance bar for the entire industry.
California's DFAL represents the most significant expansion of state-level crypto regulation since New York introduced the BitLicense in 2015. The law's breadth — covering exchanges, custodians, wallet providers, kiosks, and potentially any entity facilitating digital asset transactions for California residents — combined with the DFPI's demonstrated willingness to enforce ahead of the licensing deadline, creates a compliance imperative for the industry.
The economic consequences are already visible. Bitcoin Depot's bankruptcy, the $389 million in ATM fraud losses, and the escalating penalty structure in California enforcement actions illustrate the cost of non-compliance. For firms that meet the requirements, California's 8.2 million crypto-holding residents represent a substantial market. For those that do not, July 1 is a hard stop.
The unresolved question is whether DeFi protocols, DAOs, and other decentralized structures fall within the statute's reach. The DFPI has the statutory authority to expand or narrow exemptions. How it exercises that authority in the months following July 1 will determine whether DFAL becomes a model for other states or a cautionary example of regulatory overreach.