Published in Law360 on October 19, 2023. © Copyright 2023, Portfolio Media, Inc., publisher of Law360. Reprinted here with permission.
The California Department of Financial Protection and Innovation, or DFPI, continued to have significant influence over legislative and regulatory developments in the third quarter of 2023.
As we move into the fourth quarter, there are three significant developments in California law from the third quarter that have had an impact on the industry.
Digital Financial Assets Law Passed by California Legislature
Nearly one year after California Gov. Gavin Newsom vetoed a similar bill in September 2022, California legislators passed the Digital Financial Assets Law. [1]
Gov. Newsom was presented with the bill on Sept. 21 and signed it on Oct. 13. The DFAL will go into effect on July 1, 2025.
The DFAL prohibits persons from engaging in "digital financial asset business activity" unless certain criteria are met, including that the person is licensed with the DFPI.
A "digital financial asset" is a digital representation of value that is used as a "medium of exchange, unit of account, or store of value, and that is not legal tender." Cryptocurrency is likely to fall within the definition of a digital financial asset.
"Business activity" as it relates to digital financial assets means (1) "[e]xchanging, transferring, or storing a digital financial asset or engaging in digital financial asset administration"; (2) "[h]olding electronic precious metals or electronic certificates representing [] interests in precious metals"; and (3) "[e]xchanging digital representations of value within one or more online games, game platforms, or family of games."
The requirements imposed by the DFAL would apply to legal entities, individuals, partnerships, estates, business entities and nonprofit entities, but not governmental entities or government-sponsored enterprises.
There are certain exemptions from the DFAL, including certain types of banks such as commercial and industrial banks, credit unions, and persons or entities that provide only connectivity software or computing power to secure a network that records digital financial asset transactions or data storage, and individual investors investing on their own behalf, among others.
One of the centerpieces of the legislation is the licensure requirement. The DFAL prohibits entities from engaging in digital financial asset business activity unless licensed.
A prospective licensee must provide a plethora of information to the DFPI, including the legal name of the applicant and a description of current and former businesses and criminal history, as well as information about certain other licenses, pending and former litigation, and bankruptcy proceedings.
Of note, the licensee must maintain a surety bond or trust account in U.S. dollars "in a form and amount as determined by the department." The law does not indicate factors as to the amount of the bond or trust account. The licensee must also maintain capital and liquidity in an amount and form as determined by the department based on a number of factors.
The DFAL also authorizes significant "enforcement measures," including suspending or revoking a license, assessing a penalty, requesting a court to issue injunctive relief, seeking restitution on behalf of a resident caused by a violation, and "[i]mposing necessary or appropriate conditions on the conduct of [a] digital financial asset business activity."
The DFPI is authorized to assess a civil penalty up to $100,000 for nonlicensees and $20,000 for licensees for each day the DFAL is violated. Notably, the section on enforcement measures is "not to be construed to provide a private right of action."
DFPI's Action Over Out-Of-State Loans
California law imposes certain requirements on the amount of interest that can be charged on consumer loans. Specifically, the California Financing Law imposes an interest rate cap between 12% and 36% on consumer loans under $10,000, and the California usury law sets the maximum allowable interest rate at 10%.
Companies targeting a certain demographic of California residents may be unable to offer loans because the loan applicants do not qualify for loans at these rates.
Enter state-chartered banks located in states that have higher — or no — interest rate caps. Some fintech companies have begun facilitating loans between California residents and out-of-state banks that may be able to charge higher interest rates than those allowed under California law.
In 2022, however, the DFPI brought an action in California state court against one fintech company regarding consumer loans the company helped facilitate with a federally insured Utah-chartered bank, FinWise Bank.
The loans at issue carry annual percentage rates upward of 150% and therefore exceed the interest rate caps imposed under the California Financing Law and California usury law. However, the named lender on these loans is FinWise, which the parties agree is exempt from California's limits on interest rates.
In legal filings, the DFPI has taken the position that these loans are not exempt from the interest rate caps because the fintech company — not FinWise — is the "true lender." The fintech company has disputed the DFPI's characterization, stating it is not a lender and does not fund, own or hold loans.
Early this year, the DFPI filed a motion for a preliminary injunction to enjoin the fintech company from continuing to facilitate loans with interest rates that exceed the caps imposed under the California Financing Law and California usury law.
The fintech company opposes the motion on the ground that the "true lender doctrine" is a so-called "underground regulation"—i.e., a regulation that only the DFPI knew about.
Generally, agencies like the DFPI must adopt regulations following procedures established in California's Administrative Procedure Act, and regulations improperly adopted outside the APA procedures are void as underground regulations. At a hearing in July, the court ordered supplemental briefing on the impact of a finding that the true lender doctrine was an underground regulation on the DFPI's motion.
The court has scheduled a hearing for Oct. 20 to issue a ruling on the DFPI's motion for preliminary injunction. The court's order is likely to affect the relationship between fintech companies and banks in the consumer lending space.
An order granting the motion for preliminary injunction could cause fintech companies to rethink their involvement in consumer lending with out-of-state banks. Ultimately, the issues raised by the DFPI will likely need to be addressed by a higher court.
Crypto High-Yield Investment Program Enforcement Actions
On Aug. 9, the DFPI announced desist and refrain orders against three different entities for alleged violations of California securities laws. [2]
The DFPI alleges these entities — CloudFi, CoinMarketBull, and Vortic United — offered and sold unqualified securities and made material misrepresentations and omissions to investors related to crypto-asset investments.
The DFPI reported that these entities used artificial intelligence and traders to trade crypto-assets and generate "too-good-to-be-true" returns for investors. It claims these entities used multilevel marketing schemes that rewarded investors for recruiting new investors.
DFPI Commissioner Clothilde Hewlett stated that "[t]he DFPI is on the forefront of combatting investment scams involving crypto assets and will continue to leverage the tools at our disposal to do so ... includ[ing] enforcement actions, social media, and our crypto Scam Tracker. Enforcement and investor education go hand-in-hand."
The "Crypto Scam Tracker" on the DFPI's website is based on consumer complaints that have not been verified by the DFPI. [3] The website encourages visitors to submit a complaint about scams not listed on the tracker.
[1] Assembly Bill 39: https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240AB39.
[2] DFPI's August 9, 2023 Press Release: https://dfpi.ca.gov/2023/08/09/dfpi-continues-actions-to-protect-investors-from-crypto-scams/.
[3] DFPI's Crypto Scam Tracker: https://dfpi.ca.gov/crypto-scams/.
