On October 13, 2023, California enacted two bills that significantly expand the regulation of virtual currency-related activities in California:

1. Assembly Bill 39 (AB 39), known as the California Digital Financial Assets Law (DFAL), is a substantial bill that establishes a comprehensive licensing and supervision regime for “digital financial asset business activity.”
2. Senate Bill 401 (SB 401), which is tied to the DFAL, regulates operators of “digital financial asset transaction kiosks,” often referred to as crypto ATMs. SB 401 imposes consumer disclosure and other customer protection requirements on such operators.

This post summarizes the key provisions and implications of the new laws and provides some practical takeaways and recommendations for digital asset market participants.

The California Digital Financial Assets Law (DFAL)

Who must obtain a license?

The DFAL requires any person who engages in, or holds itself out as engaging in, “digital financial asset business activity” with or on behalf of a California resident to obtain a license from the California Department of Financial Protection and Innovation (the Department.) The DFAL defines “digital financial asset business activity” to include exchanging, transferring, or storing a digital financial asset or engaging in digital financial asset administration.¹ “Digital financial asset” means a digital representation of value that is used as a medium of exchange, unit of account, or store of value, and that is not legal tender, whether or not denominated in legal tender.

At first glance, the scope of activity covered under the DFAL may seem quite similar to that of New York’s Virtual Currency Business Activity regulations, often referred to as New York’s Bitlicense regime. Both the DFAL and the Bitlicense regime include the concepts of transferring, storing, exchanging, and administering digital assets within their definitions of covered activity. Both regimes also define covered assets—referred to as “digital financial assets” under the DFAL, or in the case of the Bitlicense regime, “virtual currency”—quite similarly. However, one notable distinction between the two regimes is that, under the DFAL, a requisite element of engaging in either the exchange, transfer, or storage of a digital financial asset is the assumption or maintenance of “control” of the asset. Specifically, under the DFAL:

• “Exchange” means to assume control of a digital financial asset from, or on behalf of, a resident, at least momentarily, to sell, trade, or convert either of the following: (1) a digital financial asset for legal tender, bank or credit union credit, or one or more forms of digital financial assets or (2) legal tender or bank or credit union credit for one or more forms of digital financial assets.
• “Transfer” means to assume control of a digital financial asset from, or on behalf of, a resident and to subsequently do any of the following: (1) credit the digital financial asset to the account of another person; (2) move the digital financial asset from one account of a resident to another account of the same resident; or (3) relinquish control of a digital financial asset to another person.
• “Store” means to maintain control of a digital financial asset on behalf of a resident by a person other than the resident.

“Control” is defined as the power to execute unilaterally or prevent indefinitely a digital financial asset transaction. The term is therefore used as a limiting factor vis-à-vis the types of activities that would be deemed digital financial asset business activity under the DFAL - that is, without the ability to “execute unilaterally or prevent indefinitely” a transaction, a person cannot be engaged in the exchange, transfer, or storage of a digital financial asset under the DFAL.

In contrast, the Bitlicense regime uses the term “control” several times in its definition of covered activity - e.g., maintaining control of virtual currency on behalf of others or controlling a virtual currency - but never defines the term, leaving market participants with a lack of clarity as to the precise scope of covered activities.

For these reasons, the range of activities for when a license may be required in California under the DFAL appears more limited than under the Bitlicense regime in New York. For example, decentralized exchanges (DEXs) that facilitate the exchange of digital assets without taking possession or custody of the assets would presumably not be in “control” of a digital financial asset under the DFAL, and thus not require a license, but could still be subject to the broader licensing requirement under the Bitlicense regime.

The exemptions from the scope of the DFAL are also more wide-ranging than the exemptions under the Bitlicense regime. Persons that are expressly exempt from the scope of the DFAL include, but are not limited to:

• Certain banks, trust companies, and credit unions.
• Persons that are limited to providing processing, clearing, or settlement services solely for transactions between or among persons that are exempt from the DFAL.
• Persons that contribute only connectivity software or computing power to securing a network that records digital financial asset transactions or to a protocol governing the transfer of the digital representation of value.
• A person using a digital financial asset, or obtaining a digital financial asset as payment, solely on the person’s own behalf for personal, family, or household purposes or for academic purposes.
• A merchant that accepts a digital financial asset as payment for the purchase or sale of goods or services (which does not include digital financial assets).
• A person whose digital financial asset business activity with, or on behalf of, California residents is reasonably expected to be valued, in the aggregate, on an annual basis at USD50,000 or less.
• Certain entities registered under the federal Commodity Exchange Act, but only to the extent those activities are conducted under the authority of that act, are regulated by the Commodity Futures Trading Commission, and are entitled to preemption.
• Persons registered as a securities broker-dealer under federal or state securities laws to the extent of its operation as a broker-dealer.

What are the licensing requirements?

As of July 1, 2025, any person covered by the DFAL must either be licensed or have applied for a license and be awaiting approval of the application. The required contents of the application are similar to the California money transmission statute in many respects, as the items applicants must submit under the DFAL include corporate information, financial statements, information about the applicant’s officers, directors and owners, its business plan, and various policies and procedures. That said, there are certain areas where the DFAL’s requirements are more extensive than the money transmission statute, such as requiring applicants to have implemented certain policies and procedures in addition to the standard anti-money laundering and counter-terrorist financing program, including those related to information security and operational security, business continuity and disaster recovery, anti-fraud, and policies designed to ensure compliance with applicable law.

The factors that the Department must consider when evaluating an application under the DFAL generally reflect those utilized under the California money transmission statute, such as the applicant’s financial responsibility, experience, character, and general fitness. Interestingly, though, one difference is that the DFAL specifically requires the Department to also consider the applicant’s promise of success in engaging in the desired regulated activity. While the Department may have considered this factor in practice when reviewing applications for a money transmission license - for example, when reviewing the financial projections of an applicant - it is notable that this is now an express statutory requirement under the DFAL. Time will tell how the Department executes on this requirement.

Finally, the DFAL provides for a conditional license for applicants with a pending application with the Department under the DFAL that are also authorized at the time to conduct virtual currency business activity in New York, either as a licensee under the Bitlicense regime or as a chartered New York State limited purpose trust company. This conditional license is not automatic, however, as eligible applicants are subject to certain conditions and limitations, such as paying appropriate fees and complying with the requirements of the DFAL. In addition, the conditional license, if granted, is intended to only be temporary between the time the applicant applies for a license under the DFAL and when such application is approved or denied.

What are a licensee’s obligations and limitations?

The DFAL includes a number of obligations and limitations with which licensees must comply. First, given that it is principally focused on customer protection, it is no surprise that there are requirements for licensees to maintain a surety bond, maintain sufficient capital and liquidity to ensure the financial soundness of the entity, and own certain assets of not less than the aggregate amount of all outstanding liabilities owed to customers. In addition, licensees must file annual and event-driven reports and maintain various enumerated records, which generally must be maintained for at least five years.

Licensees are also subject to various disclosure and notice requirements, including making pre- and post-transaction disclosures to customers, and providing transaction confirmations and receipts. In particular, before engaging in regulated activity with a California resident, the licensee must disclose to the resident, among other things:

• A schedule of fees and charges.
• A notice regarding whether the products or services are covered by insurance.
• Information regarding the licensee’s liability for any unauthorized, mistaken, or accidental transfer or exchange.
• A notice regarding the resident’s right to receive a receipt or other evidence of the transaction.
• A list of the instances in the past 12 months when the licensee’s service was unavailable to 10,000 or more customers related to the regulated activity due to a service outage on the part of the licensee and the causes of the service outage.

Then, at the conclusion of a transaction with or on behalf of a resident, the licensee must provide the resident with a receipt or confirmation detailing various information regarding the licensee and the transaction.

Finally, the DFAL imposes several additional requirements on any covered person that exchanges, or holds itself out as being able to exchange, a digital financial asset (a covered exchange). Obligations for covered exchanges include:

• Prior to listing or offering a particular digital financial asset, the covered exchange must make a certification to the Department that it has taken certain actions, including conducting an assessment of whether the asset could be deemed a security, establishing policies and procedures to reevaluate the continued listing of an asset, and establishing policies and procedures for the de-listing of an asset.
• Using reasonable diligence to ensure best execution for residents in light of prevailing market conditions.

What does the DFAL say about stablecoins?

A noteworthy aspect of the DFAL is that it includes specific provisions and restrictions for licensees who engage in activities involving stablecoins. As a general matter, licensees can only exchange, transfer, or store a particular stablecoin, or engage in administration with respect to a particular stablecoin, if (1) the issuer of the stablecoin is licensed under the DFAL, or is a regulated bank or trust company and (2) the issuer fully backs the stablecoin - that is, at all times owns eligible securities with an aggregate market value not less than the amount of all of its outstanding issued or stablecoins.

The digital financial asset transaction kiosks law (SB 401)

SB 401 is a companion bill to the DFAL that specifically regulates operators of digital financial asset transaction kiosks, which are devices that are capable of accepting or dispensing cash in exchange for a digital financial asset, i.e., a bitcoin or crypto ATM.

The law imposes disclosure and consumer protection requirements on kiosk operators, such as providing written terms and conditions of the transaction, including the amount of the digital financial asset involved, the amount and calculation of any fees, charges, or expenses, the difference between the price charged by the operator and the price listed by a licensed digital financial asset exchange, and whether the transaction can be reversed or refunded.

The law also limits the amount of cash that can be accepted or dispensed by a kiosk to USD1,000 per day per customer, and the amount of fees and charges that the operator can impose to the greater of USD5 or 15% of the value of the digital financial asset involved.

The law further requires the operator to provide a transaction receipt to the customer, containing the customer’s name, basic transaction information, any charges or fees, the price difference or spread, and the name of the licensed digital financial asset exchange used by the operator to fix the price.

Finally, the law requires kiosk operators to disclose the locations of all of their kiosks to the Department, which locations are then to be published on the Department’s website.

The law authorizes the Department to enforce the law and impose civil penalties, injunctions, or revocations for violations.

The practical takeaways

The enactment of the DFAL and SB 401 marks a significant expansion in the regulation of virtual currency-related activities in California, one of the largest markets in the United States, and will have important implications for the digital asset industry and its customers. While the laws do provide legal clarity and consumer safeguards for digital asset-related activities in California, which many have been calling for, they also impose significant compliance obligations and limitations that may create challenges or uncertainties for some business models and activities. Therefore, digital asset market participants should consider the following practical takeaways:

• Review and assess the applicability and impact of the new laws to your current and planned digital asset activities in California, and determine whether you may need to obtain a license under the DFAL and/or comply with the requirements of SB 401, or whether you may qualify for any exemption or exclusion.
• If you believe that a license under the DFAL is required, consider participating in the rulemaking and implementation process of the Department, which will provide further details and guidance on the interpretation and enforcement of the new laws. The Department is expected to issue regulations and forms to implement the new laws by July 1, 2025, and may solicit public comments and feedback from stakeholders during the rulemaking process. Digital asset market participants should follow the Department’s announcements and publications, seek opportunities to engage with the Department, and provide input or suggestions on the regulations and forms.
• If you desire a license under the DFAL, consult with legal and regulatory experts and prepare for the application and licensing process as soon as possible, as the application will involve submitting extensive information and documentation to the Department, demonstrating adequate capital and liquidity, establishing policies and procedures, and meeting other prudential and consumer protection requirements.

Footnotes

_{1. “Digital financial asset business activity” also includes:}

^{- Holding electronic precious metals or electronic certificates representing interests in precious metals on behalf of another person or issuing shares or electronic certificates representing interests in precious metals; and}

^{- Exchanging one or more digital representations of value used within one or more online games, game platforms, or family of games for either of the following: (1) A digital financial asset offered by or on behalf of the same publisher from which the original digital representation of value was received; or (2) Legal tender or bank or credit union credit outside the online game, game platform, or family of games offered by or on behalf of the same publisher from which the original digital representation of value was received.}