California DFAL Token Listing Certification: 10 CCR 1250

By the Guardian team Updated November 2026 6 min read

Quick answer. Before listing or offering a token to California residents, a covered exchange must file the DFPI's signed Covered Exchange Certification through NMLS. It certifies a securities analysis, conflict disclosures, a comprehensive risk assessment, and reevaluation and delisting policies.

Watch: California DFAL Token Listing Certification: 10 CCR 1250 1:43

Video transcript

Before a covered exchange lists a token in California, an officer must sign a DFPI certification. One item is a technical review that needs evidence.

The DFAL rules took effect June 29, 2026. A covered exchange files the signed form through NMLS before listing any asset, naming every ticker.

If the DFPI finds an uncertified listing, it must order the listing stopped, and may add a penalty of up to twenty thousand dollars per day.

For each asset, the officer certifies a securities analysis, conflict disclosures, a risk assessment, and policies to reevaluate and to delist.

Item three is where security comes in. It must cover cybersecurity, theft, code or protocol defects, and price manipulation. Neither the rule nor the form says how to run it.

Here is what we would expect a defensible review to check: audit coverage, a bytecode match, admin powers and their keys, bridges, and issuer controls.

Item four asks about material changes, which the rule leaves undefined. We would review again after upgrades, role changes, bridge changes, exploits or new audit findings.

Guardian audits token contracts, maps privileged roles in an OpSec audit, and matched USDT zero's deployed contracts byte-exact to audited source. Managed Security monitors upgrades on every block.

Give your signing officer a dated evidence file for every asset. Read the full article, or talk to Guardian at guardian.security.

California's Digital Financial Assets Law (DFAL) regulations took effect on June 29, 2026.

From July 1, 2026, the DFPI says companies must be licensed by it, or have applied, to operate in California.

One new rule, 10 CCR section 1250, holds the form behind a statutory listing duty. An officer signs it, and the exchange files it before listing.

Item 3 of that form is a risk assessment that includes code and protocol defects. That is a technical review, and the officer signing it will want evidence.

This article explains the technical and security side of the DFPI's DFAL regulations (PRO 02-23) and the Covered Exchange Certification in 10 CCR section 1250. It is not legal advice; confirm how it applies to you with counsel.

The Final DFAL Rules

The rulemaking, file PRO 02-23, is titled "Digital Financial Assets Law Regulations: License Application and Requirements; Money Transmission Act Exemption".

It adds a DFAL subchapter, 10 CCR sections 1200 to 1250, alongside money transmission changes. It took effect on June 29, 2026.

Section 1250 repeats a duty that already exists in Financial Code section 3505.

The DFPI moved the form into this section during the rulemaking, to make clear that licensees file it too. It is filed before listing, not with the license application.

Who Files, and When

Who: an applicant or licensee that is a covered exchange.
Covered exchange: a covered person that exchanges, or holds itself out as able to exchange, a digital financial asset for a resident.
When: before listing or offering a digital financial asset for exchange on behalf of a resident.
How: form DFPI-DFAL CCR 1250, signed and filed through NMLS.
What it lists: each asset's full name and every ticker or trading symbol.
Who signs: an officer, with name, title and date.

One exception sits in the statute. No certification is needed for an asset NYDFS approved for listing under 23 NYCRR Part 200 on or before January 1, 2023.

One commenter, GSR, told the DFPI that this carveout covers only 6 of the 50 most popular tokens on CoinMarketCap.

The DFPI also declined to exempt institutional OTC desks, saying DFAL itself obligates them to complete the form.

The stakes are in section 3505. If the DFPI finds a listing without certification, or material misrepresentations, it must order the exchange to stop offering or listing the asset.

It may also assess a civil penalty of up to $20,000 per day.

The Five Certification Items

The officer certifies that, for each listed asset, the exchange has:

Identified the likelihood that federal or California regulators would deem it a security.
Given full and fair written disclosure of material conflicts of interest involving the exchange and the asset.
Conducted a comprehensive risk assessment (below).
Set policies to reevaluate continued listing, including whether material changes have occurred.
Set policies to stop listing it, including notice to affected consumers and counterparties.

Items 1 and 2 are legal and disclosure work. Items 4 and 5 are policies. Item 3 is where security comes in.

The assessment must be "designed to ensure consumers are adequately protected" from four kinds of risk:

Cybersecurity risk.
Malfeasance, including theft.
Code or protocol defects.
Market risks, including price manipulation and fraud.

Neither section 1250 nor the form says how to run it.

What the Risk Assessment Should Check

Here is what we would expect a defensible code and protocol review to cover, for each token on each chain.

Area	What to check	Evidence
Audit coverage	Every contract that holds, mints or upgrades the token was in scope	Reports, scope, open findings
Deployed code	Deployed bytecode matches the audited commit	A dated bytecode match
Admin powers	Who can upgrade, pause, mint, freeze or blacklist	Role map from chain state
Keys behind roles	Single key or multisig, threshold, timelock delay	Signer set and delays
Bridges	Which bridge mints the token on each chain, and its verifiers	Bridge configuration
Dependencies	Oracles, collateral and protocols the token relies on	Dependency list
Token behavior	Fee-on-transfer, rebasing, blocklists, unusual decimals	Integration test results
Issuer offchain	Key custody, domains and incident response	Issuer answers, dated

Roles, thresholds, timelocks and bytecode can be read from the chain. Who holds each key, and how it is stored, has to come from the issuer.

Token behavior matters to the exchange's own systems. Our weird ERC-20 tokens checklist covers the edge cases that break integrations.

Admin keys are listing risks

A token is only as safe as whoever can change it. An upgrade key can replace its logic. A mint role can dilute holders. A freeze role can strand deposits.

For each power, record the holder, the threshold, any timelock, and whether it has been used. For the UK version of this test, see our UK listing due diligence guide.

Reevaluation and Delisting

Item 4 asks for policies to reevaluate continued listing, "including an evaluation of whether material changes have occurred".

Neither the rule nor the form defines a material change. For a token, we would treat these as triggers for a fresh review:

An upgrade to a new implementation.
A change in admin roles, signers, thresholds or timelocks.
A new chain deployment or a bridge change.
An exploit of the token, its bridge or a dependency.
New audit findings, or a change of control at the issuer.

Most of these are visible onchain. Monitoring role changes and upgrades turns the policy into something that runs.

Item 5 asks for policies to stop listing an asset, including notice to affected consumers and counterparties.

Decide in advance who can halt deposits, how customers withdraw, and who tells market makers and custodians.

Section 3505 gives policies some room. A single failure is not by itself grounds for liability if the policy was created, implemented and monitored properly.

Repeated failures, it adds, are evidence that it was not.

Evidence Pack for the Signing Officer

The officer certifies for "each and every" listed asset. For each one, keep a dated file with:

The securities analysis and conflicts disclosure (items 1 and 2).
Audit reports, their scope and the status of every finding.
A bytecode match between deployed contracts and audited code.
The role map: holders, thresholds, timelocks and recent use.
The bridge, oracle and dependency review, per chain.
The market risk review: liquidity, supply concentration and manipulation signals.
The issuer's answers on key custody and incident response.
The reviewer's conclusion, the date and any open risks.
The reevaluation triggers being watched, and the delisting runbook.

Material misrepresentations can lead to a delisting order and penalties. So record what could not be verified, as well as what was.

How Guardian Helps

Guardian's audits review the contracts behind a token through design review, invariant fuzzing and senior manual review, with proof-of-concept exploits.

An OpSec audit maps who can upgrade, pause, mint, set parameters or move funds, and the keys and multisigs behind each role.

For USDT0, Guardian matched deployed proxies, implementations and admins byte-exact against the audited source.

Guardian's Managed Security monitors privileged calls, role and ownership changes and upgrades on every block.

Frequently Asked Questions

What is a covered exchange under DFAL?

Under Financial Code section 3505, a covered person that exchanges, or holds itself out as able to exchange, a digital financial asset for a resident. Section 1250 applies to license applicants and licensees that are covered exchanges.

When must the token listing certification be filed?

Before listing or offering the digital financial asset for exchange on behalf of a resident. The signed form, DFPI-DFAL CCR 1250, is filed through NMLS.

Are any tokens exempt from the certification?

Yes, by statute. An asset approved for listing by the New York Department of Financial Services under 23 NYCRR Part 200 on or before January 1, 2023 needs no certification. The regulations add no other exemption.

What happens if an exchange lists a token without certifying?

If the DFPI finds a listing without certification, or material misrepresentations in it, it must require the exchange to stop offering or listing the asset. It may also assess a civil penalty of up to $20,000 per day of violation.

Sources

Give your signing officer the evidence

Guardian audits contracts, maps admin keys and verifies deployed code, so item 3 can rest on a dated technical record.

Talk to Guardian Explore audits and pentests