California DFAL License: Who Needs One and What It Requires

By Owen Thurm Published November 6, 2026 6 min read

Quick answer. Since July 1, 2026, exchanging, transferring or storing digital financial assets for Californians requires a DFPI license, a completed application filed by then, or an exemption. Licensees need written security programs, fully backed customer assets and annual reports.

Watch: California DFAL License: Who Needs One and What It Requires 1:49

Video transcript

Since July 1, 2026, serving Californians with digital financial assets requires a DFPI license, a completed application, or an exemption.

The law covers exchanging, transferring or storing digital financial assets. You may operate if you hold a license, filed a completed application by July 1, or are exempt, such as banks or very small activity.

SB 97, an urgency statute signed the day before the deadline, made completed applications mandatory and repealed the stablecoin chapter.

Applications go through NMLS. The DFPI expects one hundred thousand dollars in initial tangible net worth, plus a seventy five hundred dollar application fee.

Written security, continuity, fraud and compliance programs are required. The DFPI evaluates them against the NIST Cybersecurity Framework 2.0, and expects evidence such as assessments and operational samples.

It adds four digital asset areas: smart contract governance, blockchain platform reviews, custody safeguards like multisig and cold storage, and key management.

Customer assets must be fully backed at all times and are held in trust. Annual reports must show those assets, plus any material security breach.

Policies alone are not enough. A strong file maps controls to evidence, with pentests and retests, smart contract audits and custody reconciliations.

Guardian's Regulatory Readiness, Cybersecurity Maturity and Technical Evidence assessments help build that file. Your counsel owns the legal reading.

Read the full article for disclosures, audits and kiosk rules, or talk to Guardian at guardian.security.

Licensing under California's Digital Financial Assets Law (DFAL) took effect on July 1, 2026. From that date, the DFPI says companies must be licensed by it or have applied for a license.

The law changed the day before. SB 97, an urgency statute signed June 30, 2026, repealed the stablecoin chapter and requires a pending application to be complete.

This article explains the technical and security side of California's Digital Financial Assets Law and the DFPI's DFAL regulations (10 CCR 1200 to 1250). It is not legal advice; confirm how it applies to you with counsel.

Who Needs a DFAL License

From July 1, 2026, section 3201 bars digital financial asset business activity with or for a California resident. It is allowed only if:

The person holds a DFPI license.
It submitted a completed application on or before July 1, 2026, and awaits a decision.
It is exempt under section 3103.

The activity is exchanging, transferring or storing a digital financial asset, or holding electronic precious metals for others. To store means to keep control of an asset on a resident's behalf.

Section 3103's exemptions include:

Banks, trust companies and credit unions.
Registered broker-dealers, for that business.
Activity reasonably expected to total $50,000 a year or less.
Uncompensated providers, now including those that can only halt a transaction to prevent unauthorized or fraudulent activity.

A license from another state does not substitute, the DFPI says. A holder of a New York virtual currency license issued or approved no later than January 1, 2025 may get a conditional license under section 3205.

The Application and the Deadline

Date	Step
Sep 29, 2024	AB 1934 moves licensing from July 1, 2025 to July 1, 2026
Mar 9, 2026	DFPI starts accepting applications, per Baker McKenzie
Jun 29, 2026	DFPI licensing rules (PRO 02-23) take effect
Jun 30, 2026	SB 97 signed and chaptered as an urgency statute
Jul 1, 2026	License or completed application required

Applications go through NMLS on Form MU1. Rule 1212 lists what to file, including:

A detailed business plan and a step-by-step description of each transaction type.
CPA-audited financial statements for the latest fiscal year and the two before, if available.
Every consumer disclosure, and every policy required by sections 3701 and 3702.
A nonrefundable $7,500 application fee.

Section 3207 also requires capital, liquidity and a surety bond or trust account, in amounts the DFPI sets. The DFPI expects an initial $100,000 in tangible net worth with the application.

Under rule 1214, a person that filed a completed application by July 1, 2026 may keep operating while it waits. The DFPI publishes a list of the applications it is reviewing.

Cybersecurity Requirements

Section 3701 requires written policies before applying, maintained through licensure, for:

An information security program and an operational security program.
Business continuity and disaster recovery programs.
Antifraud, anti-money laundering and terrorist financing programs.
A compliance program, including steps against facilitating unregistered securities.

The security policy must include "reasonable and appropriate administrative, physical, and technical safeguards" for nonpublic personal information and digital financial assets.

A responsible individual must monitor and enforce each policy. "Repeated failures" of a policy are evidence it was not run properly.

The DFPI's application guidance says it evaluates these programs "following the NIST Cybersecurity Framework (CSF) 2.0." Applicants are "expected to provide evidence," such as documentation, procedures, assessments or operational samples.

What the DFPI lists

Its safeguards include:

Role-based access, least privilege and MFA for systems handling sensitive data.
Encryption in transit and at rest, with secure key management.
Secure development, code review and vulnerability scanning.
Logging and monitoring of access to customer information.
A written incident response plan, tested at least annually.
Independent assessments of the security controls.

It adds four digital asset areas, where they apply:

Smart contracts: governance and security for development, deployment and monitoring, with safeguards against unauthorized changes.
Blockchain platforms: regular reviews, including consensus integrity.
Custody: layered safeguards, such as multisig authorization and cold storage.
Keys: secure generation, backup and recovery, access control and rotation.

Our NIST CSF 2.0 controls list maps the framework to digital asset controls.

Custody, Disclosure and Audit Duties

Custody

Under section 3503, a covered person with control of customer assets must "at all times maintain in its control" enough of each type to cover customers' entitlements.

Those assets are held for customers, are not the company's property, and are deemed held in trust, beyond its creditors' reach.

Disclosures

Before doing business with a resident, section 3501 requires disclosures, including:

Fees, and how they are calculated.
Any insurance, including private cover against theft or cybertheft.
Outages in the past 12 months that affected 10,000 or more customers, with causes.

Section 3701 policies must also be disclosed to residents. SB 97 exempts security-sensitive programs, including the security, continuity, fraud and AML programs.

Audits and annual reports

Each year between October 1 and November 1, a licensee must file an annual report under section 3211. It includes:

Audited annual financial statements if California DFAL revenue topped $2 million; reviewed statements otherwise.
Any material data security breach or cybersecurity event (SB 97 added "material").
The value of customer assets under its control, and evidence it complies with section 3503.

Under section 3307, material changes to the application, and changes that might raise material safety and soundness or operational concerns, must be reported within 15 days.

Stablecoin, Listing and Kiosk Rules

Stablecoins. SB 97 repealed Chapter 6, the DFAL's stablecoin chapter. It had barred covered persons from handling a stablecoin unless the issuer met licensing and reserve conditions, or the commissioner approved the coin.

Token listings. Covered exchanges must still certify each asset before listing it. Assets NYDFS approved for listing on or before January 1, 2025 are exempt.

SB 97 moved that cutoff from January 1, 2023. Our listing certification guide covers the form.

Kiosks. The DFPI lists these rules for crypto kiosk operators:

Since January 1, 2024: a list of kiosk locations for the DFPI, and no more than $1,000 a day per customer.
Since January 1, 2025: pre-transaction disclosures, and fees capped at the greater of $5 or 15%.
From July 1, 2026: a license or a completed application.

Evidence to Prepare

The DFPI asks for evidence, not just policies. A file that answers it would hold:

Policies. Every section 3701 program, each with a named responsible individual.
NIST CSF 2.0 mapping. Each function tied to a control and its evidence.
Independent testing. Security assessments and pentests with retests; independent AML testing.
Keys. Generation, backup, recovery and rotation records, with signer sets and thresholds.
Smart contracts. Audit reports, deployed code matched to audited code, and monitoring.
Custody. Customer entitlements reconciled to assets in control, per asset.
Incidents and continuity. Response, continuity and recovery plans, with their latest test results.

How Guardian Helps

Guardian's regulatory and compliance assessments cover this ground:

Regulatory Readiness: each technology, security and custody provision listed by citation, with the control and evidence that meet it.
Cybersecurity Maturity: current and target NIST CSF 2.0 profiles, scored from evidence and Guardian's own testing.
Technical Evidence: audits, pentests closed out with a retest, a privileged role map and deployment verification.

Your counsel owns the legal reading.

Frequently Asked Questions

Who needs a California DFAL license?

From July 1, 2026, anyone exchanging, transferring or storing digital financial assets for a California resident, unless exempt under section 3103. Exemptions include banks, registered broker-dealers for that business, and activity reasonably expected to total $50,000 a year or less.

Can a company operate in California while its DFAL application is pending?

Yes, if it submitted a completed application on or before July 1, 2026 and is awaiting approval or denial. SB 97 added the word "completed" to section 3201 on June 30, 2026.

What cybersecurity standard does the DFPI use for DFAL applicants?

Its application guidance says it evaluates cyber and operational security programs following the NIST Cybersecurity Framework 2.0. Applicants are expected to provide evidence, such as documentation, procedures, assessments or operational samples.

Does DFAL still regulate stablecoins?

Not through a stablecoin chapter. SB 97, an urgency statute signed June 30, 2026, repealed Chapter 6, which set issuer conditions and a commissioner approval process for stablecoins.

Sources

Show the DFPI evidence, not just policies

Guardian tests your security, custody and key controls and maps the evidence to the provisions that apply.

Talk to Guardian Explore regulatory compliance