What is the California DFAL license?

California built a dedicated rulebook for digital assets rather than stretching its old money transmitter statute to cover them. The Digital Financial Assets Law, enacted as Assembly Bill 39, creates a purpose-built license for businesses that deal in digital assets with California residents. It is administered by the Department of Financial Protection and Innovation, sits apart from the state Money Transmission Act, and takes effect July 1, 2026.

Why California created a separate framework

For years, crypto businesses serving Californians lived in uncertainty about whether and how the existing money transmitter rules applied to them. The DFAL replaces that ambiguity with a framework written for digital asset activity specifically. It defines the covered activities, sets standards tailored to how digital asset businesses actually operate, and gives the Department of Financial Protection and Innovation clear authority to license and supervise them. The design intent is a regime that fits custody, exchange, and transfer of digital assets rather than one retrofitted from traditional payments.

Who the license is aimed at

The law targets digital financial asset business activity conducted with or on behalf of a California resident. In broad terms, a business that exchanges, transfers, or stores digital assets for California residents generally needs the license once the law is in force, unless a specific exemption applies. That reaches exchanges, custodial wallet providers, and firms that move digital assets for customers. Whether a particular model is covered is a legal question that turns on the facts, so the classification should be confirmed with an independent licensing attorney before you rely on it. We address the coverage question directly in whether you need a California DFAL license.

How you apply

Applications run through the Nationwide Multistate Licensing System, the same platform states use for many financial-services licenses. Filing in the NMLS means setting up a company record, submitting the application and supporting materials there, and maintaining that record over the life of the license. Companies already licensed for other activities in the system will find the mechanics familiar, though the DFAL has its own content requirements layered on top.

What the regulator expects

The Department of Financial Protection and Innovation is looking for a business that can operate safely and protect its customers. Expect the application and ongoing supervision to focus on several areas:

• Financial standards demonstrating the business is sound enough to meet its obligations.
• Custody and consumer protection practices for how customer digital assets are held and safeguarded.
• An anti-money-laundering program consistent with federal expectations under FinCEN.
• Disclosures and background information on the people who own and control the business.

These are not box-checking items. The custody and AML expectations in particular require real policies, controls, and documentation that a reviewer can test, so they take time to build well.

How DFAL relates to other licenses

The DFAL is separate from California's Money Transmission Act, and it is separate again from federal registration. A business handling digital assets may still have federal obligations, such as registering as a money services business with FinCEN, which is a different requirement from state licensing. We explain that federal piece in what a money services business license is and the broader question of crypto and money transmission in whether you need a money transmitter license for crypto. Mapping which of these apply to your model is part of the up-front analysis, not an afterthought.

What DFAL supervision looks like after approval

A license is the start of a supervised relationship, not the end of the work. Once licensed, a digital asset business under the DFAL can expect ongoing oversight from the Department of Financial Protection and Innovation: periodic reporting, examinations that test whether the custody and AML controls described in the application are actually operating, and requirements to maintain the financial standards that supported approval. Changes in ownership or control, new lines of activity, and material shifts in how customer assets are held generally have to be reported, sometimes in advance. Building for that supervised life from the outset, with documentation a reviewer can follow, makes examinations far less disruptive than retrofitting records after a request arrives.

The custody expectations deserve particular attention because they are where digital asset businesses differ most from traditional payments firms. Regulators want to understand how private keys are secured, how customer assets are segregated, what happens to customer holdings if the business fails, and how the business proves it holds what it owes customers. These are engineering and governance questions as much as legal ones, and they take real lead time to document to a standard the regulator will accept.

Getting the classification right before you build

Because the standards are substantial, the worst outcome is building a full program for a license you did not need, or discovering late that you are covered and out of time. The classification is fact-specific and hinges on whether and how you take custody of customer assets, so it should be settled with an independent licensing attorney before the build begins. We work through that coverage question in whether you need a California DFAL license, and the timing considerations in when the California DFAL deadline falls.

Why timing is the central issue

Because the law has a fixed effective date of July 1, 2026, the schedule is the thing to manage. Building an AML program, documenting custody controls, assembling financials, and completing the NMLS filing all take lead time, and a covered business needs to be positioned before the deadline rather than scrambling after it. We cover the deadline mechanics, including the transitional path for applications filed on time, in when the California DFAL deadline falls.

How to prepare the application well

The businesses that fare best treat the filing as the output of a program that already exists, not a form to be filled in at the end. That means the substantive pieces are built and documented first, so the application describes something real rather than promising something planned. A practical order of work helps.

• Settle coverage with counsel so you are not building a program for a license you do not need.
• Write the custody model down in detail: how keys are secured, how customer assets are segregated, and how you prove you hold what you owe.
• Stand up the anti-money-laundering program with policies, controls, and named responsibilities a reviewer can test.
• Assemble financial statements that show the business can meet its obligations.
• Gather control person disclosures and background materials early, since these often take the longest to collect.

Working in that sequence means the NMLS filing becomes an assembly step rather than a scramble, and it leaves margin to answer the regulator's follow-up questions without missing the effective date. We connect this to the broader discipline of building a program in structuring a licensing compliance program.

When to get help

Because coverage is fact-specific and the standards are substantive, most digital asset businesses benefit from an early assessment: confirm with counsel whether the license applies, then build the program and file well ahead of the effective date. Our team supports that work on our California DFAL license page and across our broader cryptocurrency licensing practice. Contact our team to assess your model against the law and plan the filing timeline.