Digital asset regulation and tokenization in California

A business may fall under California rules by serving state residents even if its team and company are elsewhere. For a digital asset project, the first task is to separate exchange, transfer, custody and issuance, and identify the entity controlling each operation.

The Digital Financial Assets Law, or DFAL, provides a specific route for covered activities. This guide explains its relationship with money transmission and securities law, the distinction between applying for and obtaining a licence, and what needs resolution before opening the service.

Which activities fall within DFAL

The Digital Financial Assets Law, DFAL, forms Division 1.25 of the Financial Code. Its market-access framework became operative on 1 July 2026. SB97, Chapter 52 of 2026, approved with immediate effect on 30 June, amended definitions, exemptions, application continuity and obligations. The original 2023 wording is insufficient to determine current conditions.

The current definition covers exchanging, transferring and storing digital financial assets, alongside specified activities involving electronic precious-metal certificates. A connection with a resident can bring a business established outside California within scope. Section 3103 includes entity and activity exemptions, including certain banks and exclusively technical functions. A decentralised label does not replace examination of effective control and the service provided.

The amendment removes asset administration as a standalone category and repeals the dedicated stablecoin chapter. This does not make exchanging or safeguarding stablecoins exempt: these activities must be assessed against the functions retained in section 3102. Exclusions for loyalty programmes, games and digital records of specified goods have their own conditions; they do not place every utility token outside the law.

What DFPI supervises and what remains federal

The Department of Financial Protection and Innovation, DFPI, administers DFAL and state money transmission and securities rules within their respective scope. Assessment starts with activities and assets, rather than the platform's commercial description. Providers need to distinguish fiat funds, digital assets, custody, intermediation and issuance to determine which framework applies to each flow.

Federal requirements require separate consideration. Registration with the Financial Crimes Enforcement Network, FinCEN, is not a DFAL licence; state licensing does not authorise securities offerings or derivatives trading outside the applicable rules. The United States guide explains those responsibilities and the federal stablecoin timetable without attributing general federal permission to California.

What permits operation under the access framework

Amended section 3201 provides three routes: licensing, a completed application submitted by 1 July 2026 awaiting approval or denial, or a statutory exemption. Opening an incomplete file is insufficient. A business entering after that date cannot infer permission to operate merely from applying: unless exempt, it must obtain a licence before commencing covered activity.

DFPI opened applications on 9 March 2026 through the Nationwide Multistate Licensing System, NMLS. Opening the process evidences an application route, rather than proving that every applicant received authorisation. Evidence of timely completion should be retained and the application status supporting continued operations confirmed with the supervisor.

Section 3205 allows the commissioner to grant conditional licences to certain New York BitLicense or limited purpose trust charter holders authorised no later than 1 January 2025. Fees and California compliance are required; recognition is not automatic. Separately, section 3207 requires a surety bond or trust account, capital and liquidity according to business risks. That provision contains no universal amount satisfying every requirement.

What changes when a token represents a security

Section 3102(g) excludes from the DFAL definition certain securities registered, qualified or exempt under the specified legislation. Exclusion leaves their own regulatory framework applicable; it does not remove securities regulation. Corporations Code section 25110 requires qualification of issuer offerings or an applicable exemption. The instrument, distribution method and federal and state requirements must be identified for each transaction.

For custodied assets, Financial Code section 3503 requires sufficient quantities of each type to satisfy aggregate customer entitlements. Assets are held for their owners rather than as the provider's freely available property. The provision allows a contractual structure under Commercial Code Division 8 involving a securities intermediary and securities account; this option requires documentation and compliance, beyond an on-chain entry.

A digital record excluded from DFAL does not itself establish real estate ownership, corporate membership or copyright ownership. Documentation must identify what transfers, the obligor and the formalities applicable to the asset or right. Custody protections also do not guarantee absence of loss or remove the need to assess insolvency proceedings.

Which safeguards and controls the service needs

Amended sections 3501, 3505 and 3701 provide for fee, risk, error and execution disclosures; assessment and monitoring of listed assets; and security, continuity, fraud prevention and anti-money laundering programmes. Policies must fit the business. A licence is not evidence of public insurance: actual available protection and its extent must be disclosed.

Section 3211 distinguishes reviewed and audited financial information under the statutory conditions and requires reporting material incidents. Live telephone assistance is addressed in section 3507. Data handling and blocking powers must remain consistent with applicable exemptions; retaining a limited anti-fraud power is not automatically equated with regulated control over every asset.

DFAL implementing rules and their coordination with the Money Transmission Act were adopted with effect from 29 June 2026. Specific exemptions from the second licence exist, so dual licensing is not invariably required. Before relying on them, confirm the transaction flow, operator status and limits of the final regulations; an exemption should not be extended to the entire business.

What to prepare before serving California residents

The team should assemble a map of resident customers, listed assets, control powers and funds flows. Identify the permission, exemption or transitional position supporting each function and the responsible entity. Evidence of a timely completed application must be distinguished from a licensing decision.

Also assess fiat funds, custody documentation and any securities classification. Where relying on a regulatory exception to a second licence, check its final text and the particular case before incorporating that conclusion into the model.

To understand how this framework applies to your project, discuss your case with our team.