Digital asset regulation and tokenization in Virginia

A digital asset business in Virginia must distinguish virtual currency movement from fiat money flows. The Bureau of Financial Institutions draws that boundary for money supervision; it does not alone determine banking custody or securities offering requirements.

Kiosk operators also face a timing decision: the specific framework enacted in 2026 is scheduled to apply on 1 July 2027. Operating plans must distinguish current obligations from preparation for that future date.

How to separate current duties from the 2027 kiosk framework

The Bureau of Financial Institutions notice, revised on 11 August 2026, states that it does not currently regulate virtual currencies, although transactions also transferring fiat money may require licensing. Chapter 19.1 excludes virtual currency from the definition of money and requires assessing the complete service. This distinction cannot be turned into a universal exemption for exchanges, custody or securities.

The 2025 money transmission reform replaced the previous chapter on 1 July 2026. Separately, banks and credit unions have digital custody provisions, while commercial law recognises controllable electronic records. Chapter 22.2 on kiosks, enacted in 2026, expressly carries a future effective date: 1 July 2027. Enactment does not bring its substantive obligations forward.

Which authority supervises each activity

The State Corporation Commission, SCC, exercises different functions through its Bureau of Financial Institutions and Division of Securities and Retail Franchising. The former covers financial institutions and money transmission; securities and intermediary rules require separate analysis. State licensing also does not replace obligations explained in the U.S. federal framework.

For bank custody, Section 6.2-818.1 distinguishes fiduciary and nonfiduciary capacities. The former requires trust powers and a trust department, alongside the prescribed key-control arrangements. Nonfiduciary custody preserves customers’ legal title. Section 6.2-1302.1 permits credit union services and requires prior SCC approval for fiduciary capacity, assessing capital, personnel and the public interest.

Which permission the business model requires

Covered monetary services require licensing unless exempt, together with registration in the Nationwide Multistate Licensing System, NMLS. Sections 6.2-1923 and 1929 provide functional exceptions and allow delegates acting within written contracts. Providing only telecommunications or network access is not money transmission. For remote services, Virginia connection is determined through customer addresses and records; incorporation elsewhere does not resolve that assessment.

Applications require corporate information, activities, responsible individuals, delegates and financial statements, with a nonrefundable $1,000 fee. Section 6.2-1933 sets 120 days from a complete application, extendable for good cause; it does not promise immediate approval. Renewal is annual with a $750 fee. These amounts must be distinguished from investigation costs, NMLS charges, security and net worth requirements.

Tangible net worth under Section 6.2-1950 starts at $100,000, but an asset-based scale can require more. Security is calculated using outstanding liabilities, with an ordinary $100,000 minimum and $1 million maximum; a $100,000 alternative applies where net worth exceeds 10% of assets. None of these amounts establishes unlimited virtual asset protection or general permission to custody every asset.

How holder rights are documented

Title 8.12 governs controllable electronic records, requiring powers of benefit, exclusion, transfer and identification, with qualifications for shared or third-party control. Exclusions include investment property and electronic money. Certain purchasers for value, in good faith and without notice of claims receive protection concerning the record; they do not automatically acquire unencumbered ownership of represented real estate or another underlying asset.

The reform applies from 1 July 2025. Title 8.13 sets an adjustment date one year later, 1 July 2026, alongside continuity and priority rules. Existing security interests must be checked against those requirements: neither unchanged survival nor automatic extinction follows merely from legislative reform. Documentation must connect technical control, transferred rights and underlying-asset formalities.

Where a token constitutes a security, Section 13.1-507 requires registration, an instrument or transaction exemption, or federally covered security status. Intermediaries and advisers retain separate requirements under Section 13.1-504. Appointing a bank custodian does not exempt an issuer from analysing its offering, recipients and distribution.

Which obligations continue during operations

Bank custody requires prior self-assessment, risk management, adequate insurance and provider oversight; appropriate insurance is not public coverage of every balance. For money transmission, Sections 6.2-1943 and 1952 provide for records retained for at least three years and permissible investments against outstanding obligations across all states, with defined insolvency protection. Receipt and refund provisions contain activity and federal-regime exceptions.

Section 55.1-2514.1, introduced in 2026, addresses digital accounts presumed abandoned after five years and actions or communications interrupting that period. Delivery to the state depends on key control; the law provides for retention, delivery in kind or liquidation instructions subject to conditions. It does not authorise automatic liquidation of every inactive wallet or apply solely because no sales occurred.

From July 2027, kiosks will require specific licensing. The framework provides daily limits of $2,000 for new users and $5,000 for others, and $10,000 monthly; it defines new users through an initial 14-day period. It adds minimum 48-hour holds on their transactions, cancellation and refunds during that period, an 18% charge cap, identification, warnings and live assistance. Local authorities may impose stricter requirements.

Future fraud-related fee refunds require notice to the operator within 90 days and documentation or a sworn statement within 120 days. The official legislative summary distinguishes application acceptance, required by March 2027, from licences beginning in July. These milestones do not replace monetary or consumer obligations already applicable in 2026.

What to prepare before launching the project

Document which entity receives dollars and which controls digital assets, alongside the Virginia customers served. For bank custody, identify the fiduciary or contractual arrangement and the custodian’s specific powers.

For kiosks, prepare an application and implementation timetable for Chapter 22.2 without presenting future limits as current duties. For investment tokens, separately complete offering and issuer-rights analysis.

To understand how this framework applies to your project, discuss your case with our team.