Changeflow GovPing Banking & Finance California DFAL License Requirements and July 2...
Priority review Rule Added Final

California DFAL License Requirements and July 2026 Deadline

Favicon for www.jdsupra.com JD Supra Finance & Banking
Published April 6th, 2026
Detected April 7th, 2026
Email

Summary

The California Department of Financial Protection and Innovation (DFPI) has begun accepting Digital Financial Assets Law (DFAL) license applications through the Nationwide Multistate Licensing System (NMLS). Any person engaging in digital financial asset business activity with California residents must submit a complete application by July 1, 2026, or cease operations. The DFAL establishes a "BitLicensesque" regime covering digital asset custody, exchange, issuance, and digital asset kiosks.

What changed

California's DFAL licensing regime has become effective, requiring entities engaged in digital financial asset business activities with California residents to obtain a license from the DFPI. The DFPI will assess applications for completeness, including financial information, control person details, independent BSA/AML program review, and information security programs meeting NIST Cybersecurity Framework 2.0 standards. Stablecoin-related activities and digital asset kiosks face specific additional requirements. The DFPI has also proposed regulations (PRO_02-23) addressing the interaction between DFAL and the Money Transmission Act.

Entities must immediately assess whether their business activities fall within the DFAL's scope and begin the application process through NMLS well before July 1, 2026. A "complete" application must be submitted by the deadline to continue operations past that date. Companies involved in stablecoin custody/exchange or digital asset kiosks should review DFAL chapters specific to those activities. Businesses should not assume DFAL licensure exempts them from other applicable state licenses—each activity requires separate evaluation against licensing triggers under each law.

What to do next

  1. Assess whether your business activities fall within DFAL's scope (digital asset custody, exchange, issuance, kiosks, stablecoin activities)
  2. Begin DFAL license application through NMLS immediately to ensure completion before the July 1, 2026 deadline
  3. Review and prepare NIST Cybersecurity Framework 2.0-compliant information security program and independent BSA/AML review documentation

Source document (simplified)

April 6, 2026

The California DFAL License Application Is Open: Assess Your Business Model Now for the July 1 Deadline

Ximeng (Sammy) Tang Goodwin + Follow Contact LinkedIn Facebook X Send Embed

We published a client alert in April 2024 about the implementation of a “BitLicensesque” regime in California, the Digital Financial Assets Law (DFAL). After an extended delay of the effectiveness of the licensing provisions, the wait is over. The California Department of Financial Protection and Innovation (DFPI) has started accepting applications through the Nationwide Multistate Licensing System (NMLS). Any person who engages in digital financial asset business activity with or on behalf of a California resident and is not otherwise exempt must submit a complete DFAL license application by July 1, 2026, to continue serving California residents.

In the April 2024 alert, we discuss the activities that would be subject to the DFAL licensure requirement. Digital asset custody, exchange, and issuance and certain activities involving online game platforms are all in scope. The DFAL includes specific requirements for stablecoin-related activities and digital asset kiosks. Companies planning to engage in stablecoin exchange or custody or operating a digital asset kiosk should review the relevant chapters carefully.

In addition to the financial and legal information about the applicant and their control persons, a DFAL license applicant must provide an independent review of its Bank Secrecy Act/anti-money laundering program, and develop and maintain an information security and operational security program, among other internal compliance policies and procedures, meeting the requirements of the DFAL. The DFPI will assess the sufficiency of an applicant’s information security program following the National Institute of Standards and Technology Cybersecurity Framework 2.0. Preparation of these items may require significant lead time if an applicant has not already done the groundwork. Because the DFPI requires a “complete” application by July 1, 2026, to continue operations past that date, applicants must assess their licensure applicability and start the application process early.

The DFPI has proposed regulations under the DFAL that would provide some clarification about the interaction between the DFAL and the Money Transmission Act. While the proposed regulations purport to exempt certain digital financial asset business activities from the scope of the Money Transmission Act, one should not assume being a DFAL licensee automatically means that no other license is required. Each business activity should be evaluated against the licensing triggers and available exemptions under each applicable law.

[View source.]

Send Print Report

Related Posts

Latest Posts

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.
Attorney Advertising.

©
Goodwin

Written by:

Goodwin Contact + Follow Ximeng (Sammy) Tang + Follow more less

PUBLISH YOUR CONTENT ON JD SUPRA

  • ✔ Increased readership
  • ✔ Actionable analytics
  • ✔ Ongoing writing guidance Join more than 70,000 authors publishing their insights on JD Supra

Start Publishing »

Published In:

Anti-Money Laundering + Follow Cybersecurity + Follow Department of Financial Protection and Innovation (DFPI) + Follow Digital Assets + Follow Filing Deadlines + Follow FinTech + Follow Licensing Rights + Follow Money Transmission Act + Follow New Legislation + Follow NMLS + Follow Regulatory Requirements + Follow Stablecoins + Follow Finance & Banking + Follow Science, Computers & Technology + Follow more less

Goodwin on:

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra: Sign Up Log in ** By using the service, you signify your acceptance of JD Supra's Privacy Policy.* - hide - hide

Named provisions

Digital Asset Custody Digital Asset Exchange Digital Asset Issuance Stablecoin Requirements Digital Asset Kiosks Information Security Program BSA/AML Requirements

Classification

Agency
CA DFPI
Published
April 6th, 2026
Compliance deadline
July 1st, 2026 (85 days)
Instrument
Rule
Legal weight
Binding
Stage
Final
Change scope
Substantive
Docket
PRO_02-23

Who this affects

Applies to
Financial advisers Technology companies Consumers
Industry sector
5222 Fintech & Digital Payments 5239 Asset Management 5239.1 Cryptocurrency & Digital Assets
Activity scope
Digital Asset Custody Digital Asset Exchange Digital Asset Issuance Digital Asset Kiosks
Threshold
Any person engaging in digital financial asset business activity with or on behalf of California residents who is not otherwise exempt
Geographic scope
California US-CA

Taxonomy

Primary area
Financial Services
Operational domain
Compliance
Compliance frameworks
BSA/AML NIST CSF
Topics
Securities Consumer Protection Anti-Money Laundering

Get Banking & Finance alerts

Weekly digest. AI-summarized, no noise.

Free. Unsubscribe anytime.

Get alerts for this source

We'll email you when JD Supra Finance & Banking publishes new changes.

Optional. Personalizes your daily digest.

Free. Unsubscribe anytime.