California DFAL: crypto risk and regulation 2026

Key Takeaways:

• The licensing clock is ticking: California’s DFAL requires all crypto exchanges, kiosks, custodians, OTC desks, and stablecoin issuers serving California residents to complete a DFPI license application by July 1, 2026. Applications opened on March 9, 2026, via the NMLS. Missing the deadline disqualifies operators from continuing to practice and blocks future applications.

• Missing the DFAL deadline means missing out: With the USA’s largest state-level and deeply tech-driven economy, and highest crypto adoption rates nationally, crypto businesses – both in-state and out – that don’t beat the clock will lose access to the country’s biggest, most influential market.

• California leads the US in crypto crime losses: In 2024, California topped all US states in crypto-related complaints and losses across investment scams, ATM fraud, and sextortion, with residents aged 60 and over bearing the brunt. DFAL’s AML and fraud prevention requirements, including protections against elder abuse, are a direct regulatory response to these realities.

• DFAL’s compliance bar is high and technically specific: Applicants must demonstrate mature AML programs, blockchain analytics capabilities, NIST CSF 2.0-aligned cybersecurity, Travel Rule compliance, and risk-based KYC. DFPI will assess all six statutory standards before granting a license. Firms without a robust compliance infrastructure in place face a challenge to getting one in place by the deadline.

California at a glance

California, a western US state on the Pacific Ocean that borders Mexico to its south, has an estimated population of 39.4 million (July 2025), approximately 11.3% of the US population of 348,4 million (2026). Its 2024 GDP of over $4Tn makes it the largest state-level economy in the US and easily places it in the top ten economies of the world when similarly ranked that year. 

In addition to generating 14.14% of US GDP in 2024, California is estimated to host up to a quarter of US blockchain businesses. The state’s market size, technically driven economy, and comprehensive crypto regulatory framework mean California’s progress in digital asset adoption and management is likely to influence practices in other states. 

The Executive Director of the California Blockchain Advocacy Coalition, Joseph M. Ciccolo, alluded to California’s national status in his October 15, 2025, letter to the Department of Financial Protection and Innovation (DFPI) seeking clarification of certain terms of the incoming application process: He wrote: “Many of the most recognized digital asset projects and companies were founded in California or maintain a significant operational footprint here, underscoring the state’s outsized role in advancing this emerging sector.” 

To hear more about how US states are adapting to the GENIUS Act, watch our conversation with Joe Ciccolo and others here. 

Crypto adoption rate: 

According to Coinbase, drawing data from Morning Consult and a Toluna study, 27% of Californians surveyed owned crypto in February 2024, the highest rate in the US, of whom 40% were aged 18-34. Meanwhile, according to 2022 Internal Revenue Service (IRS) tax data analyzed by SmartAsset, 2.25% of Californian households (416,340 households) filed returns indicating digital asset involvement, making it the third-most-compliant state for crypto-specific tax matters. 

Key trading infrastructure: 

Californians enjoy access to: 

• All major U.S.-based crypto exchanges (Includes: Coinbase, Kraken, Gemini, Robinhood, Binance US [NOT Binance Global], Crypto.com, bitflyer USA, Uphold, OKX). 

• Peer-to-peer trading marketplaces (includes: Paxful, Binance P2P, KuCoin P2P, LocalCoinSwap, HODL HODL, Symlix, Bisq). 

• Over-the-counter (OTC) desks: Includes: FalconX, sFOX, Koi Trading, Coinbase Prime, Binance.US OTC, Circle Trade, Kraken OTC (all California-based), Cumberland (DRW), Galaxy Digital OTC, Genesis Global OTC, Nexo OTC, Crypto.com OTC, B2C2, GSR Markets, Wintermute, (all based elsewhere, including abroad, but operate in California.) 

• Crypto ATMs: There are at least 1,721 Bitcoin ATMs alone operating in California, of which 1,038 are in Los Angeles, according to CoinATM Radar. Meanwhile, DFPI data from late-2024 indicated 4,647 registered kiosks in the state, as required under DFPI Financial Code 3906. 

• Crypto-focused banking services, institutional trading platforms, and crypto payment processors integrated with businesses. 

Regulatory framework 

California maintains a progressive but comprehensive regulatory approach to crypto. The 2023 Digital Financial Assets Law (DFAL), comprising Assembly Bill 39 and Senate Bill 401, established a specialized licensing regime for crypto businesses through the Department of Financial Protection and Innovation (DFPI). The DFPI is the primary regulatory authority for crypto businesses in the state, administering DFAL and operating an enforcement and monitoring arm under its digital financial assets program. 

Live obligations & deadlines 

DFAL is set to be fully implemented by the DFPI’s July 1, 2026, deadline (extended from July 1, 2025), covering the licensing of all persons or entities that engage in any form of trade or storage of digital assets with or for Californian residents. License applications for the process opened on March 9, 2026, and an information session will follow on the 23rd. 

On and after the July 1 deadline, DFAL will prohibit “[any] person from engaging in digital financial asset business activity or presenting itself as being able to engage in digital financial asset business activity with or on behalf of a California resident unless certain criteria are met, including [that] they are licensed by the DFPI.”  

Failure to submit the license application timeously will disqualify the defaulting person or entity from continuing to practice, even if they are currently practicing, and will hamper any and all new applications. 

Applications are to be submitted through the Nationwide Multistate Licensing System (NMLS) and must include a non-refundable fee. The DFPI will then assess whether applicants meet six statutory standards, including sound financial condition, relevant experience, good character, and a reasonable prospect of success. 

Core focus areas of the DFAL license include: 

The anti-money laundering (AML) program: Applicants must maintain up-to-date Bank Secrecy Act (BSA)/AML policies, employ an experienced BSA Compliance Officer, conduct ongoing staff training, and implement risk-based KYC and customer due diligence processes. They are also expected to use blockchain analytics to prevent use of their services for terrorist financing, sanctions evasion, darknet activity, ransomware, and fraud, and to comply with the Travel Rule and suspicious activity reporting/currency transaction reporting (SAR/CTR) filing obligations. 

Cyber & operational security: The DFPI will evaluate applicants’ security programs against the NIST Cybersecurity Framework (CSF) 2.0, assessing governance, asset identification, access controls, data protection, threat detection, incident response, and recovery capabilities. Applicants must provide documentation demonstrating maturity across all CSF requirements. 

Notably, DFAL’s fraud prevention requirements include maintaining processes to prevent the abuse of the elderly. This is significant, as an estimated 22.5% of Californians are 60 or older, and the average age of Californians is expected to increase in the coming years. As the next section will show, this demographic is particularly vulnerable to crypto-related financial crime. 

Financial crime profile 

Crypto-related fraud throughout the USA increased by 66% in losses from 2023 to 2024 ($9.3B in 2024), while the number of complaints more than doubled from about 70,000 in 2023 to 149,686 in 2024. According to the FBI, Californians 60 or older bore the brunt by age group in 2024, losing $800M and filing the most complaints. 

Of crimes with a crypto nexus, investment scams, ATM frauds, and sex/extortion schemes were identified as rising attack vectors. Citizens aged 60 and over once again suffered the highest losses across all three categories nationally. 

By state, California led in both the number (19,508) and the losses ($1.39B) of these three complaint categories in 2024. 

Source: FBI Internet Crime Report 2024. 

The DFPI vigorously prosecutes violations of all manner of financial transgressions and, in July 2025, achieved its first enforcement action under DFAL, against the Coinme crypto kiosk operator. 

Crystal Intelligence data 

Our next report will focus on New York State, and this section will contain research by the Crystal data intelligence team. Watch this space. 

Who needs to act 

With license applications now open via NMLS, the window to act is wide open: 

Centralized exchanges operating in California, whether headquartered in the state or serving its residents from elsewhere, must apply. This includes all major US-based platforms currently accessible to Californians, as well as any out-of-state or foreign exchange with a California-resident customer base. 

Crypto kiosk operators are already subject to live DFAL obligations – including transaction fee caps and pre-transaction disclosure requirements – and must additionally meet the July 2026 licensing deadline. 

OTC desks and institutional trading platforms, whether California-domiciled or operating in the state, fall within DFAL’s purview when they exchange, transfer, or store digital assets on behalf of residents. 

Stablecoin issuers face additional DFAL obligations: no entity may exchange, transfer, or store a stablecoin unless its issuer is a DFAL applicant, licensee, or qualifying financial institution maintaining eligible securities against outstanding issuance. 

Peer-to-peer platforms and DeFi-adjacent services should seek legal counsel on applicability, as DFAL’s definitions are deliberately broad and exemptions are hard to achieve. 

Crystal Intelligence’s view 

Crystal Intelligence provides blockchain analytics and compliance capabilities that help crypto businesses, regulators, and law enforcement navigate the exact environment DFAL creates. From AML program support and transaction monitoring to sanctions screening and illicit flow detection, Crystal’s tools are built to meet the compliance obligations DFAL demands. 

As California’s licensing regime goes live, firms seeking to meet DFPI’s expectations around blockchain analytics, their compliance teams, and the investigators tasked with holding them to account, will require Crystal as an indispensable partner.