California DFAL: crypto risk and regulation 2026

Key Takeaways:

• • The licensing clock ran out: California’s DFAL required all crypto exchanges, kiosks, custodians, and OTC desks serving California residents to have a complete DFPI license application on file by July 1, 2026 – a deadline that has now passed. Applications opened on March 9, 2026, via the NMLS. Missing the deadline disqualified operators from continuing to serve California residents and barred late filings from counting toward the safe harbor. 
  • Missing the DFAL deadline meant missing out: With the USA’s largest state-level and deeply tech-driven economy, and highest crypto adoption rates nationally, crypto businesses – both in-state and out – that didn’t beat the clock have lost access to the country’s biggest, most influential market. 
  • California leads the US in crypto crime losses: In 2025, California topped every US state in total IC3 complaints and losses (116,414 complaints, $3.675B), and also led the nation in both cryptocurrency-related complaints ($2.1B in losses) and complaints from residents 60 and older ($1.4B in losses) – nationally, that age group’s losses jumped 59% year over year to $7.748B. DFAL’s AML and fraud prevention requirements, including protections against elder abuse, are a direct regulatory response to these realities. 
  • DFAL’s compliance bar is high and technically specific: Applicants must demonstrate mature AML programs, blockchain analytics capabilities, NIST CSF 2.0-aligned cybersecurity, Travel Rule compliance, and risk-based KYC. DFPI assesses all six statutory standards before granting a license. Firms that lacked a robust compliance infrastructure before the deadline now face a steep climb while DFPI reviews their filing. 

California at a glance

California, a western US state on the Pacific Ocean that borders Mexico to its south, has an estimated population of 39.4 million (July 2025), approximately 11.3% of the US population of 348,4 million (2026). Its 2024 GDP of over $4Tn makes it the largest state-level economy in the US and easily places it in the top ten economies of the world when similarly ranked that year. 

In addition to generating 14.4% of US GDP in 2024, California is estimated to host up to a quarter of US blockchain businesses. The state’s market size, technology-driven economy, and comprehensive crypto regulatory framework mean that California’s progress in digital asset adoption and management is likely to influence practices in other states. 

The Executive Director of the California Blockchain Advocacy Coalition, Joseph M. Ciccolo, alluded to California’s national status in his October 15, 2025, letter to the Department of Financial Protection and Innovation (DFPI) seeking clarification of certain terms of the incoming application process. He wrote: “Many of the most recognized digital asset projects and companies were founded in California or maintain a significant operational footprint here, underscoring the state’s outsized role in advancing this emerging sector.” 

To hear more about how US states are adapting to the GENIUS Act, watch our conversation with Joe Ciccolo and others here. 

Crypto adoption rate: 

According to Coinbase, drawing data from Morning Consult and a Toluna study, 27% of Californians surveyed owned crypto in February 2024, the highest rate in the US, of whom 40% were aged 18-34.

Key trading infrastructure: 

Californians enjoy access to: 

• All major U.S.-based crypto exchanges (Includes: Coinbase, Kraken, Gemini, Robinhood, Binance US [NOT Binance Global], Crypto.com, bitflyer USA, Uphold, OKX). 

• Peer-to-peer trading marketplaces (includes: Paxful, Binance P2P, KuCoin P2P, LocalCoinSwap, Symlix, Bisq). 

• Over-the-counter (OTC) desks: Includes: FalconX, sFOX, Koi Trading, Coinbase Prime, Binance.US OTC, Circle Trade, Kraken OTC (all California-based), Cumberland (DRW), Galaxy Digital OTC, Genesis Global OTC, Nexo OTC, Crypto.com OTC, B2C2, GSR Markets, Wintermute, (all based elsewhere, including abroad, but operate in California.) 

• Crypto ATMs: There are at least 1,721 Bitcoin ATMs alone operating in California, of which 1,038 are in Los Angeles, according to CoinATM Radar. Meanwhile, DFPI data from late-2024 indicated 4,647 registered kiosks in the state, as required under DFPI Financial Code 3906. 

• Crypto-focused banking services, institutional trading platforms, and crypto payment processors are integrated with businesses. 

Regulatory framework 

California maintains a progressive but comprehensive regulatory approach to crypto. The 2023 Digital Financial Assets Law (DFAL), comprising Assembly Bill 39 and Senate Bill 401, established a specialized licensing regime for crypto businesses through the Department of Financial Protection and Innovation (DFPI). The DFPI is the primary regulatory authority for crypto businesses in the state, administering DFAL and operating an enforcement and monitoring arm under its digital financial assets program.

On June 30, 2026, Governor Newsom signed SB 97, an urgency clean-up statute affecting stablecoins and the application safe harbor. 

Live obligations & deadlines 

DFAL’s licensing requirement took effect on the DFPI’s July 1, 2026, deadline (extended from July 1, 2025), covering the licensing of all persons or entities that engage in any form of trade or storage of digital assets with or for Californian residents. License applications for the process opened on March 9, 2026, and an information session followed on the 23rd. 

On and after the July 1 deadline, DFAL has prohibited “[any] person from engaging in digital financial asset business activity or presenting itself as being able to engage in digital financial asset business activity with or on behalf of a California resident unless certain criteria are met, including [that] they are licensed by the DFPI.”  

Failure to have a completed application on file by the deadline disqualified the defaulting person or entity from continuing to practice and hampers any new applications. 

Applications are submitted through the Nationwide Multistate Licensing System (NMLS) and must include a non-refundable fee. The DFPI assesses whether applicants meet six statutory standards, including sound financial condition, relevant experience, good character, and a reasonable prospect of success; a running list of applicants under review is published on DFPI’s site.

Core focus areas of the DFAL license include: 

The anti-money laundering (AML) program: Applicants must maintain up-to-date Bank Secrecy Act (BSA)/AML policies, employ an experienced BSA Compliance Officer, conduct ongoing staff training, and implement risk-based KYC and customer due diligence processes. They are also expected to use blockchain analytics to prevent use of their services for terrorist financing, sanctions evasion, darknet activity, ransomware, and fraud, and to comply with the Travel Rule and suspicious activity reporting/currency transaction reporting (SAR/CTR) filing obligations. 

Cyber & operational security: The DFPI will evaluate applicants’ security programs against the NIST Cybersecurity Framework (CSF) 2.0, assessing governance, asset identification, access controls, data protection, threat detection, incident response, and recovery capabilities. Applicants must provide documentation demonstrating maturity across all CSF requirements. 

Notably, DFAL’s fraud prevention requirements include maintaining processes to prevent the abuse of the elderly. This is significant, as an estimated 22.5% of Californians are 60 or older, and the average age of Californians is expected to increase in the coming years. As the next section will show, this demographic is particularly vulnerable to crypto-related financial crime. 

Financial crime profile 

Crypto-related fraud throughout the USA increased by 22% in losses from 2024 to 2025 ($9.3B $11.4B), while the number of complaints similarly increased by 21% to 181,565. California retained its number one position in both categories, with $2.1B lost and 20.878 complaints. 

Source: FBI Internet Crime Report 2025. 

In 2025, California also led in crypto fraud losses ($1.4B) and victims (22,157) among citizens over 60, with investment scams ($677M) proving the costliest to them. 

Meanwhile, the DFPI vigorously prosecutes violations of all manner of financial transgressions and, in July 2025, achieved its first enforcement action under DFAL. 

The DFPI vigorously prosecutes violations of all manner of financial transgressions and, in July 2025, achieved its first enforcement action under DFAL, against the Coinme crypto kiosk operator. 

Who needs to act 

With the July 1 deadline behind us, here is where each category of business now stands: 

Centralized exchanges operating in California, whether headquartered in the state or serving its residents from elsewhere, must apply. This includes all major US-based platforms currently accessible to Californians, as well as any out-of-state or foreign exchange with a California-resident customer base. 

Crypto kiosk operators are already subject to live DFAL obligations – including transaction fee caps and pre-transaction disclosure requirements – and must additionally meet the July 2026 licensing deadline. 

OTC desks and institutional trading platforms, whether California-domiciled or operating in the state, fall within DFAL’s purview when they exchange, transfer, or store digital assets on behalf of residents. 

Stablecoin issuers are no longer subject to DFAL’s standalone stablecoin chapter, which SB 97 repealed on June 30, 2026, given the federal GENIUS Act; issuers doing other covered exchange, transfer, or custody activity may still need a general DFAL license. 

Peer-to-peer platforms and DeFi-adjacent services should seek legal counsel on applicability, as DFAL’s definitions are deliberately broad and exemptions are hard to achieve. 

Crystal Intelligence’s view 

Crystal Intelligence provides blockchain analytics and compliance capabilities that help crypto businesses, regulators, and law enforcement navigate the exact environment DFAL creates. From AML program support and transaction monitoring to sanctions screening and illicit flow detection, Crystal’s tools are built to meet the compliance obligations DFAL demands. 

As California’s licensing regime goes live, firms seeking to meet DFPI’s expectations around blockchain analytics, their compliance teams, and the investigators tasked with holding them to account, will require Crystal as an indispensable partner.