To date, crypto companies have been able to operate in California without a license, but that will change effective July 2025 under the state’s newly-enacted “Digital Financial Assets Law” (the Law), signed by Governor Newsom on 13 October. The Law is California’s first comprehensive framework to regulate the digital asset market in the state, including specific provisions for stablecoins.

Under the Law, unless exempted, businesses must obtain a license and comply with various prudential requirements, recordkeeping rules, and disclosure requirements to engage in (or hold themselves out as engaging in) “digital financial asset business activity” with or on behalf of a California resident (as defined). The term digital financial asset is defined as digital mediums of exchange, units of account, or stores of value. The definition of digital financial asset business activity—i.e., those activities that trigger the licensing requirement—is expansive: “(1) [e]xchanging, transferring, or storing a digital financial asset or engaging in digital financial asset administration, whether directly or through an agreement with a digital financial asset control services vendor[;] (2) [h]olding electronic precious metals or electronic certificates representing interests in precious metals on behalf of another person or issuing shares or electronic certificates representing interests in precious metals[;] (3) [e]xchanging one or more digital representations of value used within one or more online games, game platforms, or family of games for either of the following: (A) [a] digital financial asset offered by or on behalf of the same publisher from which the original digital representation of value was received [or] (B) [l]egal tender or bank or credit union credit outside the online game, game platform, or family of games offered by or on behalf of the same publisher from which the original digital representation of value was received.” 

Some of the Law’s requirements are similar to existing money transmitter licensing requirements—the laws under which most states regulate digital asset activity—including surety bond requirements, net worth requirements, and recordkeeping obligations. Notably, however, there are several consequential provisions that relate to digital assets specifically. 

BROAD ENFORCEMENT POWERS

The Law grants the Department of Financial Protection and Innovation (DFPI) broad and, frankly, worryingly vague enforcement power. DFPI can bring enforcement proceedings against an entity that “has engaged, is engaging, or is about to engage in digital financial asset business activity.” There is no further guidance on how close in time an entity must be to qualify as “about to” engage in any of the enumerated activities. Absent some limiting factor, the broad language of this provision could capture entities that are in the early-to-mid stages of developing a product. In his signing statement, Governor Newsom urged DFPI to engage in thoughtful rulemaking to, among other things, clarify ambiguities in the Law. 

ROBUST DISCLOSURE REQUIREMENTS

The Law mandates that licensees provide extensive consumer disclosure requirements prior to engaging in the digital financial asset business activity. This pre-activity disclosure(s) must address 10 different categories of information, including: (1) a schedule of fees and charges that may be assessed, including how they will be calculated and when they will be imposed; (2) whether the product is covered by certain insurance protections; and (3) a description of error resolution rights and liability. In some instances, a licensee must also provide a per transaction confirmation that contains prescribed information.

EXCHANGE REQUIREMENTS

Reminiscent of the token listing requirements imposed under the BitLicense regime, the Law imposes specialized obligations on exchanges. Among other things, an exchange is required to identify the likelihood that a listed digital financial asset would be deemed a security by federal or California regulators—something that is no small feat when regulators and courts alike can’t seem to reach a consensus. Exchanges are also required to conduct “comprehensive risk assessment[s]” of their listed tokens to ensure consumers are protected from risks relating to cybersecurity, protocol defects, and price manipulation and fraud. The foregoing requirements do not apply to a token that has been approved for listing under the BitLicense regime on or before 1 January 2023, by New York’s Department of Financial Services. Exchanges must also ensure that exchange rates between assets are as “favorable as possible” to consumers.

STABLECOIN-SPECIFIC REQUIREMENTS

The Law addresses stablecoins separately, and it’s clear that the legislature contemplated the potential use of stablecoins as a payment instrument. The term stablecoin is defined as “a digital financial asset that is pegged to the United States dollar or another national currency and is marketed in a manner that intends to establish a reasonable expectation or belief among the general public that the instrument will retain a nominal value that is so stable as to render the nominal value effectively fixed.” A person may not exchange, transfer, or store stablecoins unless the stablecoin’s issuer is an applicant, licensee, or certain financial institutions, and holds eligible securities with an aggregate market value of no less than the value of outstanding stablecoins issued or sold. DFPI has discretion in approving which stablecoins are approved for exchange, transfer, or storage, looking at enumerated factors such as “amount, nature, and quality of assets owned or held by the issuer of the stablecoin that may be used to fund any redemption requests from residents.” The Law specifically provides that DFPI may require the issuer of a stablecoin to obtain a license DFPI will approve a stablecoin’s use. 

BITLICENSE RECIPROCITY

The Law allows for conditional licensure for applicants who hold a New York BitLicense or limited purpose trust company charter with approval to conduct virtual currency business in New York issued on or before 1 January 2023.

The Law brings to a close the relative freedom that crypto companies have enjoyed in California. Those companies have less than two years to evaluate the impact of the Law on their operations and bring themselves into compliance.