California's DFAL crypto license: what the July 2026 rules mean for exchanges, crypto ATMs and you

Since 1 July 2026, California has had its own licensing regime for crypto businesses. If a company exchanges, transfers or stores crypto for people in California, it generally needs a license from the state’s financial regulator, the Department of Financial Protection and Innovation (DFPI), or must fit one of a few exceptions.

This guide explains who’s covered, the protections it gives customers, the rules for crypto ATMs, and what changed shortly before the start date. For the equivalent regime in New York, see the New York BitLicense.

What the DFAL is

The Digital Financial Assets Law was created in 2023 by two bills: AB 39, the licensing and regulatory regime, and SB 401, which added rules for crypto kiosks, the machines often called crypto ATMs. According to a 2025 Senate committee analysis, the licensing requirement was first due to start on 1 July 2025, and was pushed back a year by AB 1934 to give the DFPI more time.

Shortly before the new date, SB 97 updated the law. It was passed as an urgency statute and took effect on 30 June 2026, so its changes applied from the day the licensing requirement began.

Who needs a license

The DFAL governs digital financial asset business activity by anyone doing business in California, or by anyone, wherever they’re based, who deals with a California resident. That activity means:

• exchanging, transferring or storing a digital financial asset; or
• holding electronic precious metals, or certificates representing them, for others.

From 1 July 2026, nobody may engage in that activity with a resident, or claim to be able to, unless one of these applies:

1. it’s licensed by the DFPI;
2. it submitted a completed application on or before 1 July 2026 and is awaiting approval or denial; or
3. it’s exempt.

What counts as a digital financial asset

The law defines it as a digital representation of value used as a medium of exchange, unit of account or store of value that isn’t legal tender. That covers coins such as bitcoin and ether. It specifically excludes:

• securities that are registered with, or exempt from, the SEC or the DFPI;
• digital records of ownership of goods, such as art, music, collectibles, in-game assets and event tickets;
• certain merchant rewards and loyalty points;
• value issued by a game publisher and used primarily within online games.

Who’s exempt

The law lists many exemptions. Among them:

• you, when you use crypto solely on your own behalf for personal, family or household purposes, including buying, selling and investing, or receiving it as payment for goods or services;
• FDIC-insured banks, licensed trust companies, and insured credit unions with an office in California;
• people who only provide connectivity software or computing power to secure a network;
• firms whose crypto activity with residents is reasonably expected to be $50,000 a year or less;
• people who receive no compensation for providing crypto services;
• firms regulated by the CFTC or registered as securities broker-dealers, to the extent of that regulated activity.

What a licensed firm must tell you

Before doing business with you, a covered firm must give you disclosures, separately from other information and in a record you can keep. They include:

• its fees and charges, and how and when they’re calculated;
• whether your crypto is covered by any government insurance or guarantee, or by private insurance against theft or loss;
• whether transfers can be reversed;
• its liability for unauthorized, mistaken or accidental transfers, how you report them, and your error resolution rights;
• your right to at least 14 days’ notice of changes to fees or other important terms, except for changes needed to address a risk of loss that don’t concern fees;
• that no digital financial asset is legal tender in California or the US;
• any times in the past 12 months when an outage stopped it serving 10,000 or more customers, and why.

After each transaction, the firm must give you a confirmation showing the type, value, date, precise time and amount, and the fee, including indirect charges. A firm that says so upfront may send one daily confirmation instead.

Extra rules for exchanges

Firms that exchange crypto for residents have further duties:

• Before listing a coin, they must certify to the DFPI that they’ve assessed how likely it is to be treated as a security, disclosed conflicts of interest, carried out a risk assessment covering cybersecurity, theft, code defects and market manipulation, and set policies for delisting. Coins approved by New York’s regulator on or before 1 January 2025 are exempt from this certification.
• They must make every effort to execute your orders fully and promptly, review execution quality at least every six months, and give you an up-to-date description of their order execution practices.

Crypto ATMs: limits on amounts and charges

The kiosk rules from SB 401 already apply. A kiosk operator:

• can’t accept or dispense more than $1,000 a day from or to a customer;
• since 1 January 2025, can’t collect charges on a single transaction above the greater of $5 or 15% of its dollar value, where charges include the gap between the price you pay and the price on a licensed exchange;
• must give you a written disclosure before the transaction, including fees and prices, and a warning if transactions can’t be reversed;
• must give you a receipt showing the amounts, fees and spread;
• must give the DFPI a list of its kiosk locations, which the DFPI publishes on its website.

From 1 July 2026, an operator that carries out the business activity itself must meet the licensing requirement, and one that lets another business do so through its kiosks must make sure that business is licensed. Scammers impersonating government agencies, banks and tech support often send victims to crypto ATMs. See bitcoin ATMs and their risks.

What changed in June 2026

SB 97 made several changes before the start date. Among them:

• applicants relying on a pending application must have submitted a completed application;
• the DFAL’s original stablecoin chapter was repealed;
• exchanging game tokens was removed from the definition of business activity, and the exclusions were updated;
• holders of a New York BitLicense issued or approved by 1 January 2025 can be considered for a conditional license, instead of the earlier cut-off of 1 January 2023.

For stablecoin rules at federal level, see stablecoins explained.

The DFAL at a glance

What it means for you

• Check the firm’s status. Before using a crypto platform as a California resident, find out whether it’s licensed, has an application pending, or claims an exemption, and why. See how to check if a crypto exchange is registered.
• Read the disclosures. They tell you what insurance applies, if any, and what happens after a mistaken or unauthorized transfer.
• Keep your confirmations. They’re useful for disputes and for taxes. See crypto tax in the US.
• Be careful at crypto ATMs. The daily limit caps how much can be lost in one day, but if someone tells you to pay them through a kiosk, stop and check: it’s a common scam script.
• Know where to complain. See how to complain about a crypto company.