On October 13, 2023, California Gov. Gavin Newsom signed two bills into law that will impose sweeping obligations on companies engaged in virtual currency activities in California and with California residents. Newsom vetoed similar legislation last year due to concerns that it lacked the flexibility necessary to adapt to the rapidly evolving cryptocurrency landscape. Given that California was an outlier among the largest US states in leaving virtual currency activities to a great extent unregulated under the money transmission regulatory framework, the enactment of these new laws carries profound implications for the cryptocurrency industry.
The first bill (AB 39) – the California Digital Financial Assets Law (DFAL) – is a new virtual currency licensing regime with similarities to New York’s virtual currency regulations, which require entities conducting virtual currency business activity in New York to obtain a “BitLicense” (or a charter under the New York Banking Law). The second bill (SB 401) is tied to the DFAL and specifically regulates “digital financial asset transaction kiosks,” which are generally defined as devices that are “capable of accepting or dispensing cash in exchange for a digital financial asset.”
The California Digital Financial Assets Law (DFAL)
Overview
The DFAL prohibits a person from engaging in digital financial asset business activity – or holding itself out as being able to engage in digital financial asset business activity – without meeting certain criteria and obtaining a license from the California Department of Financial Protection and Innovation (DFPI).
Similar to other states’ definitions of regulated virtual currency activity (although using a different term), the law defines “digital financial asset” to mean “a digital representation of value that is used as a medium of exchange, unit of account, or store of value, and that is not legal tender, whether or not denominated as legal tender.” The definition of a digital financial asset excludes rewards points and value issued and usable only within an online game platform, provided certain criteria are met. Securities registered with or exempt from registration with the Securities and Exchange Commission (SEC)1 or the DFPI also are excluded from this definition.
A number of persons are exempt from the DFAL, including, but not limited to:
- Banks.
- Certain trust companies.
- Persons that provide processing, clearing or settlement services solely for transactions between or among persons that are exempt from the licensing requirements.
- Persons using a digital financial asset, or obtaining a digital financial asset as payment, solely for personal, family or household purposes, or academic purposes.
- A merchant that accepts a digital financial asset as payment for the purchase or sale of goods or services, which does not include digital financial assets.
- Persons whose digital financial asset business activity with, or on behalf of, California residents is reasonably expected to be valued, in the aggregate, on an annual basis at $50,000 or less.
- Persons that contribute only connectivity software or computing power to securing a network that records digital financial asset transactions or to a protocol governing transfer of the digital representation of value.
Distinct from the enumerated exemptions, the DFAL also authorizes the DFPI commissioner to further exempt any class of persons or transactions, if the commissioner finds the exemption to be in the public interest.
Licensing requirement
The law requires a person to be licensed to engage in digital financial asset business activity (a “covered person”), unless exempt. Digital financial asset business activity subject to licensing includes “exchanging, transferring, or storing a digital financial asset or engaging in digital financial asset administration” and “holding electronic precious metals or electronic certificates representing interests in precious metals on behalf of another person or issuing shares or electronic certificates representing interests in precious metals.”
Perhaps most significantly, the DFAL defines digital financial asset business activity to include exchanging digital representations of value used within online games for a digital financial asset offered by the same game or app publisher, or for legal tender or bank or credit union credit outside the game. This provision seems to suggest that if in-game tokens/digital assets can be redeemed for a digital financial asset or cash, such activity may be within the scope of the DFAL licensing requirement. It is not clear, however, if it would apply to the exchange or “trading up” of digital representations of value within a game if the new token is within the scope of the exemption for digital representations of value used within online games and does not itself otherwise meet the definition of a digital financial asset.
Effective July 1, 2025, covered persons must be licensed or have submitted a licensing application. The application requirements are similar to those for a “traditional” money transmission license but are more extensive and more prescriptive. For example, in addition to standard requirements, like an anti-money laundering program and an information security program, applicants also are expressly required to have in place policies and procedures to address business continuity, disaster recovery, an anti-fraud program and a general compliance program.
Furthermore, the applicant’s business plan must not only describe the business activities of the applicant and its products and services, but also include information about its internet websites and social media pages. Applicants also must provide insurance coverage information, information about licenses held in other states and information about persons that have control over the applicant. The adjudication factors for the DFPI’s licensing determination also are similar to the money transmission law but include the unique factor of whether the “applicant has a reasonable promise of success in engaging in digital financial business activity.”
The DFAL separately provides that a person with a pending license application may be issued a conditional license if the applicant holds a license to conduct virtual currency business activity pursuant to the New York BitLicense regulations (23 NYCRR Part 200), provided that the New York license was issued or approved no later than January 1, 2023.
The DFAL also effectively prohibits a covered person from exchanging, transferring or storing a stablecoin unless the issuer of the stablecoin is licensed under the DFAL (or has an application pending), or is an exempt bank or a California or nationally chartered trust company. The commissioner of the DFPI also must approve any stablecoin before the covered person engages in exchanging, transferring or storing the stablecoin.
Licensee obligations
Under the DFAL, licensees are subject to annual and special reporting requirements and annual assessments, as well as requirements to maintain certain records for all digital financial asset business activity for five years – including a general ledger maintained at least monthly that lists all assets, liabilities, capital, income and expenses of the licensee. The DFAL imposes additional requirements on covered persons that operate an exchange or engage in activities involving stablecoin. With respect to a “covered exchange” – “a covered person that exchanges or holds itself out as being able to exchange a digital financial asset for a [California] resident” – the entity must certify that it has complied with specific requirements, including determining the likelihood of whether any digital financial asset available to be exchanged through the platform would be deemed a security by California or federal regulators. Penalties for listing or offering a digital financial asset without appropriate certification, or based on material misrepresentations in the certification process, include civil penalties of up to $20,000 per day.
Licensees also are subject to extensive disclosure requirements, largely based on the New York BitLicense regulations, including
- Pre-transaction disclosures of fees.
- Information regarding whether the product or service is covered by insurance or other protection against loss.
- Recognition that the transaction is irrevocable, along with any exceptions to irrevocability.
- Liability for unauthorized transactions.
- Disclosure of a California resident’s right to at least 14 days’ prior notice of a change in the licensee’s fee schedule, other terms and conditions that have a material impact on digital financial asset business activity, or the policies applicable to user accounts.
Finally, licensees are subject to examination and oversight by the DFPI and enforcement for noncompliance with the DFAL. The DFPI has extensive enforcement authority, including the authority to impose severe penalties for unlicensed activity. If a person that is not a licensee has engaged, is engaging or is about to engage in digital financial asset business activity with, or on behalf of, a resident in violation of the DFAL, the DFPI may assess a civil penalty of up to $100,000 per day. If a licensee or other covered person (e.g., a person that has been granted a conditional license) materially violates the DFAL, the DFPI still has the authority to assess a civil penalty of up to $20,000, which is much higher than the typical statutory penalty amounts enumerated in “traditional” state money transmission licensing laws.
California Digital Financial Asset Transaction Kiosks Law
The second piece of legislation signed by Newsom (SB 401) imposes requirements on operators of digital financial asset transaction kiosks that are not, as we read the legislation, otherwise licensed under the DFAL. The law is intended to apply to operators of so-called bitcoin ATMs that allow customers to purchase and sell cryptocurrency in exchange for cash.
The law prohibits an operator from accepting or dispensing more than $1,000 in a day from or to a customer via a digital financial asset transaction kiosk. The law also requires an operator, beginning on January 1, 2025, to provide written disclosure containing the terms and conditions of the transaction, including the amount of the digital financial asset involved. These disclosures, which must be made prior to when the digital financial asset transaction takes place, also must include information about whether the operator provides a method to reverse or refund a transaction (and, if not, a warning that transactions are final and cannot be undone), as well as the amount of the digital financial asset involved in the transaction, the amount in US dollars of fees, charges, etc., the price in US dollars charged by the operator to the customer for the digital financial asset, and the US dollar price of that same asset “as listed by a licensed digital financial asset exchange.”
Further, total charges and fees cannot exceed the greater of $5.00 or 15% of the US dollar equivalent of the digital financial assets involved in the transaction based on the market price of that same asset quoted by a licensed digital financial asset exchange.
Transaction receipts must include customer name, transaction information, the spread between the dollar price of the digital financial asset that is charged to the customer and the dollar price of the digital financial asset as listed by a licensed digital financial asset exchange, and the name of the licensed digital financial asset exchange used by the operator to calculate that spread. Operators also are required to disclose the locations of their kiosks to the DFPI (to be posted on the agency’s website) and must provide an update to the agency within 30 days of changing or adding kiosk locations.
Implications for the industry
California, one of the most significant holdouts in the context of regulating virtual currency activities under state money transmission laws (or similarly constructed virtual currency-specific licensing laws), will soon have in place what seems to be the most stringent virtual currency licensing laws of any state. Companies engaging in virtual currency activities in California will need to begin evaluating whether their activities in the state are within the scope of the DFAL and SB 401 – and, if so, begin preparations to apply for any required license and otherwise come into compliance with the extensive requirements of the laws.
The industry also can anticipate some degree of complexity in evaluating how to operate in California going forward, because, for example, entities subject to the DFAL can likely only engage in stablecoin activities if the stablecoin issuers themselves also pursue a DFAL license in California. While the laws do not take full effect until 2025, the industry will likely benefit from the relatively long lead time afforded by the legislation to develop compliance approaches for this unprecedented regulatory regime.
Notes
- The chair of the SEC has indicated that it is his view that virtually all tokens (or digital financial assets) are securities. The SEC recently settled two cases involving non-fungible assets that the SEC determined were securities. If the SEC’s interpretation prevails, virtually all digital financial assets would need to be registered under the Securities Exchange Act of 1934.
