California Crypto Regulations: Complete 2026 Guide

California operates the second comprehensive state licensing regime for digital asset businesses in the United States. The Digital Financial Assets Law (DFAL), enacted as AB 39 (2023) and codified at Cal. Fin. Code § 3101 et seq., took effect for licensing purposes on July 1, 2026. Any firm serving California residents that has not yet resolved its licensing posture is now operating in a live enforcement window.

Does This Apply to You?

DFAL reaches you if you engage in digital financial asset business activity with or on behalf of a California resident. That includes exchanging, transferring, or storing digital assets; holding electronic precious metals or certificates; and exchanging digital representations of value within online games for legal tender outside the game platform. Critically, the statute follows the resident, not the company’s domicile — a Miami or Austin exchange with California customers is squarely in scope.

You are likely outside DFAL if you are a depository institution, a merchant accepting crypto solely as payment for goods and services, a software developer or node operator who does not take custody, a miner, or an individual transacting for personal purposes. The exemption list at Fin. Code § 3103 also contains a de minimis threshold and carve-outs for certain federally regulated securities and commodities intermediaries. Confirm your specific exemption against the current statutory text — this list is summarized, not exhaustive.

1. Overview: California’s Regulatory Landscape

General approach: strict, but less rigid than New York. California spent years as a notably permissive jurisdiction — the Department of Financial Protection and Innovation (DFPI) historically declined to require money transmitter licensure for pure crypto-to-crypto activity. DFAL ended that posture. The state now sits in the same tier as New York on licensing burden, though DFAL grants the Commissioner more discretion to calibrate capital and bonding to a licensee’s actual risk profile rather than imposing fixed statutory floors.

Key agencies:

• DFPI (Department of Financial Protection and Innovation) — the primary regulator. Administers DFAL, the Money Transmission Act (Fin. Code § 2000 et seq.), and the California Consumer Financial Protection Law (CCFPL, Fin. Code § 90000 et seq.).
• DFPI Securities Regulation Division — administers the Corporate Securities Law of 1968 (Cal. Corp. Code § 25000 et seq.).
• California Attorney General — parallel consumer protection authority under Bus. & Prof. Code § 17200 (Unfair Competition Law).
• Franchise Tax Board (FTB) — income tax. CDTFA — sales and use tax.

Two adjacent statutes matter. SB 401 (2023), Fin. Code § 3901 et seq., regulates digital financial asset transaction kiosks: a $1,000 per-day, per-customer cap effective January 1, 2024, and a fee cap of the greater of $5 or 15% effective January 1, 2025. AB 1934 (2024) delayed DFAL’s original July 1, 2025 licensing date by one year and authorized the Commissioner to issue conditional licenses — a meaningful accommodation for firms already holding a New York BitLicense.

2. Licensing: DFAL and the Money Transmission Act

The two-track problem

DFAL is now the operative regime for digital asset business activity. But the Money Transmission Act has not disappeared. If your product moves fiat — on-ramps, off-ramps, holding customer dollar balances, ACH settlement — you should assume you need a California money transmitter license in addition to DFAL registration. Firms that assumed DFAL displaced the MTA entirely have a mapping exercise to do.

DFAL requirements

Applications run through NMLS. Expect to produce audited financials, a detailed business plan, policies for AML/BSA, cybersecurity, and business continuity, and fingerprinting and background checks for control persons and 25%+ owners. Ongoing obligations include:

• Capital and surety bond — set by the Commissioner based on the licensee’s risk profile, volume, and asset types, rather than fixed in statute. Budget conservatively.
• Custody — a licensee must hold digital assets in the amount and type owed to each customer, and may not sell, transfer, pledge, or lend customer assets without express consent (Fin. Code § 3601 et seq.).
• Stablecoin restrictions — a licensee may not facilitate a stablecoin unless the issuer is a bank or DFPI-approved, with reserves at least equal to the outstanding amount in high-quality liquid assets. This provision alone dictates which assets many exchanges can list to California users.
• Disclosures and receipts — pre-transaction risk disclosures and transaction receipts with specified content.
• Records and reporting — five-year retention, annual reports, and DFPI examination authority.

Fees and timeline

DFAL provides for a nonrefundable application fee (reported at $5,000) plus investigation costs; the MTA carries a $5,000 application fee, a net worth requirement generally in the $250,000–$500,000 range, and a surety bond scaling from $250,000 to $7 million with transmission volume. Verify all figures against DFPI’s current published fee schedule — these change. Realistic timeline for a complete DFAL application is six to twelve months; MTL applications have historically run twelve to eighteen. Start earlier than feels necessary.

3. Securities Regulation

California’s blue sky statute is the Corporate Securities Law of 1968. Section 25110 makes it unlawful to offer or sell a security in California unless the offering is qualified or exempt. Section 25401 is the state antifraud provision.

The most important point for token issuers: California does not stop at Howey. Under Silver Hills Country Club v. Sobieski, 55 Cal. 2d 811 (1961), California applies a risk capital test that can find a security where the federal test would not — it asks whether the purchaser’s funds are placed at the risk of the enterprise, without requiring an expectation of profits derived from the efforts of others. A utility or access token that survives a federal Howey analysis can still be a security under California law. Later cases including Reiswig v. Department of Corporations, 144 Cal. App. 4th 327 (2006), confirm the test remains good law.

The workhorse exemption is the limited offering exemption at Corp. Code § 25102(f), implemented at 10 Cal. Code Regs. § 260.102.14. Federally covered securities under Reg D Rule 506 preempt state qualification but still require a notice filing and fee. There is no California analogue to Wyoming’s or Colorado’s token-specific exemption; California has not enacted a digital token exemption.

4. Banking and Custody

California offers no special-purpose charter comparable to Wyoming’s SPDI or a Nebraska-style digital asset depository. Your realistic options are a DFPI-licensed California trust company (Fin. Code § 1500 et seq.), a national trust bank charter from the OCC, or partnership with an out-of-state qualified custodian. Firms seeking a genuine state-chartered crypto bank continue to look to Wyoming.

Within DFAL, the custody rules do substantial work: segregation of customer assets, a prohibition on rehypothecation absent consent, and reserve adequacy that DFPI can test on examination. Investment advisers should separately confirm the federal custody rule and any state adviser custody requirements — DFAL compliance does not satisfy them.

5. Tax Treatment

• Income tax: California conforms to the federal treatment of virtual currency as property. Dispositions produce gain or loss. California provides no preferential capital gains rate — gains are taxed as ordinary income at marginal rates up to 12.3%, plus the 1% Mental Health Services Tax on taxable income above $1 million, for an effective top rate of 13.3%. This is the single largest planning consideration for California crypto holders.
• Entity tax: 8.84% corporate franchise tax; LLCs owe the annual minimum franchise tax plus a gross receipts–based fee.
• Sales and use tax: Per CDTFA guidance (Special Notice L-382), purchasing cryptocurrency is not itself a taxable sale — crypto is not tangible personal property. When crypto is used to buy taxable goods, tax is measured by the U.S. dollar value of the property at the time of sale.
• Mining: No mining-specific tax regime and no mining exemption. Hardware purchases and, in some configurations, electricity are subject to sales and use tax. Larger operations should analyze whether the partial manufacturing and R&D exemption (Rev. & Tax. Code § 6377.1) reaches any equipment purchases — this is fact-specific and worth a dedicated opinion.
• Staking and airdrops: California follows federal characterization; ordinary income on receipt, taxed at full marginal rates.

6. Enforcement Trends

DFPI’s enforcement output has been dominated by fraud rather than technical licensing violations. The department has issued a steady stream of desist and refrain orders against purported high-yield digital asset investment platforms, and maintains a public Crypto Scam Tracker (launched February 2023) cataloging complaint-sourced schemes — a useful early signal of what the department is looking at.

Three enforcement themes to plan around:

1. Yield and interest-bearing accounts. California participated in the multistate actions against crypto lending and interest-account programs during 2021–2023. Any product paying a return on deposited assets should assume securities scrutiny under the risk capital test.
2. Relationship-investment fraud. “Pig butchering” schemes drive a large share of DFPI orders and AG consumer alerts, and increasingly draw kiosk operators and on-ramps into the department’s field of view as facilitators.
3. UDAAP under the CCFPL. Fin. Code § 90000 et seq. gives DFPI broad unfair, deceptive, and abusive practices authority over consumer financial products — a hook that does not require a licensing violation. Marketing copy, fee disclosure, and outage handling are all exposure surfaces.

Expect DFAL’s first licensing-specific actions to emerge over the coming year as the department works through applications and identifies unregistered operators. Verify the current status of any individual matter before relying on it.

7. Compliance Checklist

• ☐ Determine whether your activity is digital financial asset business activity under Fin. Code § 3102 and whether any § 3103 exemption applies. Document the analysis.
• ☐ Separately assess fiat money transmission — a DFAL license does not cover it.
• ☐ If you hold a New York BitLicense, evaluate the conditional license pathway under AB 1934.
• ☐ Confirm current application fees, capital, and surety bond figures directly with DFPI.
• ☐ Run every listed stablecoin against DFAL’s issuer and reserve conditions; delist or geofence what fails.
• ☐ Audit custody: segregation, no rehypothecation without express consent, reserve adequacy.
• ☐ Implement DFAL disclosures, receipts, and five-year record retention.
• ☐ Screen tokens under the California risk capital test, not Howey alone; make § 25102(f) or notice filings as needed.
• ☐ If operating kiosks, confirm SB 401 daily caps and fee limits.
• ☐ Review consumer-facing marketing for CCFPL UDAAP exposure.
• ☐ Maintain FinCEN MSB registration and a BSA/AML program — federal obligations run in parallel.
• ☐ Model the 13.3% top state rate into any California-resident tax planning.

Bottom Line

California is no longer a permissive jurisdiction. DFAL is now live, the risk capital test makes state securities analysis broader than federal, and the 13.3% top income tax rate imposes a real cost on residents. Firms should treat California as a New York–tier compliance obligation while recognizing that DFAL’s discretionary capital standards leave more room to negotiate a proportionate outcome than the BitLicense does.

This content is for informational purposes only and does not constitute legal advice. Consult with a qualified US attorney for guidance specific to your situation.