Key Takeaways
- California's Digital Financial Assets Law (DFAL) takes effect July 1, 2026, requiring any business that holds or transfers customer crypto to be licensed by the DFPI.
- If your exchange or custodial app hasn't filed for a license, it may stop serving California residents on or after July 1.
- Self-custody wallets (hardware wallets, MetaMask, etc.) are completely exempt — the law only applies to businesses that hold customer funds.
- Crypto ATMs in California now face a $1,000-per-day transaction cap and a fee ceiling of 15% — still steep, but better than the 20–25% some kiosks charged before.
The Last Time a State Did This, Exchanges Left Overnight
In 2015, New York introduced the BitLicense — the first major state-level crypto licensing requirement in the country. What happened next was a scramble. Kraken and Bitfinex announced they were exiting New York entirely rather than navigate the new rules. Users woke up to notices that their accounts would be suspended. Some scrambled to move funds off platforms in a matter of days.
California is about to test whether history repeats.
On July 1, 2026 — 23 days from now — the state's Digital Financial Assets Law officially takes effect. Any business that exchanges, transfers, stores, or issues digital assets for California residents must be licensed by the California Department of Financial Protection and Innovation (DFPI), or stop operating in the state. California has 40 million residents and is the fifth-largest economy in the world. The stakes are considerably higher than New York in 2015.
What Is the DFAL, Exactly?
California passed DFAL in October 2023 (Assembly Bill 39 plus Senate Bill 401). After one extension that pushed the deadline from July 2025 to July 2026, the DFPI opened its licensing portal in March 2026 — giving companies roughly four months to apply before enforcement begins.
The law creates a licensing framework for covered businesses. To legally serve California residents, they must:
- Maintain at least $100,000 in tangible net worth and post a $500,000 surety bond — real financial backing, not just promises
- Provide at least 10 hours of live telephone customer support on business days, a standard almost unheard of in the crypto industry
- Follow strict reserve rules if they issue stablecoins: full 1:1 backing in eligible securities at all times
Covered entities include centralized exchanges, custodial wallet providers, stablecoin issuers, and crypto broker-dealers. Small operators earning under $50,000 annually from covered activities may qualify for an exemption.
What About Stablecoins?
California's stablecoin rules go further than the federal baseline. The GENIUS Act — the first federal stablecoin law, passed in 2025 — requires 1:1 reserves and monthly third-party audits. California's DFAL adds an extra layer: stablecoin issuers serving California residents must be licensed by the DFPI or operate as a federally regulated bank or trust. Full reserves must be maintained continuously, not just at audit time.
This matters if you hold stablecoins on a platform that isn't pursuing a California license. That platform may restrict or suspend California residents' ability to hold or redeem stablecoins after July 1.
The ATM Rule: A Floor, Not a Benchmark
If you've ever used a Bitcoin kiosk, you know the fees can be brutal. DFAL addresses this directly. California crypto ATMs now face a $1,000-per-day transaction limit per customer, and fees are capped at the greater of $5 or 15% of the transaction value.
That's a real improvement — some kiosks were previously charging 20–25% or more. But 15% is still enormous compared to what you'd pay on an exchange. A $200 Bitcoin purchase at a California ATM could still legally cost you $30 in fees. The cap is a consumer protection floor. For anyone who can access an online exchange with 1–2% trading fees, ATMs remain an expensive last resort.
The One Group That Is Completely Exempt
Here is the most important thing the law doesn't do: it doesn't touch self-custody wallets.
The DFAL explicitly exempts non-custodial wallets — software like MetaMask, and hardware devices where you hold your own private keys. The law applies only to businesses that hold customer funds. If you control your own keys, no license is required — not for you, and not for the wallet manufacturer.
This draws a clear line that's worth understanding. As covered in our guide to how crypto wallets work, the custodial distinction comes down to one question: who holds the private keys? If an exchange or app holds them — that's custodial, covered by DFAL. If you hold them yourself — that's non-custodial, exempt. A California resident who self-custodies Bitcoin on a hardware wallet is completely unaffected by July 1, regardless of what any exchange decides to do.
What Should You Do Before July 1?
Three steps are worth taking now.
Check whether your platform has filed for a DFAL license. The DFPI publishes a public list of applicants and approved licensees. If your exchange isn't on it, that's a signal to start moving funds to a platform that is. Don't wait for an email from the platform — the FTX playbook shows that user notices sometimes come after the situation has already deteriorated.
Know how to withdraw your crypto before you need to. Understand the process for moving funds off your exchange. Practice it with a small amount. Slow, deliberate action beats a panic withdrawal under pressure.
Consider whether self-custody makes sense for your situation. California's DFAL makes one of the clearest regulatory arguments for self-custody we've seen: if you hold your own keys, no exchange's licensing status can block your access to your own assets. For long-term holdings, a dedicated device like a Ledger hardware wallet stores your private keys completely offline — entirely outside the reach of any platform's compliance decisions.
None of this is a reason to panic. Large, established US exchanges have legal teams and compliance infrastructure; they are almost certainly licensed or on track to be. The risk is concentrated in smaller or overseas platforms that may find the requirements too burdensome to meet.
The Bottom Line
California's DFAL is substantive consumer protection legislation. It requires covered businesses to have real capital behind them, answer the phone, and back stablecoins dollar-for-dollar. Those are meaningful safeguards for anyone keeping funds on a licensed platform.
The flip side: some platforms may exit California, as exchanges exited New York in 2015. That pattern is already playing out with other state-level licensing regimes — similar dynamics are reshaping which DeFi lending platforms California residents can access. If you're on a smaller or less-established platform, the next few weeks are a reasonable time to check its status and know your options. And if you've been curious about self-custody, the regulatory landscape just handed you one more concrete reason to learn.