On October 13, 2023, California Gov. Gavin Newsom signed two
bills into law that will impose sweeping obligations on companies
engaged in virtual currency activities in California and with
California residents. Newsom vetoed similar legislation last year
due to concerns that it lacked the flexibility necessary to adapt
to the rapidly evolving cryptocurrency landscape. Given that
California was an outlier among the largest US states in leaving
virtual currency activities to a great extent unregulated under the
money transmission regulatory framework, the enactment of these new
laws carries profound implications for the cryptocurrency
industry.
The first bill (AB 39) – the California Digital
Financial Assets Law (DFAL) – is a new virtual currency
licensing regime with similarities to New York’s virtual
currency regulations, which require entities conducting virtual
currency business activity in New York to obtain a
“BitLicense” (or a charter under the New York Banking
Law). The second bill (SB 401) is tied to the DFAL and specifically
regulates “digital financial asset transaction kiosks,”
which are generally defined as devices that are “capable of
accepting or dispensing cash in exchange for a digital financial
asset.”
The California Digital Financial Assets Law (DFAL)
Overview
The DFAL prohibits a person from engaging in digital financial
asset business activity – or holding itself out as being able
to engage in digital financial asset business activity –
without meeting certain criteria and obtaining a license from the
California Department of Financial Protection and Innovation
(DFPI).
Similar to other states’ definitions of regulated virtual
currency activity (although using a different term), the law
defines “digital financial asset” to mean “a digital
representation of value that is used as a medium of exchange, unit
of account, or store of value, and that is not legal tender,
whether or not denominated as legal tender.” The definition of
a digital financial asset excludes rewards points and value issued
and usable only within an online game platform, provided certain
criteria are met. Securities registered with or exempt from
registration with the Securities and Exchange Commission
(SEC)1 or the DFPI also are excluded from this
definition.
A number of persons are exempt from the DFAL, including, but not
limited to:
- Banks.
- Certain trust companies.
- Persons that provide processing, clearing or settlement
services solely for transactions between or among persons that are
exempt from the licensing requirements. - Persons using a digital financial asset, or obtaining a digital
financial asset as payment, solely for personal, family or
household purposes, or academic purposes. - A merchant that accepts a digital financial asset as payment
for the purchase or sale of goods or services, which does not
include digital financial assets. - Persons whose digital financial asset business activity with,
or on behalf of, California residents is reasonably expected to be
valued, in the aggregate, on an annual basis at $50,000 or
less. - Persons that contribute only connectivity software or computing
power to securing a network that records digital financial asset
transactions or to a protocol governing transfer of the digital
representation of value.
Distinct from the enumerated exemptions, the DFAL also
authorizes the DFPI commissioner to further exempt any class of
persons or transactions, if the commissioner finds the exemption to
be in the public interest.
Licensing requirement
The law requires a person to be licensed to engage in digital
financial asset business activity (a “covered person”),
unless exempt. Digital financial asset business activity subject to
licensing includes “exchanging, transferring, or storing a
digital financial asset or engaging in digital financial asset
administration” and “holding electronic precious metals
or electronic certificates representing interests in precious
metals on behalf of another person or issuing shares or electronic
certificates representing interests in precious metals.”
Perhaps most significantly, the DFAL defines digital financial
asset business activity to include exchanging digital
representations of value used within online games for a digital
financial asset offered by the same game or app publisher, or for
legal tender or bank or credit union credit outside the game. This
provision seems to suggest that if in-game tokens/digital assets
can be redeemed for a digital financial asset or cash, such
activity may be within the scope of the DFAL licensing requirement.
It is not clear, however, if it would apply to the exchange or
“trading up” of digital representations of value within a
game if the new token is within the scope of the exemption for
digital representations of value used within online games and does
not itself otherwise meet the definition of a digital financial
asset.
Effective July 1, 2025, covered persons must be licensed or have
submitted a licensing application. The application requirements are
similar to those for a “traditional” money transmission
license but are more extensive and more prescriptive. For example,
in addition to standard requirements, like an anti-money laundering
program and an information security program, applicants also are
expressly required to have in place policies and procedures to
address business continuity, disaster recovery, an anti-fraud
program and a general compliance program.
Furthermore, the applicant’s business plan must not only
describe the business activities of the applicant and its products
and services, but also include information about its internet
websites and social media pages. Applicants also must provide
insurance coverage information, information about licenses held in
other states and information about persons that have control over
the applicant. The adjudication factors for the DFPI’s
licensing determination also are similar to the money transmission
law but include the unique factor of whether the “applicant
has a reasonable promise of success in engaging in digital
financial business activity.”
The DFAL separately provides that a person with a pending
license application may be issued a conditional
license if the applicant holds a license to conduct
virtual currency business activity pursuant to the New York
BitLicense regulations (23 NYCRR Part 200), provided that the New York
license was issued or approved no later than January 1, 2023.
The DFAL also effectively prohibits a covered person from
exchanging, transferring or storing a stablecoin unless the issuer
of the stablecoin is licensed under the DFAL (or has an application
pending), or is an exempt bank or a California or nationally
chartered trust company. The commissioner of the DFPI also must
approve any stablecoin before the covered person engages in
exchanging, transferring or storing the stablecoin.
Licensee obligations
Under the DFAL, licensees are subject to annual and special
reporting requirements and annual assessments, as well as
requirements to maintain certain records for all digital financial
asset business activity for five years – including a general
ledger maintained at least monthly that lists all assets,
liabilities, capital, income and expenses of the licensee. The DFAL
imposes additional requirements on covered persons that operate an
exchange or engage in activities involving stablecoin. With respect
to a “covered exchange” – “a covered person
that exchanges or holds itself out as being able to exchange a
digital financial asset for a [California] resident” –
the entity must certify that it has complied with specific
requirements, including determining the likelihood of whether any
digital financial asset available to be exchanged through the
platform would be deemed a security by California or federal
regulators. Penalties for listing or offering a digital financial
asset without appropriate certification, or based on material
misrepresentations in the certification process, include civil
penalties of up to $20,000 per day.
Licensees also are subject to extensive disclosure requirements,
largely based on the New York BitLicense regulations, including
- Pre-transaction disclosures of fees.
- Information regarding whether the product or service is covered
by insurance or other protection against loss. - Recognition that the transaction is irrevocable, along with any
exceptions to irrevocability. - Liability for unauthorized transactions.
- Disclosure of a California resident’s right to at least 14
days’ prior notice of a change in the licensee’s fee
schedule, other terms and conditions that have a material impact on
digital financial asset business activity, or the policies
applicable to user accounts.
Finally, licensees are subject to examination and oversight by
the DFPI and enforcement for noncompliance with the DFAL. The DFPI
has extensive enforcement authority, including the authority to
impose severe penalties for unlicensed activity. If a person that
is not a licensee has engaged, is engaging or is
about to engage in digital financial asset business activity with,
or on behalf of, a resident in violation of the DFAL, the DFPI may
assess a civil penalty of up to $100,000 per day.
If a licensee or other covered person (e.g., a person that has been
granted a conditional license) materially violates the DFAL, the
DFPI still has the authority to assess a civil penalty of up to
$20,000, which is much higher than the typical statutory penalty
amounts enumerated in “traditional” state money
transmission licensing laws.
California Digital Financial Asset Transaction Kiosks Law
The second piece of legislation signed by Newsom (SB 401)
imposes requirements on operators of digital financial asset
transaction kiosks that are not, as we read the legislation,
otherwise licensed under the DFAL. The law is intended to apply to
operators of so-called bitcoin ATMs that allow customers to
purchase and sell cryptocurrency in exchange for cash.
The law prohibits an operator from accepting or dispensing more
than $1,000 in a day from or to a customer via a digital financial
asset transaction kiosk. The law also requires an operator,
beginning on January 1, 2025, to provide written disclosure
containing the terms and conditions of the transaction, including
the amount of the digital financial asset involved. These
disclosures, which must be made prior to when the digital financial
asset transaction takes place, also must include information about
whether the operator provides a method to reverse or refund a
transaction (and, if not, a warning that transactions are final and
cannot be undone), as well as the amount of the digital financial
asset involved in the transaction, the amount in US dollars of
fees, charges, etc., the price in US dollars charged by the
operator to the customer for the digital financial asset,
and the US dollar price of that same asset
“as listed by a licensed digital financial asset
exchange.”
Further, total charges and fees cannot exceed the greater of
$5.00 or 15% of the US dollar equivalent of the digital financial
assets involved in the transaction based on the market price of
that same asset quoted by a licensed digital financial asset
exchange.
Transaction receipts must include customer name, transaction
information, the spread between the dollar price of the digital
financial asset that is charged to the customer and the dollar
price of the digital financial asset as listed by a licensed
digital financial asset exchange, and the name of the licensed
digital financial asset exchange used by the operator to calculate
that spread. Operators also are required to disclose the locations
of their kiosks to the DFPI (to be posted on the agency’s
website) and must provide an update to the agency within 30 days of
changing or adding kiosk locations.
Implications for the industry
California, one of the most significant holdouts in the context
of regulating virtual currency activities under state money
transmission laws (or similarly constructed virtual
currency-specific licensing laws), will soon have in place what
seems to be the most stringent virtual currency licensing laws of
any state. Companies engaging in virtual currency activities in
California will need to begin evaluating whether their activities
in the state are within the scope of the DFAL and SB 401 –
and, if so, begin preparations to apply for any required license
and otherwise come into compliance with the extensive requirements
of the laws.
The industry also can anticipate some degree of complexity in
evaluating how to operate in California going forward, because, for
example, entities subject to the DFAL can likely only engage in
stablecoin activities if the stablecoin issuers themselves also
pursue a DFAL license in California. While the laws do not take
full effect until 2025, the industry will likely benefit from the
relatively long lead time afforded by the legislation to develop
compliance approaches for this unprecedented regulatory regime.
Footnotes
1. The chair of the SEC has indicated that it is his view
that virtually all tokens (or digital financial assets) are
securities. The SEC recently settled two cases involving
non-fungible assets that the SEC determined were securities. If the
SEC’s interpretation prevails, virtually all digital financial
assets would need to be registered under the Securities Exchange
Act of 1934.
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.
