California enacted a licensing framework for crypto businesses

California Governor Gavin Newsom signed Assembly Bill 39 on October 13, 2023, establishing the Digital Financial Assets Law and committing the state to a licensing and supervision regime for many businesses serving California residents. The chaptered measure was approved and filed with the secretary of state on October 13, with its principal licensing requirement scheduled for July 1, 2025.

The development mattered because it converted a debated policy model into state law. It did not immediately license any exchange, certify any token or settle whether a particular cryptoasset was a security. Instead, it gave the California Department of Financial Protection and Innovation, or DFPI, a mandate to build rules, review applicants, examine licensees and enforce the new framework.

From legislation to a licensing perimeter

AB 39 covered exchanging, transferring or storing digital financial assets for California residents, as well as administering an asset with redemption authority. Its definition reached businesses located outside California when they acted for a state resident. The law also drew boundaries: governments, specified banks and credit unions, qualifying trust companies, certain registered securities and commodities firms, people acting solely for themselves, merchants accepting crypto for ordinary goods or services, and businesses expecting no more than $50,000 in annual covered activity were among the exemptions.

Beginning July 1, 2025, a nonexempt operator would need a DFPI license, a pending application submitted by that date, or another statutory basis to continue covered activity. Applicants had to provide ownership, management, financial, regulatory and criminal-history information. The department could approve, conditionally approve or deny an application.

That was a compliance architecture, not a judgment that every covered company was safe. The statute left important settings—including the amount of required security, capital and liquidity—to DFPI based on each licensee’s risks.

Consumer protection moved into operating rules

The law required a licensee to maintain a dollar-denominated surety bond or trust account in a form and amount set by DFPI. It also required risk-based capital and liquidity, five years of transaction and financial records, and policies covering information security, business continuity, disaster recovery, fraud, money laundering and terrorist financing.

Before doing business with a resident, a covered company would have to provide clear disclosures about fees and their timing, applicable insurance or guarantees, and other material terms. DFPI received powers that included examinations, license suspension or revocation, cease-and-desist orders, restitution requests and civil penalties. Those tools made the law more than a registration list: they placed ongoing conduct and financial-resilience obligations around intermediaries.

Stablecoins received a separate gate. Under the October 13 text, a covered business generally could handle a stablecoin when the issuer was an applicant, licensee or specified regulated institution and held eligible securities at least equal to outstanding issuance, or when DFPI separately approved the stablecoin subject to conditions. The statute therefore assigned the state regulator a direct role in which stablecoins covered firms could support.

The rulebook was not finished

Newsom’s signing message endorsed stronger consumer and investor protection but also acknowledged ambiguity in the bill’s terms and scope. He said further refinement would be needed through regulation and statute. The implementation runway was designed to let DFPI tailor the system before the July 1, 2025 licensing date.

AB 39 was also written to become operative only if Senate Bill 401 took effect by January 1, 2024. Newsom signed SB 401 on October 13, 2023 as well, adding a companion framework for digital-financial-asset transaction kiosks.

The defensible event-day conclusion is institutional rather than market-based: California created a broad legal perimeter for crypto intermediaries while leaving substantial implementation work ahead. The available official records do not establish that the signing caused a measurable move in bitcoin, ether, stablecoin supply, trading volume or company activity on October 13, 2023, so no such causal claim is made.