Digital asset firms that treat California’s Digital Financial Assets Law (DFAL) as a paperwork project may get a filing in the door, but they may not be ready for the supervisory scrutiny that follows.
California’s DFAL changes the business calculus for exchanges, custodians, wallet providers, stablecoin participants, and other firms serving California residents. The Department of Financial Protection and Innovation (DFPI) has made clear that applicants must be able to demonstrate sound financial condition, responsible management, effective risk controls, and the ability to operate in compliance with the law. The application process also runs through NMLS and requires a complete submission by the applicable deadline for firms that want to continue serving California residents. Recent rulemaking activity and statutory amendments only raise the stakes because the market is moving while the regulatory framework is still being refined.
The business challenge is simple: Leadership teams need to keep revenue channels open while proving to regulators that their operating model is controlled, resilient, and customer protection. That is not achieved by assembling policies at the end of the process. DFAL readiness requires a connected view of licensing, cybersecurity, anti-money laundering (AML), fraud prevention, financial controls, customer disclosures, vendor oversight, and governance. The firms that move fastest will be those that can show how each document ties to a real control, a responsible owner, a tested process, and evidence that the control works.
At Ankura, our point of view is direct: DFAL is not just a California licensing event. It is a market access, operational resilience, and trust event. The license application is the front door. The more important question is whether the business can withstand examination, incident pressure, partner diligence, investor scrutiny, and customer expectations after that door opens.
What Leaders Should Do Now
Start With Applicability and Business Impact
Confirm which products, entities, customer flows, and third-party arrangements create DFAL exposure. Do not evaluate licensing in isolation. Map the impact on revenue, customer onboarding, custody, liquidity, operations, and product roadmap decisions.
Build an Evidence Inventory
Executives should ask one question about every policy: What proves this is implemented? A strong file includes board materials, risk assessments, test results, issue logs, vendor reviews, incident exercises, training records, and management reporting. Policies matter, but evidence carries the application.
Align Cybersecurity to NIST CSF 2.0
The DFPI’s review of information security is tied to the NIST Cybersecurity Framework 2.0, which organizes cyber risk management across Govern, Identify, Protect, Detect, Respond, and Recover. Leadership should translate those functions into board-level oversight, clear ownership, risk-based controls, incident readiness, and recovery capability.
Stress-Test the Operating Model Before Filing
A tabletop exercise can reveal unclear decision rights, stale escalation paths, weak vendor dependencies, and gaps between promised customer obligations and actual recovery capability. Finding those gaps before filing is a business advantage.
Assign Accountable Owners
DFAL readiness cannot sit solely with legal or compliance. Cybersecurity, operations, finance, product, customer support, fraud, AML, and executive management all own pieces of the answer. The best programs name owners, define decision rights, and track remediation like a business-critical initiative.
The Ankura Advantage
Ankura helps clients turn DFAL readiness from a document assembly exercise into a defensible operating program. Our teams combine regulatory compliance, financial crimes, cybersecurity, incident response, blockchain analytics, investigations, and risk governance. That matters because DFAL does not test one function at a time. It tests how the business actually works.
Clients trust Ankura because we understand both the filing and the failure scenario. We know what a regulator asks for, what evidence holds up, and where digital asset controls often break under pressure. Our approach is practical: assess the current state, prioritize the gaps that affect market access and supervisory risk, build the evidence file, test the controls, and help leadership make informed decisions.
Call to Action
Digital asset leaders should not wait for a deficiency letter to learn where the program is thin. If your firm serves California residents, now is the time to confirm applicability, test readiness, and build an examiner-ready evidence package. Contact Eric Gagnon and Ankura’s DFAL team to pressure-test your application strategy and strengthen the controls that protect your license, customers, and growth plan.
Sources
California Department of Financial Protection and Innovation, Digital Financial Assets Law application guidance and regulations materials; NIST Cybersecurity Framework 2.0; California DFAL statutory and rulemaking updates.
© Copyright 2026. The views expressed herein are those of the author(s) and not necessarily the views of Ankura Consulting Group, LLC, its management, its subsidiaries, its affiliates, or its other professionals. Ankura is not a law firm and cannot provide legal advice.
