For digital asset firms, the next DFAL challenge is not writing more policies. It is proving that the controls behind those policies work when the business is under stress.
Missed Part 1? Read “DFAL: Licensing Readiness Starts Before the Application” for practical guidance on building the governance, compliance, and operational foundations needed before entering the DFAL licensing process.
California’s Digital Financial Assets Law (DFAL) requires digital asset businesses serving California residents to maintain core programs for information security, operational security, business continuity, disaster recovery, antifraud, anti-money laundering (AML), and related risk controls. DFPI’s review of information security is aligned to NIST CSF 2.0, which places governance, identification, protection, detection, response, and recovery into one risk-management model. That structure sends an important message to the market: Regulators are not looking for a binder. They are looking for a business that can prevent, detect, respond to, and recover from disruption.
This is especially important in digital assets. A cyber incident can become a customer harm event in minutes. A key compromise, wallet drain, smart contract exploit, vendor outage, liquidity disruption, or failed customer disclosure can affect trust, revenue, regulatory standing, and enterprise value at the same time. The firms that win confidence will be those that can show their programs are tested, risk-based, and managed by leaders who understand the business impact.
Ankura’s point of view is that DFAL creates a practical test of executive discipline. The question is not whether the firm has an incident response plan, disaster recovery plan, or risk assessment. The question is whether those tools are specific to the firm’s products, customers, custody model, vendors, technology stack, and threat profile. A plan that could belong to any company is not a defensible plan.
4 Capabilities That Deserve Executive Attention
Incident response must match digital asset realities. Leaders should know who can declare an incident, pause withdrawals, move assets to cold storage, contact law enforcement, notify regulators, and communicate with customers. The plan should address key compromise, unauthorized transfers, wallet drains, vendor breaches, insider misuse, and on-chain tracing. It should also identify backups for every critical role.
Disaster recovery must restore the business without weakening controls. Recovery time and recovery point objectives should be tied to customer commitments and critical operations. Backup restoration must be tested. Key material recovery must preserve quorum, segregation of duties, and security controls. Vendor failover should be documented and exercised.
Testing must produce evidence, not comfort. Penetration tests, vulnerability scans, control validation, tabletop exercises, and functional recovery tests each answer different questions. Executives should require clear findings, owners, deadlines, remediation proof, and reporting that shows whether risk is moving up or down.
Risk adjustment must be a management cycle. A DFAL security program should change when the business changes. New products, new chains, new custody arrangements, new vendors, acquisitions, incidents, and threat shifts should trigger reassessment. The output should be visible in budget, controls, testing, staffing, and board reporting.
Actionable Takeaways
First, ask for a one-page control evidence map that links each DFAL policy to owners, tests, findings, remediation, and management reporting. Second, run a tabletop exercise against the incident most likely to harm customers or impair operations. Third, test recovery of the systems and signing capabilities that matter most. Fourth, update the risk assessment after the exercise and require leadership to approve the resulting priorities.
The Ankura Advantage
Ankura brings together the disciplines that digital asset firms need when compliance, cyber, financial crime, and operational resilience converge. Our professionals have worked with regulated financial institutions, fintechs, digital asset businesses, and companies facing incidents, investigations, remediation, and regulatory scrutiny. We translate requirements into operating decisions and evidence that executives, boards, regulators, partners, and investors can understand.
What differentiates our approach is the combination of practical regulatory judgment and real-world incident experience. We do not just draft a plan. We test whether it works. We do not just identify gaps. We help management prioritize them based on customer impact, regulatory exposure, operational dependency, and business strategy. That is why clients turn to Ankura when the challenge is complex, cross-functional, and time-sensitive.
Call to Action
DFAL readiness is the right moment to move from documented to defensible. If your leadership team wants confidence that its cyber, recovery, and governance programs will stand up to scrutiny, contact Eric Gagnon and Ankura’s digital assets team. We can help you test the program, close the highest-risk gaps, and build a practical roadmap for licensing, supervision, and growth.
Selected Sources
California Department of Financial Protection and Innovation, Digital Financial Assets Law application guidance and regulations materials; NIST Cybersecurity Framework 2.0; California DFAL statutory and rulemaking updates.
© Copyright 2026. The views expressed herein are those of the author(s) and not necessarily the views of Ankura Consulting Group, LLC, its management, its subsidiaries, its affiliates, or its other professionals. Ankura is not a law firm and cannot provide legal advice.
