A PYMNTS Company

States Step Up to Regulate Digital Asset ‘Business Activity’ Within Their Borders

By  |  December 2, 2025

As Congress and federal financial regulators work to expand the legal playing field for crypto trading and transactions, states are stepping in regulate businesses that engage in them. California, Louisiana and Illinois are the latest state governments to implement licensing requirements modeled on New York’s decade-old BitLicense regime for firms that deal in or otherwise handle digital assets.

    Get the Full Story

    Complete the form to unlock this article and enjoy unlimited free access to all PYMNTS content — no additional logins required.

    yesSubscribe to our daily newsletter, PYMNTS Today.

    By completing this form, you agree to receive marketing communications from PYMNTS and to the sharing of your information with our sponsor, if applicable, in accordance with our Privacy Policy and Terms and Conditions.

    According to a blog post by attorneys with Katten, companies that offer digital asset services in those states should carefully evaluate whether their activities could trigger new compliance obligations and establish compliance procedures ahead of statutory deadlines.

    Illinois’ Digital Asset Consumer Protection Act (DACPA), passed in August, establishes regulatory authority over “digital asset business activity” involving Illinois residents. The statute’s broad language covers activities including exchanging, transferring, or storing digital assets, as well as digital asset administration.

    Before offering a digital asset, exchanges must identify the risk that the digital asset would be deemed a security by federal or state regulators; provide written disclosure relating to conflicts of interest; and conduct a comprehensive risk assessment designed to ensure consumers are adequately protected. Customer disclosure and protections must be implemented by January 1, 2027 while the full licensing regime takes effect July 1, 2027.

    Notably, the Illinois law does not apply to activities regulated by the Securities and Exchange Commission (SEC) or the Commodity Futures Trading Commission (CFTC), or to merchant transactions and personal use.

    Related: Crypto, DeFi Companies Urge White House to Clarify Tax and Trading Rules for Digital Assets

    California’s Digital Financial Assets Law (DFAL), adopted in October 2023, requires any person engaging in “digital financial asset business activity” with a California resident to obtain a license from the California Department of Financial Protection and Innovation (DFPI), starting July 1, 2026. Banks, certain broker dealers, government entities, and merchants are exempt from the licensing requirement.

    In April 2025, DFPI proposed rules under the statute detailing the laws application to surety bond requirements, disclosures, change notifications, and kiosk location oversight. A subsequent rulemaking in September clarified that licensees would be exempt from California’s Money Transmission Act for activities incidental to their digital asset business.

    Louisiana’s Virtual Currency Business Act (VCBA), originally enacted in 2020, established a licensing requirement for business activity involving the exchange, transfer, storage, and administration of digital currencies. The regime was strengthened in 2023 to add new definitions of covered activities, authorize emergency rulemaking capabilities and expand the enforcement authority for the state Office of Financial Institutions (OFI). The 2023 amendments are scheduled to sunset on July 1, 2027 unless renewed by the legislature.

    Katten recommends that digital asset firms that operate in those states conduct comprehensive compliance assessments, and develop robust internal procedures to meet the new compliance obligations. In particular, the attorneys recommend firms should develop policies addressing cybersecurity, anti-money laundering, customer asset segregation, and financial reporting for each of the states.

    Katten also notes that potential federal legislation could preempt or modify the state regulatory regimes and should be monitored closely by digital asset firms.