States Step Up to Regulate Digital Asset ‘Business Activity’ Within Their Borders

According to a blog post by attorneys with Katten, companies that offer digital asset services in those states should carefully evaluate whether their activities could trigger new compliance obligations and establish compliance procedures ahead of statutory deadlines.

Illinois’ Digital Asset Consumer Protection Act (DACPA), passed in August, establishes regulatory authority over “digital asset business activity” involving Illinois residents. The statute’s broad language covers activities including exchanging, transferring, or storing digital assets, as well as digital asset administration.

Before offering a digital asset, exchanges must identify the risk that the digital asset would be deemed a security by federal or state regulators; provide written disclosure relating to conflicts of interest; and conduct a comprehensive risk assessment designed to ensure consumers are adequately protected. Customer disclosure and protections must be implemented by January 1, 2027 while the full licensing regime takes effect July 1, 2027.

We’d love to be your preferred source for news.

Please add us to your preferred sources list so our news, data and interviews show up in your feed. Thanks!

Add as Preferred Source

Notably, the Illinois law does not apply to activities regulated by the Securities and Exchange Commission (SEC) or the Commodity Futures Trading Commission (CFTC), or to merchant transactions and personal use.

Related: Crypto, DeFi Companies Urge White House to Clarify Tax and Trading Rules for Digital Assets

California’s Digital Financial Assets Law (DFAL), adopted in October 2023, requires any person engaging in “digital financial asset business activity” with a California resident to obtain a license from the California Department of Financial Protection and Innovation (DFPI), starting July 1, 2026. Banks, certain broker dealers, government entities, and merchants are exempt from the licensing requirement.

In April 2025, DFPI proposed rules under the statute detailing the laws application to surety bond requirements, disclosures, change notifications, and kiosk location oversight. A subsequent rulemaking in September clarified that licensees would be exempt from California’s Money Transmission Act for activities incidental to their digital asset business.

Louisiana’s Virtual Currency Business Act (VCBA), originally enacted in 2020, established a licensing requirement for business activity involving the exchange, transfer, storage, and administration of digital currencies. The regime was strengthened in 2023 to add new definitions of covered activities, authorize emergency rulemaking capabilities and expand the enforcement authority for the state Office of Financial Institutions (OFI). The 2023 amendments are scheduled to sunset on July 1, 2027 unless renewed by the legislature.

Katten recommends that digital asset firms that operate in those states conduct comprehensive compliance assessments, and develop robust internal procedures to meet the new compliance obligations. In particular, the attorneys recommend firms should develop policies addressing cybersecurity, anti-money laundering, customer asset segregation, and financial reporting for each of the states.

Katten also notes that potential federal legislation could preempt or modify the state regulatory regimes and should be monitored closely by digital asset firms.