State-Level Digital Asset Licensing: What to Watch as We Head Into 2026

California, Louisiana, and Illinois have established comprehensive crypto licensing frameworks that mirror New York’s BitLicense regime.  With multiple rulemaking processes now established or soon-to-be adopted and critical compliance deadlines approaching in 2026 and 2027, firms that provide digital asset services to residents in these states should carefully evaluate whether their activities trigger compliance obligations and, to the extent that they do, begin preparations for applying for licenses and building comprehensive compliance programs well in advance of the statutory deadlines.

This article provides summaries of each new state framework, as well as practical compliance considerations digital asset firms should consider.

Illinois: Digital Assets and Consumer Protection Act

Illinois enacted the Digital Assets Consumer Protection Act (DACPA) on August 18, 2025, establishing broad regulatory authority over “digital asset business activity” conducted with Illinois residents.[1] This expansive definition of this term encompasses exchanging, transferring, or storing digital assets, as well as digital asset administration and any additional activities designated through Illinois Department of Financial and Professional Regulation (IDFPR) rulemaking.  One requirement of note applies to exchanges that fall within DACPA’s statutory definition of “covered exchange.”  Before such an exchange lists or offers a digital asset for the benefit of Illinois residents, the exchange must certify that it has (i) identified the risk that the digital asset would be deemed a security by federal or state regulators; (ii) provided written disclosure relating to conflicts of interest of the covered exchange and digital asset; and (iii) conducted a comprehensive risk assessment designed to ensure consumers are adequately protected.

DACPA creates critical compliance milestones: customer disclosure and custody protections must be implemented by January 1, 2027, while full licensing requirements take effect July 1, 2027.  Notably, activities regulated by the Securities and Exchange Commission or the Commodity Futures Trading Commission fall outside DACPA’s scope, as do merchant transactions and personal use.  IDFPR possesses extensive enforcement powers including examination authority, subpoena power, and civil penalties up to $25,000 per violation.  IDFPR’s broad rulemaking mandate suggests detailed regulations addressing cybersecurity, business continuity, asset segregation, and capital requirements are forthcoming.

California: Digital Financial Assets Law

California’s Digital Financial Assets Law (DFAL), enacted in October 2023, requires licensing for digital financial asset business activity beginning July 1, 2026.[2] DFAL requires any person engaging in “digital financial asset business activity” with a California resident to obtain a license from the California Department of Financial Protection and Innovation (DFPI), subject to exemptions for banks, certain broker dealers, government entities, and personal or merchant use.  DFAL includes conditional licensure for holders of qualifying New York approvals, robust disclosure duties, exchange listing certifications, and stablecoin provisions tied to issuer reserves and potential licensing of issuers.

In 2025, DFPI advanced rulemaking to promulgate the various requirements under DFAL.  Initial proposed regulations in April 2025 outlined application content, surety bond requirements, disclosures, change notifications, and kiosk location oversight.[3] On September 29, 2025, DFPI issued a Notice of Modification that clarified and expanded exemptions to avoid duplicative money transmission licensing, added technical amendments to definitions and application details, and renumbered regulatory sections.[4] The modifications notably clarified that DFAL licensees would be exempt from California’s Money Transmission Act for activities incidental to their digital asset business.  Comments closed October 15, 2025.

Next is the finalization of rules and preparation for the July 1, 2026 deadline, by which time entities must be licensed with DFPI or have a pending application.

Louisiana: Virtual Currency Businesses Act

Louisiana’s Virtual Currency Businesses Act (VCBA), effective since 2020, is administered by the Louisiana Office of Financial Institutions (OFI) through the Nationwide Multistate Licensing System.  VCBA requires licensure for “virtual currency business activity” including exchange, transfer, storage, and administration services. 

In 2023, Louisiana strengthened its regulatory framework under the VCBA through Act 331.[5] This legislation enhanced the regulatory structure by adding new definitions, streamlining change of control procedures, expanding OFI’s enforcement authority, mandating accurate disclosures to residents, and authorizing emergency rulemaking capabilities.  Recent legislation provides that the 2023 amendments will automatically expire on July 1, 2027, unless renewed by the legislature.[6]

Strategic Compliance Considerations

As 2026 approaches, digital asset firms that touch residents of Illinois, California, or Louisiana should conduct comprehensive compliance assessments, engage qualified legal counsel to navigate the distinct requirements of each jurisdiction, and establish robust internal governance structures to meet the heightened regulatory expectations.  Firms should particularly focus on developing policies for cybersecurity, anti-money laundering, customer asset segregation, and financial reporting that comply with each state’s specific requirements.

Industry participants should also monitor federal developments closely, as potential federal legislation could preempt or modify state regulatory frameworks.  In the interim, firms should seek early engagement with state regulators through the rulemaking process, particularly in Illinois where IDFPR has broad authority to shape the scope of DACPA through administrative rules.