The Digital Financial Assets Law, on or after July 1, 2026, prohibits a person from engaging in digital financial asset business activity or holding itself out as being able to engage in digital financial asset business activity, with or on behalf of a resident unless any of specified conditions is true. The law defines digital financial asset to mean a digital representation of value that is used as a medium of exchange, unit of account, or store of value, and that is not legal tender, whether or not denominated in legal tender and defines digital financial asset business activity to mean, among other similar things, exchanging, transferring, or storing a digital financial asset or engaging in digital financial asset administration, whether directly or through an agreement with a digital financial asset control services vendor.

This bill, the Digital Financial Asset Banking Act, would generally regulate a bank or a credit union under the examination authority of the Department of Financial Protection and Innovation with respect to its provision of digital asset custody services, staking services, and digital asset transaction services, as those terms are defined, including by requiring certain disclosures to costumers and requiring certain financial safety measures. The bill would require a financial institution engaged in digital financial asset custody services to conduct an annual audit of its custodial activities and holdings that is either an independent audit or a review by the financial institutions board of directors for accuracy and signed be each board member under penalty of perjury. By expanding the scope of the crime of perjury, this bill would impose a state-mandated local program.

This bill would authorize the department to enforce its provisions with administrative and civil remedies, as specified.

The Corporate Securities Law of 1968 generally regulates the offering and selling in this state of a security, as defined.

This bill would define security to not include a staking reward, as defined.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

The Digital Financial Assets Law, on or after July 1, 2026, prohibits a person from engaging in digital financial asset business activity or holding itself out as being able to engage in digital financial asset business activity, with or on behalf of a resident unless any of specified conditions is true. The law defines digital financial asset to mean a digital representation of value that is used as a medium of exchange, unit of account, or store of value, and that is not legal tender, whether or not denominated in legal tender and defines digital financial asset business activity to mean, among other similar things, exchanging, transferring, or storing a digital financial asset or engaging in digital financial asset administration, whether directly or through an agreement with a digital financial asset control services vendor.

This bill, the Digital Financial Asset Banking Act, would generally regulate a bank or a credit union under the examination authority of the Department of Financial Protection and Innovation with respect to its provision of digital asset custody services, staking services, and digital asset transaction services, as those terms are defined, including by requiring certain disclosures to costumers and requiring certain financial safety measures. The bill would require a financial institution engaged in digital financial asset custody services to conduct an annual audit of its custodial activities and holdings that is either an independent audit or a review by the financial institutions board of directors for accuracy and signed be each board member under penalty of perjury. By expanding the scope of the crime of perjury, this bill would impose a state-mandated local program.

This bill would authorize the department to enforce its provisions with administrative and civil remedies, as specified.

The Corporate Securities Law of 1968 generally regulates the offering and selling in this state of a security, as defined.

This bill would define security to not include a staking reward, as defined.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

The Digital Financial Assets Law, on or after July 1, 2026, prohibits a person from engaging in digital financial asset business activity or holding itself out as being able to engage in digital financial asset business activity, with or on behalf of a resident unless any of specified conditions is true. The law defines digital financial asset to mean a digital representation of value that is used as a medium of exchange, unit of account, or store of value, and that is not legal tender, whether or not denominated in legal tender and defines digital financial asset business activity to mean, among other similar things, exchanging, transferring, or storing a digital financial asset or engaging in digital financial asset administration, whether directly or through an agreement with a digital financial asset control services vendor.

This bill, the Digital Financial Asset Banking Act, would generally regulate a bank or a credit union under the examination authority of the Department of Financial Protection and Innovation with respect to its provision of digital asset custody services, staking services, and digital asset transaction services, as those terms are defined, including by requiring certain disclosures to costumers and requiring certain financial safety measures. The bill would require a financial institution engaged in digital financial asset custody services to conduct an annual audit of its custodial activities and holdings that is either an independent audit or a review by the financial institutions board of directors for accuracy and signed be each board member under penalty of perjury. By expanding the scope of the crime of perjury, this bill would impose a state-mandated local program.

This bill would authorize the department to enforce its provisions with administrative and civil remedies, as specified.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

The Digital Financial Assets Law, on or after July 1, 2026, prohibits a person from engaging in digital financial asset business activity, as defined, activity or holding itself out as being able to engage in digital financial asset business activity, with or on behalf of a resident unless any of specified conditions is true. The law defines digital financial asset to mean a digital representation of value that is used as a medium of exchange, unit of account, or store of value, and that is not legal tender, whether or not denominated in legal tender and defines digital financial asset business activity to mean, among other similar things, exchanging, transferring, or storing a digital financial asset or engaging in digital financial asset administration, whether directly or through an agreement with a digital financial asset control services vendor.

This bill would make nonsubstantive changes to those provisions. bill, the Digital Financial Asset Banking Act, would generally regulate a bank or a credit union under the examination authority of the Department of Financial Protection and Innovation with respect to its provision of digital asset custody services, staking services, and digital asset transaction services, as those terms are defined, including by requiring certain disclosures to costumers and requiring certain financial safety measures. The bill would require a financial institution engaged in digital financial asset custody services to conduct an annual audit of its custodial activities and holdings that is either an independent audit or a review by the financial institutions board of directors for accuracy and signed be each board member under penalty of perjury. By expanding the scope of the crime of perjury, this bill would impose a state-mandated local program.

The Digital Financial Assets Law, on or after July 1, 2026, prohibits a person from engaging in digital financial asset business activity, as defined, or holding itself out as being able to engage in digital financial asset business activity, with or on behalf of a resident unless any of specified conditions is true.

This bill would make nonsubstantive changes to those provisions.

ASSEMBLY THIRD READING

ATR Bill Id:AB 2285

Author:(Valencia)

As Amended Ver:June 10, 2026

Majority vote

SUMMARY

1. This bill would generally regulate a bank or a credit union under the examination authority of the Department of Financial Protection and Innovation (DFPI) with respect to its provision of digital asset custody services, staking services, and digital asset transaction services, as those terms are defined, including by requiring certain disclosures to consumers and requiring certain financial safety measures.
2. Regarding all digital financial asset service providers, this bill would exempt staking rewards providers from state securities laws and registration requirements.

Major Provisions

For a detailed list of major provisions, please see the Banking and Finance Committee analysis.

1. Provides definitions for "active staking", "passive staking", "slashing", "pooled custody", "segregated custody", "fiduciary capacity", and "non-fiduciary capacity".
2. Provides requirements, as specified, for fiduciary and non-fiduciary custody of Digital Financial Assets Law (DFA).
3. Provides requirements, as specified, for custodial services including the use of third-party services. 
4. Provides requirements for annual auditing of custodial services by way of independent audit or review and signed attestation of the Depository Institution's (DI) Board of Directors.
5. Provides minimum requirements for consumer disclosures.
6. Provides anti-money laundering and cybersecurity compliance requirements.
7. Specifies that rewards from staking, including through a staking service provider, are not a security.
8. Provides that distribution staking rewards is not subject to registration for the sale of securities

COMMENTS

1. Background

In May, 2025, the Office of the Comptroller of the Currency (OCC) which oversees nearly 4,000 federal institutions across the country, issued guidance to clarify that national banks and federal savings associations can buy and sell digital financial assets held in custody at its customer's direction if they follow the practices they use for traditional assets. This clarification also included the permissibility of the use of third-party sub-custodians. Since this guideline was issued, five applications to either newly charter or convert existing institutions into national trust banks that will engage in digital financial asset activity have been conditionally approved. 

State chartered banks and credit unions are regulated by the Department of Financial Protection and Innovation, not the OCC. Despite progress on the Digital Financial Asset Law (DFAL), there is no pathway for banks and credit unions to participate in an emerging and global market.

1. What this bill does
2. Custody Service and Accuracy

This bill requires a DI to enter a written contract with its customer^[1] with clear disclosures regarding whether or not the relationship is fiduciary or non-fiduciary, If the relationship is non-fiduciary, the agreement must make clear that the DI will only act on the customer's explicit instructions. In either a fiduciary or non-fiduciary relationship the agreement must clearly disclose whether or not the DFA held in custody by the DI are insured by the Federal Deposit Insurance Corporation, the National Credit Union Administration, or any other federal or state deposit insurance or share insurance program, and whether or not a DFA held in custody by the DI is a deposit, obligation, or other liability of the DI. This bill requires disclosure of any thresholds or triggering mechanisms that may cause a DI to take action on a customer's behalf in a fiduciary relationship.  And the bill requires any changes to the agreement to be provided to the customer 45 days before its effective date.

1. Third party activity and engagement

A DI may use a third-party contractor to conduct digital asset custody services, however, use of the subcustodian must be prominently disclosed on the first page of the agreement. The bill puts the onus on the DI to ensure compliance with the requirements of this bill, which include: 1) insurance to protect against breaches or theft, and 2) licensure under DFAL, money transmitters law. The agreement between the DI and the subcustodian must be structured to maintain the DI as the custodial recordholder of the DFA, and that the DFA remains the property of the DI's customers. 

1. Staking Services and Fiduciary DFA transaction authority 

This bill requires disclosures of the following information regarding staking services: 

1. The fact that the DI may automatically stake an eligible DFA in the customer's account unless the customer affirmatively opts out of participation.
2. The key risks associated with staking, including the potential for loss of staked assets or staking rewards due to slashing or other network events, and cybersecurity or operational risks inherent in the staking process.
3. Any applicable lockup, unbonding, or notice period before a staked DFA can be withdrawn or transferred and the implications of that period for the customer's access to the customer's digital financial assets.
4. The customer's rights and obligations related to the staking service, including the right to discontinue participation in staking at any time and the entitlement to receive staking rewards earned on the customer's digital financial assets.
5. The amount or rate of any fee or commission that the DI will deduct from a staking reward as compensation for providing staking services.

AB 2285 requires the DI to identify policies and procedures to protect from, effectively identify, monitor, and manage risks associated with staking, including operational risks, cybersecurity threats, and slashing.

1. Ongoing Considerations

Non-DI digital asset exchanges have raised concerns that these higher standards and practices may become a precedent for their industry, whether in whole or in part. Some potential DI's have raised concerns with some terms of the bill, specifically regarding: auditing, slashing insurance requirement, 45-day contract amendment notice, and cybersecurity incidents. Stakeholders have also requested to put the state law in parity with the federal law. 

1. Recent Amendments

The following amendments have recently been made to the bill and Corporations Code:

• • 1. Specification that rewards from staking, including by any staking service provider is not a "security" as defined;
    2. An exemption from state securities registration laws for the act of distributing of staking rewards, and
    3. Elimination of the reference to "customer" in the definition of staking rewards in the reference language pertaining to the financial institutions proposed bill language.
    4. Deletion of the staking rewards commission fee cap terms.
  1. Basic Technical Background

Staking is the act of locking away a portion of currency, like a good-will security deposit, to gain and maintain eligibility to participate in the selection process for securing a proof of stake (PoS) based blockchain network and creating more blocks in exchange for payment. The more currency a validator stakes, the higher their chances of being selected as a validator and thus to earn payment. Since the value of the payments fluctuate, and PoS is based on a behavioral incentivization, these payments for services are characterized as "rewards".  This "skin-in-the-game" model encourages participants to perform accurately–good behavior results in payment, malicious or undesirable behavior results in penalization against the participants personal stake or slashing of the entire amount. Validators are rewarded for correctly validating transactions. However, if a validator acts against the network's interests, a portion or all their staked currency may be forfeited — a process known as slashing. Slashing results in prevention from participation and forcible exit.

The barrier to entry for staking can be relatively high for two reasons. The first reason can be economical, for example, the minimum amount of ETH required to stake Ethereum is currently 32 ETH or $72,987 USD at the time of this writing. Note, this is only the minimum, the higher the amount staked, the more likely the validator is to be selected and thus to earn more rewards. Third party exchanges offer customers "pooled" staking using fractional contributions to participate in certain network protocols that would normally be economically out of reach. The second, albeit slighter, barrier to entry, is mechanical; specifical software, hardware and reliably high-speed internet are required.

The key takeaway is that staking is the act of securing the network and receiving rewards in return, losses are not based on market fluctuation, but rather the action of the staker or cybersecurity breach.

• 1. CLARITY ACT language from the U.S. Senate Banking Committee^[2]

A recently released a version of the CLARITY Act from the U.S. Senate Banking Committee provided terms for staking, specifically, in the scenario of "self-custodial" staking with a third party. Under this version, staking rewards, which fall under the tern "network token" are not a security, however, a network token does not include an investment contract.

The Act makes clear delineations between administrative and ministerial acts versus control or custodial power over network tokens. The former is treated as commodities/non-securities, and the latter as semi-securities.^[3]

1. Litigation History
   1. Agency Actions in 2023

In 2023, the SEC charged Coinbase, Inc. and Coinbase Global, Inc. (hereinafter "Coinbase") for violating securities law when it offered its customers staking services. The SEC's complaint alleged that Coinbase: 

"has operated as: an unregistered broker, including by soliciting potential investors, handling customer funds and assets, and charging transaction-based fees; an unregistered exchange, including by providing a market place that, among other things, brings together orders of multiple buyers and sellers of crypto assets and matches and executes those orders; and an unregistered clearing agency, including by holding its customers' assets in Coinbase-controlled wallets and settling its customers' transactions by debiting and crediting the relevant accounts."

California, New Jersey, South Carolina, and Wisconsin took similar steps to halt unregistered third-party staking services against the company. These state regulators looked to the company's framework wherein users delegate their assets to the platform to act on the user's behalf in exchange for a share of the reward, which could fall under their securities law.

The California Department of Financial Protection and Innovation initiated an administrative law action by filing a desist and refrain order halting all unregistered staking activities conducted by Coinbase in the state. 

In its order^[4], the DFPI examined claims made on the company's website, specifically "Earn up to 6.00 APY% on your crypto. Put your crypto to work and earn rewards." "We'll help you put your assets to work in the cryptoeconomy so you can grow your crypto holdings with little effort." And "we take measures to mitigate risks and allow you to opt-out anytime." 

The order also includes statements of risk mitigation from Coinbase's public website, specifically, 

"'the possible slashing of staked assets or rewards. Although it's unlikely, there is a possibility you could lose your staked assets or rewards in case of a network or validator failure. We've taken measures to reduce these risks, but some events are outside our control.' In the event that crypto assets invested by Coinbase Staking Offerings investors are lost or reduced as the result of "slashing," Coinbase may, in some circumstances, replace investors' slashed assets staked in the Coinbase Staking Offering at no additional cost." 

The order notes that Coinbase has no contractual obligation to retain a like amount of investors' crypto assets or comparable ones to cover investors' losses in the event of slashing. The order also lists eight (8) functions and operations conducted by Coinbase in its "sole and absolute discretion" to facilitate the staking of assets for its users.^[5] 

The DFPI reasons that among other things, qualifying an offer and sale of securities is essential for market safety. Compliance with registration ensures that users receive all necessary material information required to assess the risk of an investment. One such disclosure is that Coinbase is not protected by investor- and consumer- protection organizations, such as the Securities Investor Protection Corporation and the Federal Deposit Insurance Corporation. It notes, Coinbase would be permitted to provide staking to its users under its current framework if it registers as a security with the DFPI. 

Coinbase's position is that it offers staking as a service to its customers as a convenience. On its publicly available website, it states: 

"staking is a way to earn rewards by putting your crypto to work on a blockchain network. In return for helping the network run smoothly and securely, you receive more of the cryptocurrency you're staking. The rewards come from the network itself—your crypto isn't being lent out. It's a safe, simple and popular way to grow your crypto while holding." 

It claims that since 2023, California users have lost $89 million in potential rewards. Coinbase also claims that it has never been slashed. This is not surprising given that slashing is a disincentivizer that is used for malicious or dishonest behavior. When staking, to a large extent, penalties, or losses, are in the mechanical control of the staker.

• 1. Agency Actions in 2025

In early 2025 following the inauguration, the SEC announced the dismissal of its civil enforcement action against Coinbase. In the press release, the SEC stated:

"For the last several years, the Commission's views on crypto have been largely expressed through enforcement actions without engaging the general public," said Acting Chairman Mark T. Uyeda. "It's time for the Commission to rectify its approach and develop crypto policy in a more transparent manner. The Crypto Task Force is designed to do just that."

The Commission's decision to exercise its discretion and dismiss this pending enforcement action rests on its judgment that the dismissal will facilitate the Commission's ongoing efforts to reform and renew its regulatory approach to the crypto industry, not on any assessment of the merits of the claims alleged in the action. Furthermore, as stated in the joint stipulation, 'the Commission's decision to seek dismissal of this litigation does not reflect the Commission's position on any other case.'"^[6]

Since this release, the other states' cases against Coinbase, except for California, have been dismissed or resolved by codifying legislation around staking. Notably, other exchanges are currently providing staking services in California having filed pursuant to state securities laws, though it is unclear if the filing is for the purposes of staking services.

Most recently, the Administrative Law Judge granted a request by Coinbase to continue the matter until November 2026 for reasons of imminent federal legislation.

1. Amendment to remove the fee cap on staking rewards

In response to stakeholder concerns, the author removed the fee cap requirements on staking rewards. This amendment is anticipated to give the financial institutions flexibility to implement their DFA programs with third party providers while maintaining consumer transparency.

1. Likely Impact of the Amendments

The amendments, if codified before the resumption of the action, will likely provide a complete defense to the DFPI action. The amendments will allow cryptocurrency exchanges in California to provide staking service without being required to register under state securities laws.

According to the Author

With no comprehensive federal framework in place, states have both the ability and the responsibility to develop guidelines for market conduct while balancing consumer safety. We would not be the first to do so. States like South Carolina and Montana have already passed legislation to determine that staking as a service is not a security, and California should not leave its own residents behind. Staking strengthens the digital asset ecosystem by helping secure the networks people rely on, and it lets everyday consumers earn rewards for doing so. That is an opportunity Californians should have. Regulatory agencies have an important role, but that role is to regulate according to the statute. It is the Legislature's authority to create and modify that statute. This bill ensures Californians can participate in staking with consumer protections in place.

Arguments in Support

"State-chartered banks and credit unions are the backbone of community finance across California. As federal regulators and Congress move to establish clearer rules for digital asset banking activities, state-chartered institutions risk being left behind when state law fails to keep pace. That gap puts California institutions at a disadvantage relative to their federally chartered competitors and to institutions in states that have already modernized their laws. AB 2285 closes that gap. By clarifying the authority of state-chartered banks and credit unions to engage in digital asset banking activities, including custody and related services, the bill preserves the competitiveness of California's dual banking system and keeps financial innovation, along with the jobs and economic activity that follow it, here in California.

We are especially supportive of the bill's staking provisions. Staking is a core function of many modern blockchain networks. Individuals and institutions that stake digital assets help validate transactions, secure networks, and support decentralized infrastructure, and in return they may receive protocol-generated rewards for providing those services. Staking is a network participation activity, and AB 2285 rightly affirms that staking and staking rewards are not securities under California law.

We also believe strongly that staking should be broadly available to Californians. Uncertainty surrounding the treatment of staking has produced regulatory confusion and reduced consumer access. In some cases, companies have limited or discontinued staking services because of legal uncertainty, depriving users of the ability to participate in blockchain networks and earn the rewards those networks generate. By recognizing the technical reality of how proof-of-stake networks operate, AB 2285 ensures that Californians are not disadvantaged relative to residents of states that have already acted to protect lawful blockchain participation, and that access to staking is not confined to a narrow set of providers."—Satoshi Action Fund

Arguments in Opposition

"As currently written, this bill lacks robust consumer protections by misleading consumers into believing that cryptocurrency assets are insured deposits with meaningful safeguards, particularly in the context of staking, when they are not.

Additionally, the bill creates an uneven playing field among entities while undermining the authority of the Department of Financial Protection and Innovation. …One of the impacts of these newer amendments is the fact that "the amendments will allow cryptocurrency exchanges in California to provide staking service without being required to register under state securities laws." AB 2258 is bad policy and sets a bad precedent."—Consumer Federation of California

FISCAL COMMENTS

The following is a revised analysis from the Assembly Committee on Appropriations to reflect the most recent amendments:

Costs of an unknown, but likely significant amount, to DFPI from specifying that a staking reward is not a "security."  Although this bill provides that the distribution of staking rewards is not subject to DFPI regulation under the Corporate Securities Law of 1968, DFPI will likely receive related consumer inquiries and complaints, resulting in staff workload costs to manage public communications and update informational materials.  DFPI may also incur related legal costs, as DFPI is currently engaged in litigation against an exchange regarding unqualified staking activities conducted in the state. 

Additionally, although DFPI anticipates minor and absorbable costs related to the regulation of a bank or credit union with respect to the financial institution's provision of DFA services, as DFPI notes it already has authority under existing law to broadly examine a financial institution, this bill may result in possibly significant costs to DFPI to the extent a financial institution's current DFA practices (or future practices, pursuant to pending federal legislation) do not align with this bill, leading to more complex examinations and enforcement proceedings regarding an evolving technological asset (Financial Protection Fund).

VOTES

ASM BANKING AND FINANCE: 9-0-0

YES: Valencia, Chen, Dixon, Fong, Krell, Michelle Rodriguez, Blanca Rubio, Schiavo, Soria

ASM PRIVACY AND CONSUMER PROTECTION: 15-0-0

YES: Bauer-Kahan, Macedo, Bryan, DeMaio, Hoover, Irwin, Lowenthal, McKinnor, Ortega, Patterson, Pellerin, Petrie-Norris, Ward, Wicks, Wilson

ASM APPROPRIATIONS: 15-0-0

YES: Wicks, Hoover, Aguiar-Curry, Calderon, Caloza, Dixon, Fong, Mark González, Krell, Pacheco, Pellerin, Sharp-Collins, Solache, Ta, Tangipa

ASM BANKING AND FINANCE: 7-1-1

YES: Valencia, Dixon, Fong, Krell, Michelle Rodriguez, Blanca Rubio, Soria

NO: Schiavo

ABS, ABST OR NV: Chen

UPDATED

VERSION: June 10, 2026

CONSULTANT: Desiree Nguyen Orth / B. & F. / (916) 319-3081 FN: 0003154

1.  Customers of credit unions are normally referred to as "members". For purposes of this analysis, the term "customer" will be used to mean both bank customers and credit union members. ↑

2. Digital Asset Market Clarity Act, H.R. 3633, 119 Cong. (2025). https://www.congress.gov/bill/119th-congress/house-bill/3633/text ↑

3. Full securities registration has not been indicated as a requirement for these digital financial assets, though some reporting and oversight requirements under the purview of the SEC is expected. ↑

4. https://dfpi.ca.gov/wp-content/uploads/sites/337/2023/06/Admin.-Action-Coinbase-Global-Inc.-Notice-of-Intent.pdf ↑

5. These arguments are likely provided to prove the "efforts of others" prong of the Howey test. The "efforts of others" requirement is satisfied when "the efforts made by those other than the investor are the undeniably significant ones, those essential managerial efforts which affect the failure or success of the enterprise." SEC v. Glenn W. Turner Enterprises, Inc., 474 F.2d 476, 482 (9th Cir. 1973). ↑

6. https://www.sec.gov/newsroom/press-releases/2025-47 Last visit 6/4/2026. ↑

Date of Hearing: June 8, 2026

ASSEMBLY COMMITTEE ON BANKING AND FINANCE

Avelino Valencia, Chair

ABPCA Bill Id:AB 2285 (

Author:Valencia) – As Amended Ver:June 3, 2026

SUBJECT: Digital Financial Asset Banking Act

SUMMARY:

This bill would generally regulate a bank or a credit union under the examination authority of the Department of Financial Protection and Innovation (DFPI) with respect to its provision of digital asset custody services, staking services, and digital asset transaction services, as those terms are defined, including by requiring certain disclosures to consumers and requiring certain financial safety measures.

Floor amendments amend the Corporations Code to specify that 1) rewards from staking, including by a staking service provider are not a security within the definition of “security”, and 2) the distribution staking rewards is not subject to registration for the sale of securities.

Specifically, this bill:

1. Provides definitions for “active staking”, “passive staking”, “slashing”, “pooled custody”, “segregated custody”, “fiduciary capacity”, and “non-fiduciary capacity”.
2. Provides requirements, as specified, for fiduciary and non-fiduciary custody of DFA.
3. Provides requirements, as specified, for custodial services including the use of third-party services. 
4. Provides requirements for annual auditing of custodial services by way of independent audit or review and signed attestation of the DI’s Board of Directors.
5. Provides minimum requirements for consumer disclosures.
6. Provides a framework for the payment of fees or commissions for staking services. 
7. Provides anti-money laundering and cybersecurity compliance requirements.
8. Specifies that rewards from staking, including through a staking service provider, are not a security.
9. Provides that distribution staking rewards is not subject to registration for the sale of securities.

EXISTING LAW:

California DFAL:

1. Defines “digital financial asset administration” to mean issuing a digital financial asset with the authority to redeem the digital financial asset for legal tender, bank or credit union credit, or another digital financial asset. Financial Code (Fin.Code) section 3201(h). 
2. Defines “digital financial asset business activity” to mean any of the following:
   1. Exchanging, transferring, or storing a digital financial asset or engaging in digital financial asset administration, whether directly or through an agreement with a digital financial asset control services vendor.
   2. Holding electronic precious metals or electronic certificates representing interests in precious metals on behalf of another person or issuing shares or electronic certificates representing interests in precious metals.
   3. Exchanging one or more digital representations of value used within one or more online games, game platforms, or family of games for either of the following:
      1. A digital financial asset offered by or on behalf of the same publisher from which the original digital representation of value was received.
      2. Legal tender or bank or credit union credit outside the online game, game platform, or family of games offered by or on behalf of the same publisher from which the original digital representation of value was received. Fin.Code section 3102 (i).
3. Requires persons conducting digital financial business activity to obtain a license as a covered person. Fin.Code section 3102. 
4. Before engaging in digital financial asset business activity with a resident, a covered person shall disclose, to the extent applicable to the digital financial asset business activity the covered person will undertake with the resident, all of the following:
   1. A schedule of fees and charges the covered person may assess, the manner by which fees and charges will be calculated if they are not set in advance and disclosed, and the timing of the fees and charges.
   2. Whether the product or service provided by the covered person is covered by either of the following:
      1. A form of insurance or other guarantee against loss by an agency of the United States as follows:
         1. Up to the full United States dollar equivalent of digital financial assets placed under the control of, or purchased from, the covered person as of the date of the placement or purchase, including the maximum amount provided by insurance under the Federal Deposit Insurance Corporation, National Credit Union Share Insurance Fund, or otherwise available from the Securities Investor Protection Corporation.
         2. If not provided at the full United States dollar equivalent of the digital financial asset placed under the control of or purchased from the covered person, the maximum amount of coverage for each resident expressed in the United States dollar equivalent of the digital financial asset.
      2. Private insurance against theft or loss, including cybertheft or theft by other means.
   3. Upon request of a resident with whom a covered person engages in digital financial asset business activity, a covered person shall disclose the terms of the insurance policy to the resident in a manner that allows the resident to understand the specific insured risks that may result in partial coverage of the resident’s assets.
   4. The irrevocability of a transfer or exchange and any exception to irrevocability.
   5. A description of all of the following:
      1. The covered person’s liability for an unauthorized, mistaken, or accidental transfer or exchange.
      2. The resident’s responsibility to provide notice to the covered person of an unauthorized, mistaken, or accidental transfer or exchange.
      3. The basis for any recovery by the resident from the covered person in case of an unauthorized, mistaken, or accidental transfer or exchange.
      4. General error resolution rights applicable to an unauthorized, mistaken, or accidental transfer or exchange.
      5. The method for the resident to update the resident’s contact information with the covered person.
   6. That the date or time when the transfer or exchange is made and the resident’s account is debited may differ from the date or time when the resident initiates the instruction to make the transfer or exchange.
   7. Whether the resident has a right to stop a preauthorized payment or revoke authorization for a transfer and the procedure to initiate a stop-payment order or revoke authorization for a subsequent transfer.
   8. The resident’s right to receive a receipt, trade ticket, or other evidence of the transfer or exchange.
   9. The resident’s right to at least 14 days’ prior notice of a change in the covered person’s fee schedule, other terms and conditions that have a material impact on digital financial asset business activity with the resident, or the policies applicable to the resident’s account.
   10. That no digital financial asset is currently recognized as legal tender by California or the United States.
   11. A list of instances in the past 12 months when the covered person’s service was unavailable to 10,000 or more customers seeking to engage in digital financial asset business activity due to a service outage on the part of the covered person and the causes of each identified service outage.
       1. As part of the disclosure required by this paragraph, the covered person may list any steps the covered person has taken to resolve underlying causes for those outages. Fin.Code section 3501.
5. California Banking and Credit Union
6. California Law regulates, through examination, state chartered banks and credit unions under the authority of the Department of Financial Protection and Innovation (DFPI). Fin.Code section 1000-1901 and Fin.Code section 14000-16906.

FISCAL EFFECT:

The following comment is from the analysis of the Assembly Appropriations Committee provided prior to the floor amendment.

DFPI anticipates minor and absorbable costs to update informational materials to reflect a financial institution’s requirements regarding DFAs, provide additional training for staff, and undergo mandatory rulemaking to create the notice form specified in this bill. DFPI notes that it already has authority under existing law to broadly examine a financial institution. However, it is possible for this bill to result in costs to DFPI in excess of $150,000, to the extent a financial institution’s current DFA practices (or future practices, pursuant to pending federal legislation) do not align with this bill, leading to more complex examinations and enforcement proceedings regarding an evolving technological asset (Financial Protection Fund).

COMMENTS:

1. Background

In May, 2025, the Office of the Comptroller of the Currency (OCC) which oversees nearly 4,000 federal institutions across the country, issued guidance to clarify that national banks and federal savings associations can buy and sell digital financial assets held in custody at its customer’s direction if they follow the practices they use for traditional assets. This clarification also included the permissibility of the use of third-party sub-custodians. Since this guideline was issued, five applications to either newly charter or convert existing institutions into national trust banks that will engage in digital financial asset activity have been conditionally approved. 

State chartered banks and credit unions are regulated by the Department of Financial Protection and Innovation, not the OCC. Despite progress on the Digital Financial Asset Law (DFAL), there is no pathway for banks and credit unions to participate in an emerging and global market. 

1. What this bill does
2. Custody Service and Accuracy

This bill requires a DI to enter a written contract with its customer^[1] with clear disclosures regarding whether or not the relationship is fiduciary or non-fiduciary, If the relationship is non-fiduciary, the agreement must make clear that the DI will only act on the customer’s explicit instructions. In either a fiduciary or non-fiduciary relationship the agreement must clearly disclose whether or not the DFA held in custody by the DI are insured by the Federal Deposit Insurance Corporation, the National Credit Union Administration, or any other federal or state deposit insurance or share insurance program, and Whether or not a DFA held in custody by the DI is a deposit, obligation, or other liability of the DI. This bill requires disclosure of any thresholds or triggering mechanisms that may cause a DI to take action on a customer’s behalf in a fiduciary relationship.  And the bill requires any changes to the agreement to be provided to the customer 45 days before its effective date. 

As to the funds itself, this bill requires at least a one-to-one reserve of each type of digital asset held in passive staking. This is to ensure demand withdrawals can be executed. The bill prohibits the pooling of DFA unless the DI maintains accurate records to identify each customer’s specific interests in the DFA. To ensure compliance, annual independent auditing or review and certification by the entire board of directors is required. 

1. Third party activity and engagement

A DI may use a third party contractor to conduct digital asset custody services, however, use of the subcustodian must be prominently disclosed on the first page of the agreement. The bill puts the onus on the DI to ensure compliance with the requirements of this bill, which include: 1) insurance to protect against breaches or theft, and 2) licensure under DFAL, money transmitters law. The agreement between the DI and the subcustodian must be structured to maintain the DI as the custodial recordholder of the DFA, and that the DFA remains the property of the DI’s customers. 

1. Staking Services and Fiduciary DFA transaction authority 

This bill requires disclosures of the following information regarding staking services: 

1. The fact that the DI may automatically stake an eligible DFA in the customer’s account unless the customer affirmatively opts out of participation.
2. The key risks associated with staking, including the potential for loss of staked assets or staking rewards due to slashing or other network events, and cybersecurity or operational risks inherent in the staking process.
3. Any applicable lockup, unbonding, or notice period before a staked DFA can be withdrawn or transferred and the implications of that period for the customer’s access to the customer’s digital financial assets.
4. The customer’s rights and obligations related to the staking service, including the right to discontinue participation in staking at any time and the entitlement to receive staking rewards earned on the customer’s digital financial assets.
5. The amount or rate of any fee or commission that the DI will deduct from a staking reward as compensation for providing staking services.

AB 2285 requires the DI to identify policies and procedures to protect from, effectively identify, monitor, and manage risks associated with staking, including operational risks, cybersecurity threats, and slashing.

This bill adds specifications to the management of DFA trading activity, whether automated or not. The required specifications speak to transparency and accountability of money, returns, and losses. 

1. Ongoing Considerations

Non-DI digital asset exchanges have raised concerns that these higher standards and practices may become a precedent for their industry, whether in whole or in part. Some potential DI’s have raised concerns with some terms of the bill, specifically regarding: auditing, fee cap rigidity, slashing insurance requirement, 45-day contract amendment notice, and cybersecurity incidents. Stakeholders have also requested to put the state law in parity with the federal law. 

1. Floor Amendments

The following floor amendments have been made to the Corporations Code:

i) Specification that rewards from staking, including by any staking service provider is not a “security” as defined;

ii) An exemption from state securities registration laws for the act of distributing of staking rewards, and

iii) Elimination of the reference to “customer” in the definition of staking rewards in the reference language pertaining to the financial institutions proposed bill language.

• 1. Basic Technical Background

Staking is the act of locking away a portion of currency, like a good-will security deposit, to gain and maintain eligibility to participate in the selection process for securing a proof of stake (PoS) based blockchain network and creating more blocks in exchange for payment. The more currency a validator stakes, the higher their chances of being selected and thus to earn payment. Since the value of the payments fluctuate, and PoS is based on a behavioral incentivization, these payments for services are characterized as “rewards”.  This “skin-in-the-game” model encourages participants to perform accurately–good behavior results in payment, malicious or undesirable behavior results in penalization against the participants personal stake or slashing of the entire amount. Slashing results in prevention from participation and forcible exit.

In broad terms, an overview of the process and requirements for staking are: 1) no less than the minimum amount of currency to stake (the more that is staked the more likely to be selected), 2) the blockchain protocol will select multiple validators as needed, and 3) validators must use specialized hardware and software, as well as stay online 24 hours to perform the validation services for a global market. Going offline for a number of days with regularity results in penalization against the validator’s stake. Validators are rewarded for correctly validating transactions. However, if a validator acts against the network’s interests, a portion or all their staked currency may be forfeited — a process known as slashing.

According to Ethereum, a leading PoS blockchain, slashing has two purposes: (1) to make it prohibitively expensive to attack the network, and (2) to stop validators from being “lazy” by checking that they actually perform their duties. Those who are slashed have acted in a provably destructive manner, and portion of their stake will be destroyed. Slashing also results in validators being prevented from participating in the protocol further and forcibly exited.

Staking is an activity that can be participated in by individuals with resources, both economically and mechanically, or on a pooled basis through a third party. The barrier to entry for staking can be relatively high for two reasons. The first reason can be economical, for example, the minimum amount of ETH required to stake Ethereum is currently 32 ETH or $72,987 USD at the time of this writing. Note, this is only the minimum, the higher the amount staked, the more likely the validator is to be selected and thus to earn more rewards. Third party exchanges offer customers pooled staking using fractional contributions to participate in certain network protocols that would normally be economically out of reach. The second, albeit slighter, barrier to entry, is mechanical; specifical software, hardware and reliably high-speed internet are required.

• 1. CLARITY ACT language from the U.S. Senate Banking Committee^[2]

The following definitions and terms are provided in the most recently released draft of the Congressional Senate Banking Committee:

“Self-custodial Staking with a Third Party” is “the distribution of a unit of a network token, as a programmatic result of validating or staking activity for a distributed ledger system’s consensus mechanism, including the staking of a network token, and the operation of a node, validator, or substantially similar software for such activity in which—‘‘(I) the owner of the staked network token, and operator of the node, validator, or substantially similar software for such activity are different persons or entities; and ‘‘(II) the operator of the node, validator, or substantially similar software does not maintain custody or control of the staked network token.

Essentially, the owner of the staked currency is not the same person as the entity operating the software and providing the hardware required to perform the validation, and the entity does not maintain control of the currency.

“Custodial and Ancillary Staking Services” in general and subject to rulemaking, “the provision of custodial or ancillary staking services enabling the owner of a network token to participate in validating or staking activity for a distributed ledger system’s consensus mechanism that results in the programmatic distribution of a unit of a network token, provided that such custodial or ancillary services are exclusively administrative or ministerial in nature.”

The Act further states that the Commission shall issue rules defining the custodial and ancillary staking services that are exclusively administrative or ministerial in nature, consistent with what is necessary or appropriate for the public interest or for the protection of investors.

1. Litigation History
   1. Agency Actions in 2023

In 2023, the SEC charged Coinbase, Inc. and Coinbase Global, Inc. (hereinafter “Coinbase”) for violating securities law when it offered its customers staking services. The SEC’s complaint alleged that Coinbase: 

“has operated as: an unregistered broker, including by soliciting potential investors, handling customer funds and assets, and charging transaction-based fees; an unregistered exchange, including by providing a market place that, among other things, brings together orders of multiple buyers and sellers of crypto assets and matches and executes those orders; and an unregistered clearing agency, including by holding its customers’ assets in Coinbase-controlled wallets and settling its customers’ transactions by debiting and crediting the relevant accounts.”

California, New Jersey, South Carolina, and Wisconsin took similar steps to halt unregistered third-party staking services against the company. These state regulators looked to the company’s framework wherein users delegate their assets to the platform to act on the user’s behalf in exchange for a share of the reward, which could fall under their securities law.

The California Department of Financial Protection and Innovation initiated an administrative law action by filing a desist and refrain order halting all unregistered staking activities conducted by Coinbase in the state. 

In its order^[3], the DFPI examined claims made on the company’s website, specifically “Earn up to 6.00 APY% on your crypto. Put your crypto to work and earn rewards.” “We’ll help you put your assets to work in the cryptoeconomy so you can grow your crypto holdings with little effort.” And “we take measures to mitigate risks and allow you to opt-out anytime.” 

The order also includes statements of risk mitigation from Coinbase’s public website, specifically, 

“‘the possible slashing of staked assets or rewards. Although it’s unlikely, there is a possibility you could lose your staked assets or rewards in case of a network or validator failure. We’ve taken measures to reduce these risks, but some events are outside our control.’ In the event that crypto assets invested by Coinbase Staking Offerings investors are lost or reduced as the result of “slashing,” Coinbase may, in some circumstances, replace investors’ slashed assets staked in the Coinbase Staking Offering at no additional cost.” 

The order notes that Coinbase has no contractual obligation to retain a like amount of investors’ crypto assets or comparable ones to cover investors’ losses in the event of slashing. The order also lists eight (8) functions and operations conducted by Coinbase in its “sole and absolute discretion” to facilitate the staking of assets for its users.^[4] 

The DFPI reasons that among other things, qualifying an offer and sale of securities is essential for market safety. Compliance with registration ensures that users receive all necessary material information required to assess the risk of an investment. One such disclosure is that Coinbase is not protected by investor- and consumer- protection organizations, such as the Securities Investor Protection Corporation and the Federal Deposit Insurance Corporation. It notes, Coinbase would be permitted to provide staking to its users under its current framework if it registers as a security with the DFPI. 

Coinbase’s position is that it offers staking as a service to its customers as a convenience. On its publicly available website, it states: 

“staking is a way to earn rewards by putting your crypto to work on a blockchain network. In return for helping the network run smoothly and securely, you receive more of the cryptocurrency you're staking. The rewards come from the network itself—your crypto isn't being lent out. It's a safe, simple and popular way to grow your crypto while holding.” 

It claims that since 2023, California users have lost $89 million in potential rewards. Coinbase also claims that it has never been slashed. This is not surprising given that slashing is a disincentivizer that is used for malicious or dishonest behavior. When staking, to a large extent, penalties, or losses, are in the mechanical control of the staker.

• 1. Agency Actions in 2025

In early 2025, the SEC announced the dismissal of its civil enforcement action against Coinbase. In the press release, the SEC stated:

“For the last several years, the Commission’s views on crypto have been largely expressed through enforcement actions without engaging the general public,” said Acting Chairman Mark T. Uyeda. “It’s time for the Commission to rectify its approach and develop crypto policy in a more transparent manner. The Crypto Task Force is designed to do just that.”

The Commission’s decision to exercise its discretion and dismiss this pending enforcement action rests on its judgment that the dismissal will facilitate the Commission’s ongoing efforts to reform and renew its regulatory approach to the crypto industry, not on any assessment of the merits of the claims alleged in the action. Furthermore, as stated in the joint stipulation, ‘the Commission’s decision to seek dismissal of this litigation does not reflect the Commission’s position on any other case.’”^[5]

Since this release, the other states’ cases against Coinbase, except for California, have been dismissed or resolved by codifying staking as a service. Notably, other exchanges are currently providing staking services in California having filed pursuant to state securities laws, though it is unclear if the filing is for the purposes of staking services.

Most recently, the Administrative Law Judge granted a request by Coinbase to continue the matter until November 2026 for reasons on imminent federal legislation.

1. Likely Impact of the Amendments

The amendments, if codified before the resumption of the action, will likely provide a complete defense to the DFPI action. The amendments will allow cryptocurrency exchanges in California to provide staking service without being required to register under state securities laws.

1. Statement from the Author

"As federal regulations continue to evolve, California banks need the tools to responsibly integrate this technology into their existing systems, while ensuring consumers are protected from potential mismanagement of digital assets. 

Blockchain technology is increasingly shaping the future, with new applications emerging across everyday use cases. By providing our state-chartered banks and credit unions, the go-to choice for many residents, a responsible framework for offering this technology, we give our state financial institutions a reputational advantage from the start.”

AB 2285 provides an innovative and modern framework for California banks seeking to offer digital asset services, positioning California to lead in balancing strong consumer protections with continued innovation in the digital asset space."

Argument in Opposition (Oppose Unless Amended)

“Stablecoin rewards are the core issue that Congress has yet to resolve in the pending CLARITY Act. Allowing yield to be paid on stablecoins would pull funds out of insured deposits and that loss of deposits would translate into a reduction in local lending. U.S. Treasury has estimated that up to $6.6 trillion in deposits could be at risk if stablecoin inducements scale. If stablecoin rewards are permitted, some depositors will pull their money out of banks and credit unions and put it on deposits with crypto exchanges. These exchanges do not have a Community Reinvestment Act obligation and do not use deposits to make mortgage, farm, auto and small business loans in communities across California. The second issue is consumer confusion. Stablecoin balances are not FDIC-insured deposits, and firms offering stablecoin rewards are not subject to prudential supervision. Interest-like rewards make stablecoin balances resemble a savings account, which may blur key distinctions for consumers.

Eliminating Section 1 or clarifying language that stablecoin rewards are prohibited (while native staking rewards on actual cryptocurrencies are allowed), would resolve concerns.”- California Bankers Association

REGISTERED SUPPORT / OPPOSITION:

Support

None received. Last certified 6/4/2026.

Opposition

None received. Last certified 6/4/2026.

Analysis Prepared by: Desiree Nguyen Orth / B. & F. / (916) 319-3081

1.  Customers of credit unions are normally referred to as “members”. For purposes of this analysis, the term “customer” will be used to mean both bank customers and credit union members. ↑

2. Digital Asset Market Clarity Act, H.R. 3633, 119 Cong. (2025). https://www.congress.gov/bill/119th-congress/house-bill/3633/text ↑

3. https://dfpi.ca.gov/wp-content/uploads/sites/337/2023/06/Admin.-Action-Coinbase-Global-Inc.-Notice-of-Intent.pdf ↑

4. These arguments are likely provided to prove the “efforts of others” prong of the Howey test. The “efforts of others” requirement is satisfied when “the efforts made by those other than the investor are the undeniably significant ones, those essential managerial efforts which affect the failure or success of the enterprise.” SEC v. Glenn W. Turner Enterprises, Inc., 474 F.2d 476, 482 (9th Cir. 1973). ↑

5. https://www.sec.gov/newsroom/press-releases/2025-47 Last visit 6/4/2026. ↑

Date of Hearing: April 20, 2026

ASSEMBLY COMMITTEE ON BANKING AND FINANCE

Avelino Valencia, Chair

ABPCA Bill Id:AB 2285 (

Author:Valencia) – As Amended Ver:May 22, 2026

SUBJECT: Digital Financial Asset Banking Act

SUMMARY:

This bill would generally regulate a bank or a credit union under the examination authority of the Department of Financial Protection and Innovation (DFPI) with respect to its provision of digital asset custody services, staking services, and digital asset transaction services, as those terms are defined, including by requiring certain disclosures to consumers and requiring certain financial safety measures.

Floor amendments amend the Corporations Code to specify that 1) rewards from staking, including by a staking service provider are not a security within the definition of “security”, and 2) the distribution staking rewards is not subject to registration for the sale of securities.

Specifically, this bill:

1. Provides definitions for “active staking”, “passive staking”, “slashing”, “pooled custody”, “segregated custody”, “fiduciary capacity”, and “non-fiduciary capacity”.
2. Provides requirements, as specified, for fiduciary and non-fiduciary custody of DFA.
3. Provides requirements, as specified, for custodial services including the use of third-party services. 
4. Provides requirements for annual auditing of custodial services by way of independent audit or review and signed attestation of the DI’s Board of Directors.
5. Provides minimum requirements for consumer disclosures.
6. Provides a framework for the payment of fees or commissions for staking services. 
7. Provides anti-money laundering and cybersecurity compliance requirements.
8. Specifies that rewards from staking, including through a staking service provider, are not a security.
9. Provides that distribution staking rewards is not subject to registration for the sale of securities.

EXISTING LAW:

California DFAL:

1. Defines “digital financial asset administration” to mean issuing a digital financial asset with the authority to redeem the digital financial asset for legal tender, bank or credit union credit, or another digital financial asset. Financial Code (Fin.Code) section 3201(h). 
2. Defines “digital financial asset business activity” to mean any of the following:
   1. Exchanging, transferring, or storing a digital financial asset or engaging in digital financial asset administration, whether directly or through an agreement with a digital financial asset control services vendor.
   2. Holding electronic precious metals or electronic certificates representing interests in precious metals on behalf of another person or issuing shares or electronic certificates representing interests in precious metals.
   3. Exchanging one or more digital representations of value used within one or more online games, game platforms, or family of games for either of the following:
      1. A digital financial asset offered by or on behalf of the same publisher from which the original digital representation of value was received.
      2. Legal tender or bank or credit union credit outside the online game, game platform, or family of games offered by or on behalf of the same publisher from which the original digital representation of value was received. Fin.Code section 3102 (i).
3. Requires persons conducting digital financial business activity to obtain a license as a covered person. Fin.Code section 3102. 
4. Before engaging in digital financial asset business activity with a resident, a covered person shall disclose, to the extent applicable to the digital financial asset business activity the covered person will undertake with the resident, all of the following:
   1. A schedule of fees and charges the covered person may assess, the manner by which fees and charges will be calculated if they are not set in advance and disclosed, and the timing of the fees and charges.
   2. Whether the product or service provided by the covered person is covered by either of the following:
      1. A form of insurance or other guarantee against loss by an agency of the United States as follows:
         1. Up to the full United States dollar equivalent of digital financial assets placed under the control of, or purchased from, the covered person as of the date of the placement or purchase, including the maximum amount provided by insurance under the Federal Deposit Insurance Corporation, National Credit Union Share Insurance Fund, or otherwise available from the Securities Investor Protection Corporation.
         2. If not provided at the full United States dollar equivalent of the digital financial asset placed under the control of or purchased from the covered person, the maximum amount of coverage for each resident expressed in the United States dollar equivalent of the digital financial asset.
      2. Private insurance against theft or loss, including cybertheft or theft by other means.
   3. Upon request of a resident with whom a covered person engages in digital financial asset business activity, a covered person shall disclose the terms of the insurance policy to the resident in a manner that allows the resident to understand the specific insured risks that may result in partial coverage of the resident’s assets.
   4. The irrevocability of a transfer or exchange and any exception to irrevocability.
   5. A description of all of the following:
      1. The covered person’s liability for an unauthorized, mistaken, or accidental transfer or exchange.
      2. The resident’s responsibility to provide notice to the covered person of an unauthorized, mistaken, or accidental transfer or exchange.
      3. The basis for any recovery by the resident from the covered person in case of an unauthorized, mistaken, or accidental transfer or exchange.
      4. General error resolution rights applicable to an unauthorized, mistaken, or accidental transfer or exchange.
      5. The method for the resident to update the resident’s contact information with the covered person.
   6. That the date or time when the transfer or exchange is made and the resident’s account is debited may differ from the date or time when the resident initiates the instruction to make the transfer or exchange.
   7. Whether the resident has a right to stop a preauthorized payment or revoke authorization for a transfer and the procedure to initiate a stop-payment order or revoke authorization for a subsequent transfer.
   8. The resident’s right to receive a receipt, trade ticket, or other evidence of the transfer or exchange.
   9. The resident’s right to at least 14 days’ prior notice of a change in the covered person’s fee schedule, other terms and conditions that have a material impact on digital financial asset business activity with the resident, or the policies applicable to the resident’s account.
   10. That no digital financial asset is currently recognized as legal tender by California or the United States.
   11. A list of instances in the past 12 months when the covered person’s service was unavailable to 10,000 or more customers seeking to engage in digital financial asset business activity due to a service outage on the part of the covered person and the causes of each identified service outage.
       1. As part of the disclosure required by this paragraph, the covered person may list any steps the covered person has taken to resolve underlying causes for those outages. Fin.Code section 3501.
5. California Banking and Credit Union
6. California Law regulates, through examination, state chartered banks and credit unions under the authority of the Department of Financial Protection and Innovation (DFPI). Fin.Code section 1000-1901 and Fin.Code section 14000-16906.

FISCAL EFFECT:

The following comment is from the analysis of the Assembly Appropriations Committee provided prior to the floor amendment.

DFPI anticipates minor and absorbable costs to update informational materials to reflect a financial institution’s requirements regarding DFAs, provide additional training for staff, and undergo mandatory rulemaking to create the notice form specified in this bill. DFPI notes that it already has authority under existing law to broadly examine a financial institution. However, it is possible for this bill to result in costs to DFPI in excess of $150,000, to the extent a financial institution’s current DFA practices (or future practices, pursuant to pending federal legislation) do not align with this bill, leading to more complex examinations and enforcement proceedings regarding an evolving technological asset (Financial Protection Fund).

COMMENTS:

1. Background

In May, 2025, the Office of the Comptroller of the Currency (OCC) which oversees nearly 4,000 federal institutions across the country, issued guidance to clarify that national banks and federal savings associations can buy and sell digital financial assets held in custody at its customer’s direction if they follow the practices they use for traditional assets. This clarification also included the permissibility of the use of third-party sub-custodians. Since this guideline was issued, five applications to either newly charter or convert existing institutions into national trust banks that will engage in digital financial asset activity have been conditionally approved. 

State chartered banks and credit unions are regulated by the Department of Financial Protection and Innovation, not the OCC. Despite progress on the Digital Financial Asset Law (DFAL), there is no pathway for banks and credit unions to participate in an emerging and global market. 

1. What this bill does
2. Custody Service and Accuracy

This bill requires a DI to enter a written contract with its customer^[1] with clear disclosures regarding whether or not the relationship is fiduciary or non-fiduciary, If the relationship is non-fiduciary, the agreement must make clear that the DI will only act on the customer’s explicit instructions. In either a fiduciary or non-fiduciary relationship the agreement must clearly disclose whether or not the DFA held in custody by the DI are insured by the Federal Deposit Insurance Corporation, the National Credit Union Administration, or any other federal or state deposit insurance or share insurance program, and Whether or not a DFA held in custody by the DI is a deposit, obligation, or other liability of the DI. This bill requires disclosure of any thresholds or triggering mechanisms that may cause a DI to take action on a customer’s behalf in a fiduciary relationship.  And the bill requires any changes to the agreement to be provided to the customer 45 days before its effective date. 

As to the funds itself, this bill requires at least a one-to-one reserve of each type of digital asset held in passive staking. This is to ensure demand withdrawals can be executed. The bill prohibits the pooling of DFA unless the DI maintains accurate records to identify each customer’s specific interests in the DFA. To ensure compliance, annual independent auditing or review and certification by the entire board of directors is required. 

1. Third party activity and engagement

A DI may use a third party contractor to conduct digital asset custody services, however, use of the subcustodian must be prominently disclosed on the first page of the agreement. The bill puts the onus on the DI to ensure compliance with the requirements of this bill, which include: 1) insurance to protect against breaches or theft, and 2) licensure under DFAL, money transmitters law. The agreement between the DI and the subcustodian must be structured to maintain the DI as the custodial recordholder of the DFA, and that the DFA remains the property of the DI’s customers. 

1. Staking Services and Fiduciary DFA transaction authority 

This bill requires disclosures of the following information regarding staking services: 

1. The fact that the DI may automatically stake an eligible DFA in the customer’s account unless the customer affirmatively opts out of participation.
2. The key risks associated with staking, including the potential for loss of staked assets or staking rewards due to slashing or other network events, and cybersecurity or operational risks inherent in the staking process.
3. Any applicable lockup, unbonding, or notice period before a staked DFA can be withdrawn or transferred and the implications of that period for the customer’s access to the customer’s digital financial assets.
4. The customer’s rights and obligations related to the staking service, including the right to discontinue participation in staking at any time and the entitlement to receive staking rewards earned on the customer’s digital financial assets.
5. The amount or rate of any fee or commission that the DI will deduct from a staking reward as compensation for providing staking services.

AB 2285 requires the DI to identify policies and procedures to protect from, effectively identify, monitor, and manage risks associated with staking, including operational risks, cybersecurity threats, and slashing.

This bill adds specifications to the management of DFA trading activity, whether automated or not. The required specifications speak to transparency and accountability of money, returns, and losses. 

1. Ongoing Considerations

Non-DI digital asset exchanges have raised concerns that these higher standards and practices may become a precedent for their industry, whether in whole or in part. Some potential DI’s have raised concerns with some terms of the bill, specifically regarding: auditing, fee cap rigidity, slashing insurance requirement, 45-day contract amendment notice, and cybersecurity incidents. Stakeholders have also requested to put the state law in parity with the federal law. 

1. Floor Amendments

The following floor amendments have been made to the Corporations Code:

i) Specification that rewards from staking, including by any staking service provider is not a “security” as defined;

ii) An exemption from state securities registration laws for the act of distributing of staking rewards, and

iii) Elimination of the reference to “customer” in the definition of staking rewards in the reference language pertaining to the financial institutions proposed bill language.

• 1. Basic Technical Background

Staking is the act of locking away a portion of currency, like a good-will security deposit, to gain and maintain eligibility to participate in the selection process for securing a proof of stake (PoS) based blockchain network and creating more blocks in exchange for payment. The more currency a validator stakes, the higher their chances of being selected and thus to earn payment. Since the value of the payments fluctuate, and PoS is based on a behavioral incentivization, these payments for services are characterized as “rewards”.  This “skin-in-the-game” model encourages participants to perform accurately–good behavior results in payment, malicious or undesirable behavior results in penalization against the participants personal stake or slashing of the entire amount. Slashing results in prevention from participation and forcible exit.

In broad terms, an overview of the process and requirements for staking are: 1) no less than the minimum amount of currency to stake (the more that is staked the more likely to be selected), 2) the blockchain protocol will select multiple validators as needed, and 3) validators must use specialized hardware and software, as well as stay online 24 hours to perform the validation services for a global market. Going offline for a number of days with regularity results in penalization against the validator’s stake. Validators are rewarded for correctly validating transactions. However, if a validator acts against the network’s interests, a portion or all their staked currency may be forfeited — a process known as slashing.

According to Ethereum, a leading PoS blockchain, slashing has two purposes: (1) to make it prohibitively expensive to attack the network, and (2) to stop validators from being “lazy” by checking that they actually perform their duties. Those who are slashed have acted in a provably destructive manner, and portion of their stake will be destroyed. Slashing also results in validators being prevented from participating in the protocol further and forcibly exited.

Staking is an activity that can be participated in by individuals with resources, both economically and mechanically, or on a pooled basis through a third party. The barrier to entry for staking can be relatively high for two reasons. The first reason can be economical, for example, the minimum amount of ETH required to stake Ethereum is currently 32 ETH or $72,987 USD at the time of this writing. Note, this is only the minimum, the higher the amount staked, the more likely the validator is to be selected and thus to earn more rewards. Third party exchanges offer customers pooled staking using fractional contributions to participate in certain network protocols that would normally be economically out of reach. The second, albeit slighter, barrier to entry, is mechanical; specifical software, hardware and reliably high-speed internet are required.

• 1. CLARITY ACT language from the U.S. Senate Banking Committee^[2]

The following definitions and terms are provided in the most recently released draft of the Congressional Senate Banking Committee:

“Self-custodial Staking with a Third Party” is “the distribution of a unit of a network token, as a programmatic result of validating or staking activity for a distributed ledger system’s consensus mechanism, including the staking of a network token, and the operation of a node, validator, or substantially similar software for such activity in which—‘‘(I) the owner of the staked network token, and operator of the node, validator, or substantially similar software for such activity are different persons or entities; and ‘‘(II) the operator of the node, validator, or substantially similar software does not maintain custody or control of the staked network token.

Essentially, the owner of the staked currency is not the same person as the entity operating the software and providing the hardware required to perform the validation, and the entity does not maintain control of the currency.

“Custodial and Ancillary Staking Services” in general and subject to rulemaking, “the provision of custodial or ancillary staking services enabling the owner of a network token to participate in validating or staking activity for a distributed ledger system’s consensus mechanism that results in the programmatic distribution of a unit of a network token, provided that such custodial or ancillary services are exclusively administrative or ministerial in nature.”

The Act further states that the Commission shall issue rules defining the custodial and ancillary staking services that are exclusively administrative or ministerial in nature, consistent with what is necessary or appropriate for the public interest or for the protection of investors.

1. Litigation History
   1. Agency Actions in 2023

In 2023, the SEC charged Coinbase, Inc. and Coinbase Global, Inc. (hereinafter “Coinbase”) for violating securities law when it offered its customers staking services. The SEC’s complaint alleged that Coinbase: 

“has operated as: an unregistered broker, including by soliciting potential investors, handling customer funds and assets, and charging transaction-based fees; an unregistered exchange, including by providing a market place that, among other things, brings together orders of multiple buyers and sellers of crypto assets and matches and executes those orders; and an unregistered clearing agency, including by holding its customers’ assets in Coinbase-controlled wallets and settling its customers’ transactions by debiting and crediting the relevant accounts.”

California, New Jersey, South Carolina, and Wisconsin took similar steps to halt unregistered third-party staking services against the company. These state regulators looked to the company’s framework wherein users delegate their assets to the platform to act on the user’s behalf in exchange for a share of the reward, which could fall under their securities law.

The California Department of Financial Protection and Innovation initiated an administrative law action by filing a desist and refrain order halting all unregistered staking activities conducted by Coinbase in the state. 

In its order^[3], the DFPI examined claims made on the company’s website, specifically “Earn up to 6.00 APY% on your crypto. Put your crypto to work and earn rewards.” “We’ll help you put your assets to work in the cryptoeconomy so you can grow your crypto holdings with little effort.” And “we take measures to mitigate risks and allow you to opt-out anytime.” 

The order also includes statements of risk mitigation from Coinbase’s public website, specifically, 

“‘the possible slashing of staked assets or rewards. Although it’s unlikely, there is a possibility you could lose your staked assets or rewards in case of a network or validator failure. We’ve taken measures to reduce these risks, but some events are outside our control.’ In the event that crypto assets invested by Coinbase Staking Offerings investors are lost or reduced as the result of “slashing,” Coinbase may, in some circumstances, replace investors’ slashed assets staked in the Coinbase Staking Offering at no additional cost.” 

The order notes that Coinbase has no contractual obligation to retain a like amount of investors’ crypto assets or comparable ones to cover investors’ losses in the event of slashing. The order also lists eight (8) functions and operations conducted by Coinbase in its “sole and absolute discretion” to facilitate the staking of assets for its users.^[4] 

The DFPI reasons that among other things, qualifying an offer and sale of securities is essential for market safety. Compliance with registration ensures that users receive all necessary material information required to assess the risk of an investment. One such disclosure is that Coinbase is not protected by investor- and consumer- protection organizations, such as the Securities Investor Protection Corporation and the Federal Deposit Insurance Corporation. It notes, Coinbase would be permitted to provide staking to its users under its current framework if it registers as a security with the DFPI. 

Coinbase’s position is that it offers staking as a service to its customers as a convenience. On its publicly available website, it states: 

“staking is a way to earn rewards by putting your crypto to work on a blockchain network. In return for helping the network run smoothly and securely, you receive more of the cryptocurrency you're staking. The rewards come from the network itself—your crypto isn't being lent out. It's a safe, simple and popular way to grow your crypto while holding.” 

It claims that since 2023, California users have lost $89 million in potential rewards. Coinbase also claims that it has never been slashed. This is not surprising given that slashing is a disincentivizer that is used for malicious or dishonest behavior. When staking, to a large extent, penalties, or losses, are in the mechanical control of the staker.

• 1. Agency Actions in 2025

In early 2025, the SEC announced the dismissal of its civil enforcement action against Coinbase. In the press release, the SEC stated:

“For the last several years, the Commission’s views on crypto have been largely expressed through enforcement actions without engaging the general public,” said Acting Chairman Mark T. Uyeda. “It’s time for the Commission to rectify its approach and develop crypto policy in a more transparent manner. The Crypto Task Force is designed to do just that.”

The Commission’s decision to exercise its discretion and dismiss this pending enforcement action rests on its judgment that the dismissal will facilitate the Commission’s ongoing efforts to reform and renew its regulatory approach to the crypto industry, not on any assessment of the merits of the claims alleged in the action. Furthermore, as stated in the joint stipulation, ‘the Commission’s decision to seek dismissal of this litigation does not reflect the Commission’s position on any other case.’”^[5]

Since this release, the other states’ cases against Coinbase, except for California, have been dismissed or resolved by codifying staking as a service. Notably, other exchanges are currently providing staking services in California having filed pursuant to state securities laws, though it is unclear if the filing is for the purposes of staking services.

Most recently, the Administrative Law Judge granted a request by Coinbase to continue the matter until November 2026 for reasons on imminent federal legislation.

1. Likely Impact of the Amendments

The amendments, if codified before the resumption of the action, will likely provide a complete defense to the DFPI action. The amendments will allow cryptocurrency exchanges in California to provide staking service without being required to register under state securities laws.

1. Statement from the Author

"As federal regulations continue to evolve, California banks need the tools to responsibly integrate this technology into their existing systems, while ensuring consumers are protected from potential mismanagement of digital assets. 

Blockchain technology is increasingly shaping the future, with new applications emerging across everyday use cases. By providing our state-chartered banks and credit unions, the go-to choice for many residents, a responsible framework for offering this technology, we give our state financial institutions a reputational advantage from the start.”

AB 2285 provides an innovative and modern framework for California banks seeking to offer digital asset services, positioning California to lead in balancing strong consumer protections with continued innovation in the digital asset space."

Argument in Opposition (Oppose Unless Amended)

“Stablecoin rewards are the core issue that Congress has yet to resolve in the pending CLARITY Act. Allowing yield to be paid on stablecoins would pull funds out of insured deposits and that loss of deposits would translate into a reduction in local lending. U.S. Treasury has estimated that up to $6.6 trillion in deposits could be at risk if stablecoin inducements scale. If stablecoin rewards are permitted, some depositors will pull their money out of banks and credit unions and put it on deposits with crypto exchanges. These exchanges do not have a Community Reinvestment Act obligation and do not use deposits to make mortgage, farm, auto and small business loans in communities across California. The second issue is consumer confusion. Stablecoin balances are not FDIC-insured deposits, and firms offering stablecoin rewards are not subject to prudential supervision. Interest-like rewards make stablecoin balances resemble a savings account, which may blur key distinctions for consumers.

Eliminating Section 1 or clarifying language that stablecoin rewards are prohibited (while native staking rewards on actual cryptocurrencies are allowed), would resolve concerns.”- California Bankers Association

REGISTERED SUPPORT / OPPOSITION:

Support

None received. Last certified 6/4/2026.

Opposition

None received. Last certified 6/4/2026.

Analysis Prepared by: Desiree Nguyen Orth / B. & F. / (916) 319-3081

1.  Customers of credit unions are normally referred to as “members”. For purposes of this analysis, the term “customer” will be used to mean both bank customers and credit union members. ↑

2. Digital Asset Market Clarity Act, H.R. 3633, 119 Cong. (2025). https://www.congress.gov/bill/119th-congress/house-bill/3633/text ↑

3. https://dfpi.ca.gov/wp-content/uploads/sites/337/2023/06/Admin.-Action-Coinbase-Global-Inc.-Notice-of-Intent.pdf ↑

4. These arguments are likely provided to prove the “efforts of others” prong of the Howey test. The “efforts of others” requirement is satisfied when “the efforts made by those other than the investor are the undeniably significant ones, those essential managerial efforts which affect the failure or success of the enterprise.” SEC v. Glenn W. Turner Enterprises, Inc., 474 F.2d 476, 482 (9th Cir. 1973). ↑

5. https://www.sec.gov/newsroom/press-releases/2025-47 Last visit 6/4/2026. ↑

ASSEMBLY THIRD READING

ATR Bill Id:AB 2285

Author:(Valencia)

As Amended Ver:May 22, 2026

Majority vote

SUMMARY

This bill would generally regulate a bank or a credit union under the examination authority of the Department of Financial Protection and Innovation (DFPI) with respect to its provision of digital asset custody services, staking services, and digital asset transaction services, as those terms are defined, including by requiring certain disclosures to consumers and requiring certain financial safety measures.

Floor amendments amend the Corporations Code to specify that rewards from staking are not a security within the definition of ″security″.

Major Provisions

For a detailed list of major provisions, please see the Banking and Finance Committee analysis.

1. Provides definitions for ″active staking″, ″passive staking″, ″slashing″, ″pooled custody″, ″segregated custody″, ″fiduciary capacity″, and ″non-fiduciary capacity″.
2. Provides requirements, as specified, for fiduciary and non-fiduciary custody of DFA.
3. Provides requirements, as specified, for custodial services including the use of third-party services.
4. Provides requirements for annual auditing of custodial services by way of independent audit or review and signed attestation of the DI′s Board of Directors.
5. Provides minimum requirements for consumer disclosures.
6. Provides a framework for the payment of fees or commissions for staking services. 
7. Provides anti-money laundering and cybersecurity compliance requirements.
8. Specifies that rewards from staking are not a security.

COMMENTS

1. Background

In May, 2025, the Office of the Comptroller of the Currency (OCC) which oversees nearly 4,000 federal institutions across the country, issued guidance to clarify that national banks and federal savings associations can buy and sell digital financial assets held in custody at its customer′s direction if they follow the practices they use for traditional assets. This clarification also included the permissibility of the use of third-party sub-custodians. Since this guideline was issued, five applications to either newly charter or convert existing institutions into national trust banks that will engage in digital financial asset activity have been conditionally approved. 

On July 30, 2025, JP Morgan Chase issued an announcement regarding its partnership with Coinbase to offer seamless bank to exchange access. ″We′re excited to partner with JPMorganChase to onboard the next generation of consumers into crypto. Together, we are expanding choice and lowering barriers to entry for consumers to participate in the future of financial services onchain,″ said Max Branzburg, Head of Consumer & Business Products at Coinbase. 

As of August, 2025, more than half of the 25 largest banks in the United States are now either considering or actively rolling out crypto-related products.^[1] Digital financial assets (DFA) afford financial institutions the opportunity to establish novel revenue streams and expand market presence by facilitating cryptocurrency access without geographical constraints. Institutions integrating digital asset services can have significant advantages in financial inclusion and benefit from the enhanced transaction speed, settlement finality, and automation inherent in smart contracts. Additionally, the adoption of blockchain technology promotes heightened security and substantial operational efficiencies within the existing financial framework.

State chartered banks and credit unions are regulated by the Department of Financial Protection and Innovation, not the OCC. Despite progress on the Digital Financial Asset Law (DFAL), there is no pathway for banks and credit unions to participate in an emerging and global market. 

1. What this bill does
2. Custody Service and Accuracy

This bill requires a DI to enter a written contract with its customer^[2] with clear disclosures regarding whether or not the relationship is fiduciary or non-fiduciary, If the relationship is non-fiduciary, the agreement must make clear that the DI will only act on the customer′s explicit instructions. In either a fiduciary or non-fiduciary relationship the agreement must clearly disclose whether or not the DFA held in custody by the DI are insured by the Federal Deposit Insurance Corporation, the National Credit Union Administration, or any other federal or state deposit insurance or share insurance program, and Whether or not a DFA held in custody by the DI is a deposit, obligation, or other liability of the DI. This bill requires disclosure of any thresholds or triggering mechanisms that may cause a DI to take action on a customer′s behalf in a fiduciary relationship.  And the bill requires any changes to the agreement to be provided to the customer 45 days before its effective date.

As to the funds itself, this bill requires at least a one-to-one reserve of each type of digital asset held in passive staking. This is to ensure demand withdrawals can be executed. The bill prohibits the pooling of DFA unless the DI maintains accurate records to identify each customer′s specific interests in the DFA. To ensure compliance, annual independent auditing or review and certification by the entire board of directors is required.

1. Third party activity and engagement

A DI may use a third party contractor to conduct digital asset custody services, however, use of the subcustodian must be prominently disclosed on the first page of the agreement. The bill puts the onus on the DI to ensure compliance with the requirements of this bill, which include: 1) insurance to protect against breaches or theft, and =2) licensure under DFAl, money transmitters law. The agreement between the DI and the subcustodian must be structured to maintain the DI as the custodial recordholder of the DFA, and that the DFA remains the property of the DI′s customers.

1. Staking Services and Fiduciary DFA transaction authority

This bill requires disclosures of the following information regarding staking services: 

1. The fact that the DI may automatically stake an eligible DFA in the customer′s account unless the customer affirmatively opts out of participation.
2. The key risks associated with staking, including the potential for loss of staked assets or staking rewards due to slashing or other network events, and cybersecurity or operational risks inherent in the staking process.
3. Any applicable lockup, unbonding, or notice period before a staked DFA can be withdrawn or transferred and the implications of that period for the customer′s access to the customer′s digital financial assets.
4. The customer′s rights and obligations related to the staking service, including the right to discontinue participation in staking at any time and the entitlement to receive staking rewards earned on the customer′s digital financial assets.
5. The amount or rate of any fee or commission that the DI will deduct from a staking reward as compensation for providing staking services.

AB 2285 requires the DI to identify policies and procedures to protect from, effectively identify, monitor, and manage risks associated with staking, including operational risks, cybersecurity threats, and slashing.

This bill adds specifications to the management of DFA trading activity, whether automated or not. The required specifications speak to transparency and accountability of money, returns, and losses. 

1. Ongoing Considerations

Non-DI digital asset exchanges have raised concerns that these higher standards and practices may become a precedent for their industry, whether in whole or in part. Some potential DI′s have raised concerns with some terms of the bill, specifically regarding: auditing, fee cap rigidity, slashing insurance requirement, 45-day contract amendment notice, and cybersecurity incidents. Stakeholders have also requested to put the state law in parity with the federal law. 

This bill comes at a time when it appears that federal DFA regulation is on the precipice of passage. Congress has been at an impasse on the CLARITY Act, a bill aimed at establishing a comprehensive regulatory framework for digital assets, dividing oversight between the Securities and Exchange Commission, (SEC) and the Commodity Futures Trading Commission (CFTC). An update on the closely followed bill was recently released,^[3] noting that negotiations on the recently released Senate redlines to the CLARITY Act are fluid. These issues include anti-money laundering requirements, elected officials and ethics, and whether platforms should be able to issue yield-like rewards on fiat-backed digital assets (stablecoin) to users. Banks contend that allowing yield will cause deposits to move from insured bank accounts to less regulated stablecoins, threatening traditional lending capacity. 

The author has agreed to continue dialogue with stakeholders as the CLARITY Act moves through the Senate in Congress. The floor amendment to add specifications that rewards from staking are not a security as defined come after a recent draft of the U.S. Senate Banking CLARITY bill was released and provided for states to manage staking terms. While the full act is still not settled, this amendment aligns with the narrow finding of the SEC′s comments on pooled custodial staking and how it does not meet the criteria for an investment contract under the Howey test.

According to the Author

″As federal regulations continue to evolve, California banks need the tools to responsibly integrate this technology into their existing systems, while ensuring consumers are protected from potential mismanagement of digital assets. 

Blockchain technology is increasingly shaping the future, with new applications emerging across everyday use cases. By providing our state-chartered banks and credit unions, the go-to choice for many residents, a responsible framework for offering this technology, we give our state financial institutions a reputational advantage from the start.″

AB 2285 provides an innovative and modern framework for California banks seeking to offer digital asset services, positioning California to lead in balancing strong consumer protections with continued innovation in the digital asset space.″

Arguments in Support

None received. Last certified 5/12/26.

Arguments in Opposition

None received. Last certified 5/12/26.

FISCAL COMMENTS

The following comment is from the analysis of the Assembly Appropriations Committee.

DFPI anticipates minor and absorbable costs to update informational materials to reflect a financial institution′s requirements regarding DFAs, provide additional training for staff, and undergo mandatory rulemaking to create the notice form specified in this bill. DFPI notes that it already has authority under existing law to broadly examine a financial institution. However, it is possible for this bill to result in costs to DFPI in excess of $150,000, to the extent a financial institution′s current DFA practices (or future practices, pursuant to pending federal legislation) do not align with this bill, leading to more complex examinations and enforcement proceedings regarding an evolving technological asset (Financial Protection Fund).

VOTES

ASM BANKING AND FINANCE: 9-0-0

YES: Valencia, Chen, Dixon, Fong, Krell, Michelle Rodriguez, Blanca Rubio, Schiavo, Soria

ASM PRIVACY AND CONSUMER PROTECTION: 15-0-0

YES: Bauer-Kahan, Macedo, Bryan, DeMaio, Hoover, Irwin, Lowenthal, McKinnor, Ortega, Patterson, Pellerin, Petrie-Norris, Ward, Wicks, Wilson

ASM APPROPRIATIONS: 15-0-0

YES: Wicks, Hoover, Aguiar-Curry, Calderon, Caloza, Dixon, Fong, Mark González, Krell, Pacheco, Pellerin, Sharp-Collins, Solache, Ta, Tangipa

UPDATED

VERSION: May 22, 2026

CONSULTANT: Desiree Nguyen Orth / B. & F. / (916) 319-3081 FN: 0003132

1. “The Majority of the US’s Largest Banks Have Embraced Crypto Services”, Bank Exchange (2025, August, 11) ↑

2.  Customers of credit unions are normally referred to as “members”. For purposes of this analysis, the term “customer” will be used to mean both bank customers and credit union members. ↑

3. https://www.reuters.com/legal/transactional/us-senate-committee-weigh-crypto-billmilestone-digital-assets-2026-05-14/ Last visited 5/14/2026 ↑

ASSEMBLY THIRD READING

ATR Bill Id:AB 2285

Author:(Valencia)

As Amended Ver:March 16, 2026

Majority vote

SUMMARY

This bill would generally regulate a bank or a credit union under the examination authority of the Department of Financial Protection and Innovation (DFPI) with respect to its provision of digital asset custody services, staking services, and digital asset transaction services, as those terms are defined, including by requiring certain disclosures to consumers and requiring certain financial safety measures.

Major Provisions

For a detailed list of major provisions, please see the Banking and Finance Committee analysis.

1. Provides definitions for "active staking", "passive staking", "slashing", "pooled custody", "segregated custody", "fiduciary capacity", and "non-fiduciary capacity".
2. Provides requirements, as specified, for fiduciary and non-fiduciary custody of DFA.
3. Provides requirements, as specified, for custodial services including the use of third-party services. 
4. Provides requirements for annual auditing of custodial services by way of independent audit or review and signed attestation of the DI's Board of Directors.
5. Provides minimum requirements for consumer disclosures.
6. Provides a framework for the payment of fees or commissions for staking services. 
7. Provides anti-money laundering and cybersecurity compliance requirements.

COMMENTS

1. Background

In May, 2025, the Office of the Comptroller of the Currency (OCC) which oversees nearly 4,000 federal institutions across the country, issued guidance to clarify that national banks and federal savings associations can buy and sell digital financial assets held in custody at its customer’s direction if they follow the practices they use for traditional assets. This clarification also included the permissibility of the use of third-party sub-custodians. Since this guideline was issued, five applications to either newly charter or convert existing institutions into national trust banks that will engage in digital financial asset activity have been conditionally approved. 

On July 30, 2025, JP Morgan Chase issued an announcement regarding its partnership with Coinbase to offer seamless bank to exchange access. "We’re excited to partner with JPMorganChase to onboard the next generation of consumers into crypto. Together, we are expanding choice and lowering barriers to entry for consumers to participate in the future of financial services onchain," said Max Branzburg, Head of Consumer & Business Products at Coinbase. 

As of August, 2025, more than half of the 25 largest banks in the United States are now either considering or actively rolling out crypto-related products.^[1] Digital financial assets (DFA) afford financial institutions the opportunity to establish novel revenue streams and expand market presence by facilitating cryptocurrency access without geographical constraints. Institutions integrating digital asset services can have significant advantages in financial inclusion and benefit from the enhanced transaction speed, settlement finality, and automation inherent in smart contracts. Additionally, the adoption of blockchain technology promotes heightened security and substantial operational efficiencies within the existing financial framework.

State chartered banks and credit unions are regulated by the Department of Financial Protection and Innovation, not the OCC. Despite progress on the Digital Financial Asset Law (DFAL), there is no pathway for banks and credit unions to participate in an emerging and global market. 

1. What this bill does:
2. Custody Service and Accuracy

This bill requires a DI to enter a written contract with its customer^[2] with clear disclosures regarding whether or not the relationship is fiduciary or non-fiduciary, If the relationship is non-fiduciary, the agreement must make clear that the DI will only act on the customer’s explicit instructions. In either a fiduciary or non-fiduciary relationship the agreement must clearly disclose whether or not the DFA held in custody by the DI are insured by the Federal Deposit Insurance Corporation, the National Credit Union Administration, or any other federal or state deposit insurance or share insurance program, and Whether or not a DFA held in custody by the DI is a deposit, obligation, or other liability of the DI. This bill requires disclosure of any thresholds or triggering mechanisms that may cause a DI to take action on a customer’s behalf in a fiduciary relationship.  And the bill requires any changes to the agreement to be provided to the customer 45 days before its effective date. 

As to the funds itself, this bill requires at least a one-to-one reserve of each type of digital asset held in passive staking. This is to ensure demand withdrawals can be executed. The bill prohibits the pooling of DFA unless the DI maintains accurate records to identify each customer’s specific interests in the DFA. To ensure compliance, annual independent auditing or review and certification by the entire board of directors is required. 

1. Third party activity and engagement

A DI may use a third party contractor to conduct digital asset custody services, however, use of the subcustodian must be prominently disclosed on the first page of the agreement. The bill puts the onus on the DI to ensure compliance with the requirements of this bill, which include: 1) insurance to protect against breaches or theft, and 2) licensure under DFAl, money transmitters law. The agreement between the DI and the subcustodian must be structured to maintain the DI as the custodial recordholder of the DFA, and that the DFA remains the property of the DI’s customers. 

1. Staking Services and Fiduciary DFA transaction authority 

This bill requires disclosures of the following information regarding staking services: 

1. The fact that the DI may automatically stake an eligible DFA in the customer’s account unless the customer affirmatively opts out of participation.
2. The key risks associated with staking, including the potential for loss of staked assets or staking rewards due to slashing or other network events, and cybersecurity or operational risks inherent in the staking process.
3. Any applicable lockup, unbonding, or notice period before a staked DFA can be withdrawn or transferred and the implications of that period for the customer’s access to the customer’s digital financial assets.
4. The customer's rights and obligations related to the staking service, including the right to discontinue participation in staking at any time and the entitlement to receive staking rewards earned on the customer's digital financial assets.
5. The amount or rate of any fee or commission that the DI will deduct from a staking reward as compensation for providing staking services.

AB 2285 requires the DI to identify policies and procedures to protect from, effectively identify, monitor, and manage risks associated with staking, including operational risks, cybersecurity threats, and slashing.

This bill adds specifications to the management of DFA trading activity, whether automated or not. The required specifications speak to transparency and accountability of money, returns, and losses. 

1. Ongoing Considerations

Non-DI digital asset exchanges have raised concerns that these higher standards and practices may become a precedent for their industry, whether in whole or in part. Some potential DI's have raised concerns with some terms of the bill, specifically regarding: auditing, fee cap rigidity, slashing insurance requirement, 45-day contract amendment notice, and cybersecurity incidents. Stakeholders have also requested to put the state law in parity with the federal law. 

This bill comes at a time when it appears that federal DFA regulation is on the precipice of passage. Congress has been at an impasse on the CLARITY Act, a bill aimed at establishing a comprehensive regulatory framework for digital assets, dividing oversight between the Securities and Exchange Commission, (SEC) and the Commodity Futures Trading Commission (CFTC). An update on the closely followed bill was recently released,^[3] noting that negotiations on the recently released Senate redlines to the CLARITY Act are fluid. These issues include anti-money laundering requirements, elected officials and ethics, and whether platforms should be able to issue yield-like rewards on fiat-backed digital assets (stablecoin) to users. Banks contend that allowing yield will cause deposits to move from insured bank accounts to less regulated stablecoins, threatening traditional lending capacity. 

The author has agreed to continue dialogue with stakeholders as the CLARITY Act moves through the Senate in Congress.

According to the Author

"As federal regulations continue to evolve, California banks need the tools to responsibly integrate this technology into their existing systems, while ensuring consumers are protected from potential mismanagement of digital assets. 

Blockchain technology is increasingly shaping the future, with new applications emerging across everyday use cases. By providing our state-chartered banks and credit unions, the go-to choice for many residents, a responsible framework for offering this technology, we give our state financial institutions a reputational advantage from the start."

AB 2285 provides an innovative and modern framework for California banks seeking to offer digital asset services, positioning California to lead in balancing strong consumer protections with continued innovation in the digital asset space."

Arguments in Support

None received. Last certified 5/12/26.

Arguments in Opposition

None received. Last certified 5/12/26.

FISCAL COMMENTS

The following comment is from the analysis of the Assembly Appropriations Committee.

DFPI anticipates minor and absorbable costs to update informational materials to reflect a financial institution's requirements regarding DFAs, provide additional training for staff, and undergo mandatory rulemaking to create the notice form specified in this bill. DFPI notes that it already has authority under existing law to broadly examine a financial institution. However, it is possible for this bill to result in costs to DFPI in excess of $150,000, to the extent a financial institution's current DFA practices (or future practices, pursuant to pending federal legislation) do not align with this bill, leading to more complex examinations and enforcement proceedings regarding an evolving technological asset (Financial Protection Fund).

VOTES

ASM BANKING AND FINANCE: 9-0-0

YES: Valencia, Chen, Dixon, Fong, Krell, Michelle Rodriguez, Blanca Rubio, Schiavo, Soria

ASM PRIVACY AND CONSUMER PROTECTION: 15-0-0

YES: Bauer-Kahan, Macedo, Bryan, DeMaio, Hoover, Irwin, Lowenthal, McKinnor, Ortega, Patterson, Pellerin, Petrie-Norris, Ward, Wicks, Wilson

ASM APPROPRIATIONS: 15-0-0

YES: Wicks, Hoover, Aguiar-Curry, Calderon, Caloza, Dixon, Fong, Mark González, Krell, Pacheco, Pellerin, Sharp-Collins, Solache, Ta, Tangipa

UPDATED

VERSION: March 16, 2026

CONSULTANT: Desiree Nguyen Orth / B. & F. / (916) 319-3081 FN: 0002792

1. “The Majority of the US’s Largest Banks Have Embraced Crypto Services”, Bank Exchange (2025, August, 11) ↑

2.  Customers of credit unions are normally referred to as “members”. For purposes of this analysis, the term “customer” will be used to mean both bank customers and credit union members. ↑

3. https://www.reuters.com/legal/transactional/us-senate-committee-weigh-crypto-bill-milestone-digital-assets-2026-05-14/ Last visited 5/14/2026 ↑

Date of Hearing: May 6, 2026

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Buffy Wicks, Chair

ABPCA Bill Id:AB 2285

Author:(Valencia) – As Amended Ver:March 16, 2026

Urgency: No State Mandated Local Program: Yes Reimbursable: No

SUMMARY:

This bill enacts the Digital Financial Asset (DFA) Banking Act.

Specifically, this bill:

1. Regulates a bank or credit union under the examination authority of the Department of Financial Protection and Innovation (DFPI) with respect to the financial institution’s provision of digital asset custody services, staking services, and digital asset transaction services, including requiring certain disclosures to customers and financial safety measures.
2. Requires a financial institution engaged in DFA custody services to conduct an annual audit of custodial activities and holdings.
3. Requires a financial institution to establish and maintain an anti-money laundering compliance program and cybersecurity program in relation to the financial institution’s digital asset custody and staking services and requires a financial institution to notify DFPI within 72 hours of discovering a material cybersecurity incident.
4. Authorizes DFPI to enforce these regulations with administrative and civil remedies, including issuing a written order directing a financial institution to take specific corrective action to remedy a violation, issuing a cease and desist order, imposing civil penalties of up to $10,000 per violation, and suspension or revocation of authority.

FISCAL EFFECT:

DFPI anticipates minor and absorbable costs to update informational materials to reflect a financial institution’s requirements regarding DFAs, provide additional training for staff, and undergo mandatory rulemaking to create the notice form specified in this bill. DFPI notes that it already has authority under existing law to broadly examine a financial institution. However, it is possible for this bill to result in costs to DFPI in excess of $150,000, to the extent a financial institution’s current DFA practices (or future practices, pursuant to pending federal legislation) do not align with this bill, leading to more complex examinations and enforcement proceedings regarding an evolving technological asset (Financial Protection Fund).

COMMENTS:

1. Purpose. According to the author:

Blockchain technology is increasingly shaping the future, with new applications emerging across everyday use cases. By providing our state-chartered banks and credit unions, the go-to choice for many residents, a responsible framework for offering this technology, we give our state financial institutions a reputational advantage from the start.

1. Background. DFA Regulation in California. A DFA, also referred to as “cryptocurrency” or “crypto,” is a digital representation of value that is not issued or backed by a government or central bank. AB 39 (Grayson), Chapter 792, Statutes of 2023, established a licensing program for DFA companies serving California customers. Under the Digital Financial Assets Law (DFAL), companies must apply for licensure by July 1, 2026, and adhere to new regulations governing operating procedures, customer service standards, and financial stability. DFA-related activity by certain entities are exempt from DFAL, including most banks and credit unions separately regulated by DFPI.

Federal Guidance. In May 2025, the Office of the Comptroller of the Currency, which oversees nearly 4,000 federal institutions across the country, issued guidance to clarify that national banks and federal savings associations can buy and sell DFAs held in custody at the customer’s direction, if the financial institution follows the practices used for traditional assets. As of August 2025, more than half of the 25 largest banks in the U.S. are considering or actively offering DFA products.

This bill regulates the provision of digital asset custody services, staking services, and digital asset transaction services by a bank or credit union under DFPI authority. As noted in the Assembly Banking and Finance Committee’s analysis of this bill:

Stakeholders have also requested to put the state law in parity with the federal law.

This bill comes at a time when it appears that federal DFA regulation is on the precipice of passage. Congress has been at an impasse on the CLARITY Act, a bill aimed at establishing a comprehensive regulatory framework for digital assets, dividing oversight between the Securities and Exchange Commission (SEC) and the Commodity Futures Trading Commission (CFTC)…The author has agreed to continue dialogue with stakeholders as the CLARITY Act moves through the Senate in Congress.

1. Letter of Concern. There is no registered support or opposition on file for this bill. However, California’s Credit Unions, California Bankers Association, and California Community Banking Network collectively write, “While we support moving AB 2285 to the second house, final enactment without deliberate harmonization risks creating a “patchwork” of duplicative, conflicting, or preempted requirements that could disadvantage California state-chartered institutions.”

Analysis Prepared by: Irene Ho / APPR. / (916) 319-2081

Date of Hearing: April 21, 2026

Fiscal: Yes

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Rebecca Bauer-Kahan, Chair

ABPCA Bill Id:AB 2285 (

Author:Valencia) – As Amended Ver:March 16, 2026

SUBJECT: Digital Financial Asset Banking Act

SYNOPSIS

The rapid growth of digital assets like cryptocurrencies has outpaced existing financial regulations, leaving gaps in how banks safeguard customer assets, manage risks, and disclose key information. As traditional financial institutions begin offering digital asset services, a clear regulatory framework is needed to ensure consistent standards, accountability, and trust in these emerging markets.

This bill would establish a comprehensive regulatory framework governing how banks and credit unions in California can custody, manage, and transact in digital financial assets on behalf of customers. A coalition composed of California’s Credit Unions, the California Bankers Association, and the California Community Banking Network take a “support in concept” position on the bill, mostly wishing to see the bill’s requirements align with existing state and federal law. The bill has no formal opposition.

This committee’s jurisdiction is limited to the cybersecurity provisions of this bill. The bill will be heard by the Banking and Finance Committee one day before it is heard by this committee.

EXISTING LAW:

1. Defines “digital financial asset administration” to mean issuing a digital financial asset with the authority to redeem the digital financial asset for legal tender, bank or credit union credit, or another digital financial asset. (Fin. Code § 3201(h).)
2. Defines “digital financial asset business activity” to mean any of the following:
   1. Exchanging, transferring, or storing a digital financial asset or engaging in digital financial asset administration, whether directly or through an agreement with a digital financial asset control services vendor.
   2. Holding electronic precious metals or electronic certificates representing interests in precious metals on behalf of another person or issuing shares or electronic certificates representing interests in precious metals.
   3. Exchanging one or more digital representations of value used within one or more online games, game platforms, or family of games for either of the following:
      1. A digital financial asset offered by or on behalf of the same publisher from which the original digital representation of value was received.
      2. Legal tender or bank or credit union credit outside the online game, game platform, or family of games offered by or on behalf of the same publisher from which the original digital representation of value was received. (Fin. Code § 3102(i).)
3. Requires a person conducting digital financial business activity to obtain a license as a covered person. (Fin. Code § 3102.)
4. Requires a covered person to disclose specified business activity the covered person will undertake with a resident before engaging in digital financial asset business activity with the resident. (Fin. Code § 3501.)

THIS BILL:

1. Defines the following terms:
   1. “Active staking” means intentional participation in staking services resulting in inaccessibility to one’s digital financial asset for an agreed-upon time in exchange for a staking reward minus a fee that is in a fixed amount or a percentage of the staking reward.
   2. “Customer” means a person for whom a financial institution provides digital asset services, including a digital asset account holder or a person on whose behalf the financial institution acts in a fiduciary capacity.
   3. “Department” means the Department of Financial Protection and Innovation.
   4. “Digital asset” means a digital representation of value recorded on a cryptographically secured, distributed ledger or similar technology, including, but not limited to, a digital financial asset.
   5. “Digital asset custody services” means the safekeeping or custody of a digital financial asset on behalf of a customer by a financial institution, including maintaining control over the digital financial asset and any associated key.
   6. “Digital asset transaction services” means to facilitate the execution of a digital asset purchase or sale on behalf of a customer for compensation.
   7. “Digital financial asset” means a digital representation of value that is used as a medium of exchange, unit of account, or store of value, and that is not legal tender, whether or not denominated in legal tender.
   8. “Digital financial asset business activity” means any of the following:
      
      1. Exchanging, transferring, or storing a digital financial asset or engaging in digital financial asset administration, whether directly or through an agreement with a digital financial asset control services vendor.
         
      2. Holding electronic precious metals or electronic certificates representing interests in precious metals on behalf of another person or issuing shares or electronic certificates representing interests in precious metals.
         
      3. Exchanging one or more digital representations of value used within one or more online games, game platforms, or family of games for either of the following:
         
         1. A digital financial asset offered by, or on behalf of, the same publisher from which the original digital representation of value was received.
            
         2. Legal tender or bank or credit union credit outside of the online game, game platform, or family of games offered by, or on behalf of, the same publisher from which the original digital representation of value was received.
            
   9. “Digital wallet” means a digital interface or physical device that stores a digital asset or a private key in a manner that enables the owner to securely manage, transfer, and maintain independent control over the owner’s digital asset.
      
   10. “Fiduciary capacity” means a capacity in which a financial institution possesses investment, management, or administration discretion of a digital financial asset on behalf of a customer that creates for the financial institution a strict duty to act in the best financial interest of the customer, including against its own interest.
       
   11. “Financial institution” means a bank or credit union operating under the examination authority of the Department of Financial Protection and Innovation (DFPI).
       
   12. “Key” means a pair of cryptographic codes associated with a digital asset wallet that consists of a public key and a private key that meets both of the following criteria:
       
       1. The public key of the pair enables the receipt of a digital financial asset and the verification of a digital signature.
          
       2. The private key of the pair enables the control, transfer, or management of a digital asset within the digital asset wallet.
          
   13. “Material cybersecurity incident” means a cybersecurity breach or event that materially compromises the security, confidentiality, or integrity of a financial institution’s information system or a digital asset under the financial institution’s control.
       
   14. “Nonfiduciary capacity” means providing digital asset custody services solely for safekeeping without discretionary authority to manage or transfer a digital financial asset and with respect to which legal title and control of the assets remain with the customer.
       
   15. “Passive staking” means staking pooled assets by, or on behalf of, the financial institution wherein the customer may receive the customer’s digital financial asset upon demand in exchange for a staking reward minus an agreed-upon fee, in a fixed amount or a percentage of the staking reward, from the financial institution staking service provider.
       
   16. “Pooled custody” means the collective holding of fungible digital financial assets of like kind belonging to different customers in a shared account or digital asset wallet.
       
   17. “Segregated custody” means the holding separately from the digital financial assets of other customers of the fungible digital financial assets of an individual customer in an account or digital asset wallet.
   18. “Slashing” means a penalty imposed by a blockchain protocol that results in the forfeiture or reduction of staked digital assets or staking rewards due to validator misconduct or failure.
   19. “Staking” means committing fungible digital financial assets to a blockchain network to participate in the network’s operations by validating transactions, proposing and attesting to blocks, and securing the network.
   20. “Staking reward” means any interest, yield, or other compensation earned by a customer from staking a digital financial asset on a blockchain network.
   21. “Subcustodian” means a third party that a financial institution uses to hold a digital financial asset on the financial institution’s behalf as part of providing digital asset custody services to a customer.
2. Permits state-chartered financial institutions to offer digital financial asset (DFA) retail services under specified requirements.
3. Requires annual auditing of custodial services by way of independent audit or review and signed attestation of the DI’s Board of Directors.
4. Requires consumer disclosures, as specified.
5. Provides a framework for the payment of fees or commissions for staking services. 
6. Requires financial institutions adopt anti-money laundering measures, as specified.
7. Requires a financial institution and any of its subcustodians to maintain a cybersecurity program designed to protect the confidentiality, integrity, and availability of the financial institution’s information systems, digital asset custody, and staking software and hardware that is based on the financial institution’s risk assessment and designed to perform all of the following functions:
   1. Identifying and assessing internal and external cybersecurity risks that threaten the security or integrity of nonpublic information stored on the financial institution’s information systems as it relates to the digital financial assets of its customers.
   2. Using defensive infrastructure and the implementation of policies and procedures to protect the financial institution’s information systems, and the nonpublic information stored on those information systems, from unauthorized access, use, or other malicious acts.
   3. Detecting cybersecurity events.
   4. Responding to identified or detected cybersecurity events to mitigate any negative effects.
   5. Recovering from cybersecurity events and restoring normal operations and services.
   6. Fulfilling applicable regulatory reporting obligations.
8. Requires that any information relevant to the financial institution’s cybersecurity program, including the relevant and applicable provisions of a cybersecurity program maintained by any subcustodian, be made available to the department upon request.
9. Requires that the cybersecurity program for a financial institution and any of its subcustodians align with applicable federal cybersecurity standards for financial institutions, including, but not limited to, the guidelines of the Federal Financial Institutions Examination Council (FFIEC) Information Technology Examination Handbook, the framework established by the National Institute of Standards and Technology (NIST), and any other standard deemed applicable by the department and shall comply with applicable federal financial privacy and data security requirements, as determined by the department.
10. Requires a financial institution to notify the department within 72 hours after discovering any material cybersecurity incident that impacts the financial institution or its subcustodian’s digital asset custody or staking software or hardware or any digital financial asset held or managed through those systems. Requires the notice to include a description of the incident and its likely impact on the financial institution and its customers, as prescribed by the department.
11. Requires a financial institution to maintain, for at least seven years, detailed records of its cybersecurity compliance efforts, including any policy, procedure, risk assessment, audit report, or training material related to its cybersecurity program. Requires the financial institution to make those records available for inspection by the department upon request or during any examination.

COMMENTS:

1. Author’s statement. According to the author:

As federal regulations continue to evolve, California banks need the tools to responsibly integrate this technology into their existing systems, while ensuring consumers are protected from potential mismanagement of digital assets.

Blockchain technology is increasingly shaping the future, with new applications emerging across everyday use cases. By providing our state-chartered banks and credit unions, the go-to choice for many residents, a responsible framework for offering this technology, we give our state financial institutions a reputational advantage from the start.”

AB 2285 provides an innovative and modern framework for California banks seeking to offer digital asset services, positioning California to lead in balancing strong consumer protections with continued innovation in the digital asset space

1. Background. The Assembly Banking and Finance Committee explains recent developments related to financial institutions managing digital financial assets in their bill analysis:

In May, 2025, the Office of the Comptroller of the Currency (OCC) which oversees nearly 4,000 federal institutions across the country, issued guidance to clarify that national banks and federal savings associations can buy and sell digital financial assets held in custody at its customer’s direction if they follow the practices they use for traditional assets. This clarification also included the permissibility of the use of third-party sub-custodians. Since this guideline was issued, five applications to either newly charter or convert existing institutions into national trust banks that will engage in digital financial asset activity have been conditionally approved.

On July 30, 2025, JP Morgan Chase issued an announcement regarding its partnership with Coinbase to offer seamless bank to exchange access. “We’re excited to partner with JP Morgan Chase to onboard the next generation of consumers into crypto. Together, we are expanding choice and lowering barriers to entry for consumers to participate in the future of financial services onchain,” said Max Branzburg, Head of Consumer & Business Products at Coinbase.

As of August, 2025, more than half of the 25 largest banks in the United States are now either considering or actively rolling out crypto-related products. Digital financial assets (DFA) afford financial institutions the opportunity to establish novel revenue streams and expand market presence by facilitating cryptocurrency access without geographical constraints. Institutions integrating digital asset services can have significant advantages in financial inclusion and benefit from the enhanced transaction speed, settlement finality, and automation inherent in smart contracts. Additionally, the adoption of blockchain technology promotes heightened security and substantial operational efficiencies within the existing financial framework.

State chartered banks and credit unions are regulated by the Department of Financial Protection and Innovation, not the OCC. Despite progress on the Digital Financial Asset Law (DFAL), there is no pathway for banks and credit unions to participate in an emerging and global market.

[…]

This bill comes at a time when it appears that federal DFA regulation is on the precipice of passage. Congress has been at an impasse on the CLARITY Act, a bill aimed at establishing a comprehensive regulatory framework for digital assets, dividing oversight between the Securities and Exchange Commission (SEC) and the Commodity Futures Trading Commission (CFTC).

1. What this bill would do. This bill would establish a comprehensive regulatory framework governing how banks and credit unions in California manage digital financial assets on behalf of customers. The bill requires financial institutions to clearly define whether they are acting in a fiduciary or nonfiduciary capacity, obtain customer consent through written agreements, and provide key disclosures about risks, insurance status, and control of assets. The bill also imposes strict requirements around safeguarding customer assets, including maintaining full one-to-one reserves, keeping accurate ownership records, and ensuring that customer assets remain the property of the customer. The bill regulates emerging practices like staking and subcustody by requiring transparency, limiting fees, mandating timely payment of rewards, and ensuring that institutions retain responsibility even when using third parties. The bill also establishes robust compliance obligations, including annual audits, anti-money laundering programs, and cybersecurity standards aligned with federal frameworks, along with rapid breach notification requirements. Finally, the bill grants enforcement authority to the Department of Financial Protection and Innovation, including the ability to issue orders, impose penalties, and suspend or revoke a financial institution’s authority to engage in digital asset activities.
   

This committee’s jurisdiction is limited to the cybersecurity provisions of this bill. Taking what they describe as a “support in concept” position, a coalition that includes California’s Credit Unions, the California Bankers Association, and the California Community Banking Network request that the bill avoid creating duplicative cybersecurity requirements:

State-chartered federally insured financial institutions are already subject to oversight by Department of Financial Protection and Innovation (DFPI), the California Department of Justice (DOJ) and federal prudential regulators for cybersecurity incidents. AB 2285 should not add new, duplicative requirements.

The author may wish to consider working with DFPI, DOJ, and federal regulators to align this bill with existing frameworks.

REGISTERED SUPPORT / OPPOSITION:

Support

None on file.

Opposition

None on file.

Analysis Prepared by: Slater Sharp / P. & C.P. / (916) 319-2200

Date of Hearing:

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Rebecca Bauer-Kahan, Chair

ABPCA Bill Id:AB 2285 (

Author:Valencia) – As Amended Ver:March 16, 2026

SUBJECT: Digital Financial Asset Banking Act

SYNOPSIS

The rapid growth of digital assets like cryptocurrencies has outpaced existing financial regulations, leaving gaps in how banks safeguard customer assets, manage risks, and disclose key information. As traditional financial institutions begin offering digital asset services, a clear regulatory framework is needed to ensure consistent standards, accountability, and trust in these emerging markets.

This bill would establish a comprehensive regulatory framework governing how banks and credit unions in California can custody, manage, and transact in digital financial assets on behalf of customers. A coalition composed of California’s Credit Unions, the California Bankers Association, and the California Community Banking Network take a “support in concept” position on the bill, mostly wishing to see the bill’s requirements align with existing state and federal law. The bill has no formal opposition.

This committee’s jurisdiction is limited to the cybersecurity provisions of this bill. The bill will be heard by the Banking and Finance Committee one day before it is heard by this committee.

EXISTING LAW:

1. Defines “digital financial asset administration” to mean issuing a digital financial asset with the authority to redeem the digital financial asset for legal tender, bank or credit union credit, or another digital financial asset. (Fin. Code § 3201(h).)
2. Defines “digital financial asset business activity” to mean any of the following:
   1. Exchanging, transferring, or storing a digital financial asset or engaging in digital financial asset administration, whether directly or through an agreement with a digital financial asset control services vendor.
   2. Holding electronic precious metals or electronic certificates representing interests in precious metals on behalf of another person or issuing shares or electronic certificates representing interests in precious metals.
   3. Exchanging one or more digital representations of value used within one or more online games, game platforms, or family of games for either of the following:
      1. A digital financial asset offered by or on behalf of the same publisher from which the original digital representation of value was received.
      2. Legal tender or bank or credit union credit outside the online game, game platform, or family of games offered by or on behalf of the same publisher from which the original digital representation of value was received. (Fin. Code § 3102(i).)
3. Requires a person conducting digital financial business activity to obtain a license as a covered person. (Fin. Code § 3102.)
4. Requires a covered person to disclose specified business activity the covered person will undertake with a resident before engaging in digital financial asset business activity with the resident. (Fin. Code § 3501.)

THIS BILL:

1. Defines the following terms:
   1. “Active staking” means intentional participation in staking services resulting in inaccessibility to one’s digital financial asset for an agreed-upon time in exchange for a staking reward minus a fee that is in a fixed amount or a percentage of the staking reward.
   2. “Customer” means a person for whom a financial institution provides digital asset services, including a digital asset account holder or a person on whose behalf the financial institution acts in a fiduciary capacity.
   3. “Department” means the Department of Financial Protection and Innovation.
   4. “Digital asset” means a digital representation of value recorded on a cryptographically secured, distributed ledger or similar technology, including, but not limited to, a digital financial asset.
   5. “Digital asset custody services” means the safekeeping or custody of a digital financial asset on behalf of a customer by a financial institution, including maintaining control over the digital financial asset and any associated key.
   6. “Digital asset transaction services” means to facilitate the execution of a digital asset purchase or sale on behalf of a customer for compensation.
   7. “Digital financial asset” means a digital representation of value that is used as a medium of exchange, unit of account, or store of value, and that is not legal tender, whether or not denominated in legal tender.
   8. “Digital financial asset business activity” means any of the following:
      
      1. Exchanging, transferring, or storing a digital financial asset or engaging in digital financial asset administration, whether directly or through an agreement with a digital financial asset control services vendor.
         
      2. Holding electronic precious metals or electronic certificates representing interests in precious metals on behalf of another person or issuing shares or electronic certificates representing interests in precious metals.
         
      3. Exchanging one or more digital representations of value used within one or more online games, game platforms, or family of games for either of the following:
         
         1. A digital financial asset offered by, or on behalf of, the same publisher from which the original digital representation of value was received.
            
         2. Legal tender or bank or credit union credit outside of the online game, game platform, or family of games offered by, or on behalf of, the same publisher from which the original digital representation of value was received.
            
   9. “Digital wallet” means a digital interface or physical device that stores a digital asset or a private key in a manner that enables the owner to securely manage, transfer, and maintain independent control over the owner’s digital asset.
      
   10. “Fiduciary capacity” means a capacity in which a financial institution possesses investment, management, or administration discretion of a digital financial asset on behalf of a customer that creates for the financial institution a strict duty to act in the best financial interest of the customer, including against its own interest.
       
   11. “Financial institution” means a bank or credit union operating under the examination authority of the Department of Financial Protection and Innovation (DFPI).
       
   12. “Key” means a pair of cryptographic codes associated with a digital asset wallet that consists of a public key and a private key that meets both of the following criteria:
       
       1. The public key of the pair enables the receipt of a digital financial asset and the verification of a digital signature.
          
       2. The private key of the pair enables the control, transfer, or management of a digital asset within the digital asset wallet.
          
   13. “Material cybersecurity incident” means a cybersecurity breach or event that materially compromises the security, confidentiality, or integrity of a financial institution’s information system or a digital asset under the financial institution’s control.
       
   14. “Nonfiduciary capacity” means providing digital asset custody services solely for safekeeping without discretionary authority to manage or transfer a digital financial asset and with respect to which legal title and control of the assets remain with the customer.
       
   15. “Passive staking” means staking pooled assets by, or on behalf of, the financial institution wherein the customer may receive the customer’s digital financial asset upon demand in exchange for a staking reward minus an agreed-upon fee, in a fixed amount or a percentage of the staking reward, from the financial institution staking service provider.
       
   16. “Pooled custody” means the collective holding of fungible digital financial assets of like kind belonging to different customers in a shared account or digital asset wallet.
       
   17. “Segregated custody” means the holding separately from the digital financial assets of other customers of the fungible digital financial assets of an individual customer in an account or digital asset wallet.
   18. “Slashing” means a penalty imposed by a blockchain protocol that results in the forfeiture or reduction of staked digital assets or staking rewards due to validator misconduct or failure.
   19. “Staking” means committing fungible digital financial assets to a blockchain network to participate in the network’s operations by validating transactions, proposing and attesting to blocks, and securing the network.
   20. “Staking reward” means any interest, yield, or other compensation earned by a customer from staking a digital financial asset on a blockchain network.
   21. “Subcustodian” means a third party that a financial institution uses to hold a digital financial asset on the financial institution’s behalf as part of providing digital asset custody services to a customer.
2. Permits state-chartered financial institutions to offer digital financial asset (DFA) retail services under specified requirements.
3. Requires annual auditing of custodial services by way of independent audit or review and signed attestation of the DI’s Board of Directors.
4. Requires consumer disclosures, as specified.
5. Provides a framework for the payment of fees or commissions for staking services. 
6. Requires financial institutions adopt anti-money laundering measures, as specified.
7. Requires a financial institution and any of its subcustodians to maintain a cybersecurity program designed to protect the confidentiality, integrity, and availability of the financial institution’s information systems, digital asset custody, and staking software and hardware that is based on the financial institution’s risk assessment and designed to perform all of the following functions:
   1. Identifying and assessing internal and external cybersecurity risks that threaten the security or integrity of nonpublic information stored on the financial institution’s information systems as it relates to the digital financial assets of its customers.
   2. Using defensive infrastructure and the implementation of policies and procedures to protect the financial institution’s information systems, and the nonpublic information stored on those information systems, from unauthorized access, use, or other malicious acts.
   3. Detecting cybersecurity events.
   4. Responding to identified or detected cybersecurity events to mitigate any negative effects.
   5. Recovering from cybersecurity events and restoring normal operations and services.
   6. Fulfilling applicable regulatory reporting obligations.
8. Requires that any information relevant to the financial institution’s cybersecurity program, including the relevant and applicable provisions of a cybersecurity program maintained by any subcustodian, be made available to the department upon request.
9. Requires that the cybersecurity program for a financial institution and any of its subcustodians align with applicable federal cybersecurity standards for financial institutions, including, but not limited to, the guidelines of the Federal Financial Institutions Examination Council (FFIEC) Information Technology Examination Handbook, the framework established by the National Institute of Standards and Technology (NIST), and any other standard deemed applicable by the department and shall comply with applicable federal financial privacy and data security requirements, as determined by the department.
10. Requires a financial institution to notify the department within 72 hours after discovering any material cybersecurity incident that impacts the financial institution or its subcustodian’s digital asset custody or staking software or hardware or any digital financial asset held or managed through those systems. Requires the notice to include a description of the incident and its likely impact on the financial institution and its customers, as prescribed by the department.
11. Requires a financial institution to maintain, for at least seven years, detailed records of its cybersecurity compliance efforts, including any policy, procedure, risk assessment, audit report, or training material related to its cybersecurity program. Requires the financial institution to make those records available for inspection by the department upon request or during any examination.

COMMENTS:

1. Author’s statement. According to the author:

As federal regulations continue to evolve, California banks need the tools to responsibly integrate this technology into their existing systems, while ensuring consumers are protected from potential mismanagement of digital assets.

Blockchain technology is increasingly shaping the future, with new applications emerging across everyday use cases. By providing our state-chartered banks and credit unions, the go-to choice for many residents, a responsible framework for offering this technology, we give our state financial institutions a reputational advantage from the start.”

AB 2285 provides an innovative and modern framework for California banks seeking to offer digital asset services, positioning California to lead in balancing strong consumer protections with continued innovation in the digital asset space

1. Background. The Assembly Banking and Finance Committee explains recent developments related to financial institutions managing digital financial assets in their bill analysis:

In May, 2025, the Office of the Comptroller of the Currency (OCC) which oversees nearly 4,000 federal institutions across the country, issued guidance to clarify that national banks and federal savings associations can buy and sell digital financial assets held in custody at its customer’s direction if they follow the practices they use for traditional assets. This clarification also included the permissibility of the use of third-party sub-custodians. Since this guideline was issued, five applications to either newly charter or convert existing institutions into national trust banks that will engage in digital financial asset activity have been conditionally approved.

On July 30, 2025, JP Morgan Chase issued an announcement regarding its partnership with Coinbase to offer seamless bank to exchange access. “We’re excited to partner with JP Morgan Chase to onboard the next generation of consumers into crypto. Together, we are expanding choice and lowering barriers to entry for consumers to participate in the future of financial services onchain,” said Max Branzburg, Head of Consumer & Business Products at Coinbase.

As of August, 2025, more than half of the 25 largest banks in the United States are now either considering or actively rolling out crypto-related products. Digital financial assets (DFA) afford financial institutions the opportunity to establish novel revenue streams and expand market presence by facilitating cryptocurrency access without geographical constraints. Institutions integrating digital asset services can have significant advantages in financial inclusion and benefit from the enhanced transaction speed, settlement finality, and automation inherent in smart contracts. Additionally, the adoption of blockchain technology promotes heightened security and substantial operational efficiencies within the existing financial framework.

State chartered banks and credit unions are regulated by the Department of Financial Protection and Innovation, not the OCC. Despite progress on the Digital Financial Asset Law (DFAL), there is no pathway for banks and credit unions to participate in an emerging and global market.

[…]

This bill comes at a time when it appears that federal DFA regulation is on the precipice of passage. Congress has been at an impasse on the CLARITY Act, a bill aimed at establishing a comprehensive regulatory framework for digital assets, dividing oversight between the Securities and Exchange Commission (SEC) and the Commodity Futures Trading Commission (CFTC).

1. What this bill would do. This bill would establish a comprehensive regulatory framework governing how banks and credit unions in California manage digital financial assets on behalf of customers. The bill requires financial institutions to clearly define whether they are acting in a fiduciary or nonfiduciary capacity, obtain customer consent through written agreements, and provide key disclosures about risks, insurance status, and control of assets. The bill also imposes strict requirements around safeguarding customer assets, including maintaining full one-to-one reserves, keeping accurate ownership records, and ensuring that customer assets remain the property of the customer. The bill regulates emerging practices like staking and subcustody by requiring transparency, limiting fees, mandating timely payment of rewards, and ensuring that institutions retain responsibility even when using third parties. The bill also establishes robust compliance obligations, including annual audits, anti-money laundering programs, and cybersecurity standards aligned with federal frameworks, along with rapid breach notification requirements. Finally, the bill grants enforcement authority to the Department of Financial Protection and Innovation, including the ability to issue orders, impose penalties, and suspend or revoke a financial institution’s authority to engage in digital asset activities.
   

This committee’s jurisdiction is limited to the cybersecurity provisions of this bill. Taking what they describe as a “support in concept” position, a coalition that includes California’s Credit Unions, the California Bankers Association, and the California Community Banking Network request that the bill avoid creating duplicative cybersecurity requirements:

State-chartered federally insured financial institutions are already subject to oversight by Department of Financial Protection and Innovation (DFPI), the California Department of Justice (DOJ) and federal prudential regulators for cybersecurity incidents. AB 2285 should not add new, duplicative requirements.

The author may wish to consider working with DFPI, DOJ, and federal regulators to align this bill with existing frameworks.

REGISTERED SUPPORT / OPPOSITION:

Support

None on file.

Opposition

None on file.

Analysis Prepared by: Slater Sharp / P. & C.P. / (916) 319-2200

Date of Hearing: April 20, 2026

ASSEMBLY COMMITTEE ON BANKING AND FINANCE

Avelino Valencia, Chair

ABPCA Bill Id:AB 2285 (

Author:Valencia) – As Amended Ver:March 16, 2026

SUBJECT: Digital Financial Asset Banking Act

SUMMARY: Specifically, this bill:

1. Provides state-chartered financial institutions the ability to offer digital financial asset (DFA) retail services under specified requirements. 
2. Defines “active staking” to mean intentional participation in staking services resulting in inaccessibility to one’s digital financial asset for an agreed-upon time in exchange for a staking reward minus a fee that is in a fixed amount or a percentage of the staking reward.
3. Defines “passive staking” to mean staking pooled assets by, or on behalf of, the financial institution wherein the customer may receive the customer’s digital financial asset upon demand in exchange for a staking reward minus an agreed-upon fee, in a fixed amount or a percentage of the staking reward, from the financial institution staking service provider.
4. Defines “fiduciary capacity” to mean a capacity in which a financial institution possesses investment, management, or administration discretion of a digital financial asset on behalf of a customer that creates for the financial institution a strict duty to act in the best financial interest of the customer, including against its own interest.
5. Defines “nonfiduciary capacity” to mean providing digital asset custody services solely for safekeeping without discretionary authority to manage or transfer a digital financial asset and with respect to which legal title and control of the assets remain with the customer.
6. Defines “financial institution” means a bank or credit union operating under the examination authority of the Department of Financial Protection and Innovation (DFPI).
7. Defines “pooled custody” to mean the collective holding of fungible digital financial assets of like kind belonging to different customers in a shared account or digital asset wallet.
8. Defines “segregated custody” to mean the holding separately from the digital financial assets of other customers of the fungible digital financial assets of an individual customer in an account or digital asset wallet.
9. Defines “slashing” to mean a penalty imposed by a blockchain protocol that results in the forfeiture or reduction of staked digital assets or staking rewards due to validator misconduct or failure.
10. Defines “staking” to mean committing fungible digital financial assets to a blockchain network to participate in the network’s operations by validating transactions, proposing and attesting to blocks, and securing the network.
11. Defines “staking reward” to mean any interest, yield, or other compensation earned by a customer from staking a digital financial asset on a blockchain network.
12. Provides requirements, as specified, for fiduciary and non-fiduciary custody of DFA.
13. Provides requirements, as specified, for custodial services including the use of third-party services. 
14. Provides requirements for annual auditing of custodial services by way of independent audit or review and signed attestation of the DI’s Board of Directors.
15. Provides minimum requirements for consumer disclosures.
16. Provides a framework for the payment of fees or commissions for staking services. 
17. Provides anti-money laundering and cybersecurity compliance requirements.

EXISTING LAW:

California DFAL:

1. Defines “digital financial asset administration” to mean issuing a digital financial asset with the authority to redeem the digital financial asset for legal tender, bank or credit union credit, or another digital financial asset. Financial Code (Fin.Code) section 3201(h). 
2. Defines “digital financial asset business activity” to mean any of the following:
   1. Exchanging, transferring, or storing a digital financial asset or engaging in digital financial asset administration, whether directly or through an agreement with a digital financial asset control services vendor.
   2. Holding electronic precious metals or electronic certificates representing interests in precious metals on behalf of another person or issuing shares or electronic certificates representing interests in precious metals.
   3. Exchanging one or more digital representations of value used within one or more online games, game platforms, or family of games for either of the following:
      1. A digital financial asset offered by or on behalf of the same publisher from which the original digital representation of value was received.
      2. Legal tender or bank or credit union credit outside the online game, game platform, or family of games offered by or on behalf of the same publisher from which the original digital representation of value was received. Fin.Code section 3102 (i).
3. Requires persons conducting digital financial business activity to obtain a license as a covered person. Fin.Code section 3102. 
4. Before engaging in digital financial asset business activity with a resident, a covered person shall disclose, to the extent applicable to the digital financial asset business activity the covered person will undertake with the resident, all of the following:
   1. A schedule of fees and charges the covered person may assess, the manner by which fees and charges will be calculated if they are not set in advance and disclosed, and the timing of the fees and charges.
   2. Whether the product or service provided by the covered person is covered by either of the following:
      1. A form of insurance or other guarantee against loss by an agency of the United States as follows:
         1. Up to the full United States dollar equivalent of digital financial assets placed under the control of, or purchased from, the covered person as of the date of the placement or purchase, including the maximum amount provided by insurance under the Federal Deposit Insurance Corporation, National Credit Union Share Insurance Fund, or otherwise available from the Securities Investor Protection Corporation.
         2. If not provided at the full United States dollar equivalent of the digital financial asset placed under the control of or purchased from the covered person, the maximum amount of coverage for each resident expressed in the United States dollar equivalent of the digital financial asset.
      2. Private insurance against theft or loss, including cybertheft or theft by other means.
   3. Upon request of a resident with whom a covered person engages in digital financial asset business activity, a covered person shall disclose the terms of the insurance policy to the resident in a manner that allows the resident to understand the specific insured risks that may result in partial coverage of the resident’s assets.
   4. The irrevocability of a transfer or exchange and any exception to irrevocability.
   5. A description of all of the following:
      1. The covered person’s liability for an unauthorized, mistaken, or accidental transfer or exchange.
      2. The resident’s responsibility to provide notice to the covered person of an unauthorized, mistaken, or accidental transfer or exchange.
      3. The basis for any recovery by the resident from the covered person in case of an unauthorized, mistaken, or accidental transfer or exchange.
      4. General error resolution rights applicable to an unauthorized, mistaken, or accidental transfer or exchange.
      5. The method for the resident to update the resident’s contact information with the covered person.
   6. That the date or time when the transfer or exchange is made and the resident’s account is debited may differ from the date or time when the resident initiates the instruction to make the transfer or exchange.
   7. Whether the resident has a right to stop a preauthorized payment or revoke authorization for a transfer and the procedure to initiate a stop-payment order or revoke authorization for a subsequent transfer.
   8. The resident’s right to receive a receipt, trade ticket, or other evidence of the transfer or exchange.
   9. The resident’s right to at least 14 days’ prior notice of a change in the covered person’s fee schedule, other terms and conditions that have a material impact on digital financial asset business activity with the resident, or the policies applicable to the resident’s account.
   10. That no digital financial asset is currently recognized as legal tender by California or the United States.
   11. A list of instances in the past 12 months when the covered person’s service was unavailable to 10,000 or more customers seeking to engage in digital financial asset business activity due to a service outage on the part of the covered person and the causes of each identified service outage.
       1. As part of the disclosure required by this paragraph, the covered person may list any steps the covered person has taken to resolve underlying causes for those outages. Fin.Code section 3501.

California Banking and Credit Union

1. California Law regulates, through examination, state chartered banks and credit unions under the authority of the Department of Financial Protection and Innovation (DFPI). Fin.Code section 1000-1901 and Fin.Code section 14000-16906.

FISCAL EFFECT: Unknown. This bill is keyed Fiscal by Legislative Counsel.

COMMENTS:

1. Purpose

Statement from the Author

"As federal regulations continue to evolve, California banks need the tools to responsibly integrate this technology into their existing systems, while ensuring consumers are protected from potential mismanagement of digital assets. 

Blockchain technology is increasingly shaping the future, with new applications emerging across everyday use cases. By providing our state-chartered banks and credit unions, the go-to choice for many residents, a responsible framework for offering this technology, we give our state financial institutions a reputational advantage from the start.”

AB 2285 provides an innovative and modern framework for California banks seeking to offer digital asset services, positioning California to lead in balancing strong consumer protections with continued innovation in the digital asset space."

1. Background

In May, 2025, the Office of the Comptroller of the Currency (OCC) which oversees nearly 4,000 federal institutions across the country, issued guidance to clarify that national banks and federal savings associations can buy and sell digital financial assets held in custody at its customer’s direction if they follow the practices they use for traditional assets. This clarification also included the permissibility of the use of third-party sub-custodians. Since this guideline was issued, five applications to either newly charter or convert existing institutions into national trust banks that will engage in digital financial asset activity have been conditionally approved. 

On July 30, 2025, JP Morgan Chase issued an announcement regarding its partnership with Coinbase to offer seamless bank to exchange access. “We’re excited to partner with JPMorganChase to onboard the next generation of consumers into crypto. Together, we are expanding choice and lowering barriers to entry for consumers to participate in the future of financial services onchain,” said Max Branzburg, Head of Consumer & Business Products at Coinbase. 

As of August, 2025, more than half of the 25 largest banks in the United States are now either considering or actively rolling out crypto-related products.^[1] Digital financial assets (DFA) afford financial institutions the opportunity to establish novel revenue streams and expand market presence by facilitating cryptocurrency access without geographical constraints. Institutions integrating digital asset services can have significant advantages in financial inclusion and benefit from the enhanced transaction speed, settlement finality, and automation inherent in smart contracts. Additionally, the adoption of blockchain technology promotes heightened security and substantial operational efficiencies within the existing financial framework.

State chartered banks and credit unions are regulated by the Department of Financial Protection and Innovation, not the OCC. Despite progress on the Digital Financial Asset Law (DFAL), there is no pathway for banks and credit unions to participate in an emerging and global market. 

1. What this bill does
2. Custody Service and Accuracy

This bill requires a DI to enter a written contract with its customer^[2] with clear disclosures regarding whether or not the relationship is fiduciary or non-fiduciary, If the relationship is non-fiduciary, the agreement must make clear that the DI will only act on the customer’s explicit instructions. In either a fiduciary or non-fiduciary relationship the agreement must clearly disclose whether or not the DFA held in custody by the DI are insured by the Federal Deposit Insurance Corporation, the National Credit Union Administration, or any other federal or state deposit insurance or share insurance program, and Whether or not a DFA held in custody by the DI is a deposit, obligation, or other liability of the DI. This bill requires disclosure of any thresholds or triggering mechanisms that may cause a DI to take action on a customer’s behalf in a fiduciary relationship.  And the bill requires any changes to the agreement to be provided to the customer 45 days before its effective date. 

As to the funds itself, this bill requires at least a one-to-one reserve of each type of digital asset held in passive staking. This is to ensure demand withdrawals can be executed. The bill prohibits the pooling of DFA unless the DI maintains accurate records to identify each customer’s specific interests in the DFA. To ensure compliance, annual independent auditing or review and certification by the entire board of directors is required. 

1. Third party activity and engagement

A DI may use a third party contractor to conduct digital asset custody services, however, use of the subcustodian must be prominently disclosed on the first page of the agreement. The bill puts the onus on the DI to ensure compliance with the requirements of this bill, which include: 1) insurance to protect against breaches or theft and  2) licensure under DFAl, money transmitters law. The agreement between the DI and the subcustodian must be structured to maintain the DI as the custodial recordholder of the DFA, and that the DFA remains the property of the DI’s customers. 

1. Staking Services and Fiduciary DFA transaction authority 

This bill requires disclosures of the following information regarding staking services: 

1. The fact that the DI may automatically stake an eligible DFA in the customer’s account unless the customer affirmatively opts out of participation.
2. The key risks associated with staking, including the potential for loss of staked assets or staking rewards due to slashing or other network events, and cybersecurity or operational risks inherent in the staking process.
3. Any applicable lockup, unbonding, or notice period before a staked DFA can be withdrawn or transferred and the implications of that period for the customer’s access to the customer’s digital financial assets.
4. The customer’s rights and obligations related to the staking service, including the right to discontinue participation in staking at any time and the entitlement to receive staking rewards earned on the customer’s digital financial assets.
5. The amount or rate of any fee or commission that the DI will deduct from a staking reward as compensation for providing staking services.

AB 2285 requires the DI to identify policies and procedures to protect from, effectively identify, monitor, and manage risks associated with staking, including operational risks, cybersecurity threats, and slashing.

This bill adds specifications to the management of DFA trading activity, whether automated or not. The required specifications speak to transparency and accountability of money, returns, and losses. 

1. Ongoing Considerations

Non-DI digital asset exchanges have raised concerns that these higher standards and practices may become a precedent for their industry, whether in whole or in part. Some potential DI’s have raised concerns with some terms of the bill, specifically regarding: auditing, fee cap rigidity, slashing insurance requirement, 45-day contract amendment notice, and cybersecurity incidents. Stakeholders have also requested to put the state law in parity with the federal law. 

This bill comes at a time when it appears that federal DFA regulation is on the precipice of passage. Congress has been at an impasse on the CLARITY Act, a bill aimed at establishing a comprehensive regulatory framework for digital assets, dividing oversight between the Securities and Exchange Commission, (SEC) and the Commodity Futures Trading Commission (CFTC). One benefit of late-night, marathon analysis writing is getting news first; during this writing, an update on the closely followed bill was released,^[3] noting that lawmakers are nearing an agreement with only two to three issues remaining. One of those issues is whether platforms should be able to issue yield-like rewards on fiat-backed digital assets (stablecoin) to users. Banks contend that allowing yield will cause deposits to move from insured bank accounts to less regulated stablecoins, threatening traditional lending capacity. 

The author has agreed to continue dialogue with stakeholders as the CLARITY Act moves through the Senate in Congress.

REGISTERED SUPPORT / OPPOSITION:

Support

Last verified 4/16/26.

Blockchain Cooperative Coalition

Satoshi Action Fund

Opposition

Last verified 4/16/26.

None Received.

Analysis Prepared by: Desiree NguyenOrth / B. & F. / (916) 319-3081

1. “The Majority of the US’s Largest Banks Have Embraced Crypto Services”, Bank Exchange (2025, August, 11) ↑

2.  Customers of credit unions are normally referred to as “members”. For purposes of this analysis, the term “customer” will be used to mean both bank customers and credit union members. ↑

3. https://www.coindesk.com/policy/2026/04/15/jpmorgan-says-clarity-close-to-deal-as-stablecoin-fight-enters-final-stage ↑